mirror of
https://github.com/allaunthefox/Research-Stack.git
synced 2026-07-31 03:05:21 +00:00
bd5eaadce9
k3s-edge.nix: - Added 'ca https://acme-v02.api.letsencrypt.org/directory' to porkbun_tls snippet - Forces production LE instead of staging fix-racknerd-tls.sh: - Checks current Porkbun keys (redacted) - Verifies production LE CA is configured - Provides deploy and restart instructions - Documents how to update Porkbun API keys via sops
47 lines
1.6 KiB
Bash
Executable file
47 lines
1.6 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Fix Caddy TLS on racknerd
|
|
# 1. Update Porkbun API keys via sops
|
|
# 2. Deploy updated NixOS config with production LE CA
|
|
# 3. Restart Caddy
|
|
#
|
|
# Usage: ./fix-racknerd-tls.sh
|
|
# Prerequisites: sops age key configured, SSH access to racknerd
|
|
|
|
set -euo pipefail
|
|
|
|
RACKNERD_IP="100.80.39.40"
|
|
RACKNERD_SSH="root@${RACKNERD_IP}"
|
|
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
|
|
SECRETS_DIR="${SCRIPT_DIR}/secrets"
|
|
|
|
echo "=== Step 1: Check current Porkbun keys ==="
|
|
echo "Current keys (redacted):"
|
|
sops --input-type yaml --output-type yaml -d "${SECRETS_DIR}/porkbun-env.age" 2>/dev/null | sed 's/pk1_[^ ]*/pk1_***/' | sed 's/sk1_[^ ]*/sk1_***/'
|
|
|
|
echo ""
|
|
echo "=== Step 2: Verify production LE CA is in config ==="
|
|
grep -n "acme-v02" "${SCRIPT_DIR}/k3s-edge.nix" && echo "✅ Production LE CA configured" || echo "❌ Production LE CA missing"
|
|
|
|
echo ""
|
|
echo "=== Step 3: Deploy to racknerd ==="
|
|
echo "To deploy the NixOS config with production LE CA:"
|
|
echo " ssh ${RACKNERD_SSH} 'cd /etc/nixos && sudo nixos-rebuild switch'"
|
|
echo ""
|
|
echo "Or if using deploy-rs:"
|
|
echo " deploy .#racknerd --hostname ${RACKNERD_IP}"
|
|
echo ""
|
|
echo "After deploy, restart Caddy:"
|
|
echo " ssh ${RACKNERD_SSH} 'sudo systemctl restart caddy'"
|
|
echo ""
|
|
echo "Verify:"
|
|
echo " ssh ${RACKNERD_SSH} 'sudo journalctl -u caddy -n 20'"
|
|
echo " curl -vI https://researchstack.info 2>&1 | grep -i issuer"
|
|
|
|
echo ""
|
|
echo "=== Step 4: If Porkbun keys are invalid ==="
|
|
echo "1. Go to https://porkbun.com/account/api"
|
|
echo "2. Generate new API key pair"
|
|
echo "3. Edit the secret:"
|
|
echo " sops ${SECRETS_DIR}/porkbun-env.age"
|
|
echo "4. Replace PORKBUN_API_KEY and PORKBUN_SECRET_KEY"
|
|
echo "5. Redeploy (Step 3)"
|