stut / aleff

Automated Let's Encrypt For Fabio

See https://aleff.dev/ for usage documentation.

Related repo: https://github.com/stut/aleff-challenge-responder

aleff's Issues

Add enable/disable tags

It's possible that not all domain names should get an SSL certificate. This feature would add aleff-enabled and aleff-disabled tag detection to enable or disable the fetching of certificates. This will also need an option to set the default (i.e. opt-in or opt-out) - suggest ALEFF_DEFAULT=enabled/disabled as the environment variable for that, defaulting to enabled if not present.

Support arm64 as well as amd64

Make the challenge responder startup time configurable

Add an environment variable for the maximum amount of time to wait for the challenge responder job to start up. It's currently hard-coded to 60 seconds, but it could take longer on a busy cluster so it needs to be configurable.

Add wildcard support

Challenge responder doesn't get shutdown if it fails to respond correctly before the timeout

Use the configured prefix for the tag when launching the challenge responder job

Currently, if you're using a custom prefix for Fabio the challenge responder job will not be configured correctly.,

Challenge-Responder not launching in Nomad TLS environment

I am trying to get Aleff going on a cluster where Nomad TLS is in use. The main Aleff job is running, but I see the following in the STDERR log:

2023/03/07 14:24:30 [INFO] aleff: Running...
2023/03/07 14:24:30 [INFO] [echo.xxxxxxxxxx.com] aleff: Requesting new certificate...
2023/03/07 14:24:30 [INFO] [echo.xxxxxxxxxx.com] acme: Obtaining SAN certificate
2023/03/07 14:24:30 [INFO] [echo.xxxxxxxxxx.com] AuthURL: https://acme-v02.api.letsencrypt.org/acme/authz-v3/208950xxxxxx
2023/03/07 14:24:30 [INFO] [echo.xxxxxxxxxx.com] acme: Could not find solver for: tls-alpn-01
2023/03/07 14:24:30 [INFO] [echo.xxxxxxxxxx.com] acme: use http-01 solver
2023/03/07 14:24:30 [INFO] [echo.xxxxxxxxxx.com] acme: Trying to solve HTTP-01
2023/03/07 14:24:30 [INFO] [echo.xxxxxxxxxx.com] aleff: Starting challenge responder...
2023/03/07 14:24:30 [INFO] Deactivating auth: https://acme-v02.api.letsencrypt.org/acme/authz-v3/208950xxxxx
2023/03/07 14:24:31 [WARN] [echo.xxxxxxxxxx.com] aleff: Error: error: one or more domains had a problem:
[echo.xxxxxxxxxx.com] [echo.xxxxxxxxxx.com] acme: error presenting token: tls: failed to find any PEM data in certificate input
2023/03/07 14:24:31 [INFO] aleff: Donw.

I never see the Challenge-Responder job launched in the Nomad UI nor registered as a route in Fabio. I believe the issue may have to do with Aleff's submission of the job in a TLS environment.

I have templated the necessary .PEM files and set environment variables for them as NOMAD_CACERT, NOMAD_CLIENT_CERT and NOMAD_CLIENT_KEY. I have checked that the files are being properly created in the secrets directory by inspecting them on the host. All are world readable within secrets, so I do not think it is a permissions issue. I have also confirmed that the challenge-responder.hcl job is correctly written to the local directory.

I am at a loss as to what to try next. Any idea why the challenge-responder won't launch?

Implement Vault certificate store

It would be great if the Vault certificate store was optionally available instead of the Consul one.
https://fabiolb.net/feature/certificate-stores/#vault

Add a configuration option to disable launching the challenge responder job

When running outside a Nomad cluster this feature should be disabled.

Implement metrics

Metrics would be really useful, personally I'd want to start with Prometheus but obviously other metrics tooling and mechanisms are available!