Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

Add LetsEncrypt support to PMM Server

Description

during pmmdemo.percona.com update we need to make a lot of manual steps to install letsencrypt certificates inside the container.
I propose to create docker variable LETSENCRYPT_DOMAIN for our usual container which will automate SSL certificates setup.

it is simple, it is needed to run only few commands

add the following lines to /etc/nginx/conf.d/pmm.conf # .well-known location /.well-known { alias /usr/share/pmm-server/.well-known; auth_basic off; } run commands # certbot certonly --agree-tos --register-unsafely-without-email --webroot -w /usr/share/pmm-server -d ${LETSENCRYPT_DOMAIN} # ln -f -s /etc/letsencrypt/live/${LETSENCRYPT_DOMAIN}/fullchain.pem /srv/nginx/certificate.crt # ln -f -s /etc/letsencrypt/live/${LETSENCRYPT_DOMAIN}/privkey.pem /srv/nginx/certificate.key # printf '#!/bin/bash\n\nexec /bin/certbot renew\nnginx -s reload\n' > /etc/cron.daily/certbot # chmod 755 /etc/cron.daily/certbot

Benefit:
all our users with public accessible PMM will have a possibility to get absolutely valid TLS/SSL certificates automatically for free.

How to test

None

How to document

None

Smart Checklist

Activity

Alexey Palazhchenko December 25, 2019 at 5:59 AM

David Bennett December 6, 2018 at 12:05 AM
Edited

I was able to get this to work.  Tested on 1.17.0 server.   A couple of notes:

  • nginx needs to be restarted after modifying pmm.conf  with systemctl restart nginx and before the certbot certonly call

  • nginx needs to be restarted again after certificates and key are linked.

I am not 100% sure,  but I think this may be needed for pmm-admin to work properly with let's encrypt certificate:

ln -f -s /etc/letsencrypt/live/${LETSENCRYPT_DOMAIN}/fullchain.pem /srv/nginx/ca-certs.pem

Manjot Singh October 31, 2017 at 8:33 PM

I think this would be useful.

Mykola Marzhan October 11, 2017 at 8:32 AM

,
what do you think?

Details

Assignee

Reporter

Priority

Labels

Needs QA

Yes

Needs Doc

Yes

Smart Checklist

Created October 11, 2017 at 8:31 AM
Updated March 27, 2024 at 2:58 PM

Flag notifications