Wildcard DNS in Let’s Encrypt with Go.CD, Ansible, FreeIPA and S3

When I started working on my own home-cloud (a weird term for a small self-sustained, bare-metal paid cloud on Hetzner) I needed a way to have trusted SSL certificates. I really, really hate the warning messages of the browsers when entering an self-signed site. One of my goals was to use Let’s Encrypt, put HAproxy in front of any and all services and have HAproxy do the SSL termination (and even internally, to have all services use Let’s Encrypt signed certificates).

As part of this small architecture (based on Proxmox in a cluster configuration) it was chosen also to deploy a 5-node FreeIPA cluster to manage DNS mostly but also I took advantage of other IdM features. Another goal was to implement the wildcard DNS challenge so that I wouldn’t have to configure each and every sub-domain I required (there were a couple of TLDs and a miriad of sub-domains which I already forgot their names).

Continue reading →

Getting there …

Another midnight catches me tinkering away at my own little cloud on the Internet. Since renting these 6 machines in Hetzner I’ve been literally hacking away for the past month on setting things up fully automated (that means also dns-01 challenges for all my domains automated with Ansible + FreeIPA for the core services, DNS included and tightening up security).

Out of all 6 machines, given 6TB per machine accumulated 36TB on top of which I put a few volumes of Gluster, two of them as “backup” and “ha-vms-root-fs” as I called it. Understandably, one is for (local, fast recovery) backups, doh, one is to host HA VMs declared as “resources” in Proxmox so the cluster takes care of making them HA if one machine fails). The one for backups in addition to TLK (TurnKey Linux) which provides the “tlkbam-backup” cron.

Continue reading →