be77f1eb2f
Sister to s8n/production-deb. Edge-box config + provision script for
running the OpenBSD-edge role per s8n/production-setup-audit Topology 02.
v0.1 = stock OpenBSD install ISO (interactive, 5 min) + scripted provision
from onyx. Autoinstall ISO build deferred to v0.2.
Layout:
README.md workflow + service mapping (Debian → OpenBSD)
flash.sh burn stock install76.iso to USB
etc/ pf / relayd / acme-client / unbound /
hostname.wg0.example / sshd_config / doas.conf
scripts/
provision.sh from onyx: SSH+git clone+run install.sh
install.sh on edge: copy /etc/*, validate, restart, cron
cert-renew-check.sh weekly LE renewal
read-logs.sh pull /var/log/* for offline diagnostics
docs/
setup-checklist.md 7-phase first-time install walkthrough
Hardware target: Dell Precision T5600 per
s8n/production-setup-audit/hardware/dell-t5600.md
WG mesh: 10.10.10.0/29 between edge (.1) and nullstone (.2). UDP 51820.
Keys generated per-host (NEVER committed to repo).
Public traffic flow after migration:
Internet → router → edge T5600 (relayd TLS term) → wg0 →
nullstone Traefik (10.10.10.2:8443, private only)
CVE delta vs single-host Debian: regreSSHion + xz backdoor mitigated;
public IP runs OpenBSD base only — no systemd, no glibc, no Docker.
38 lines
1.3 KiB
Text
38 lines
1.3 KiB
Text
# /etc/acme-client.conf — Let's Encrypt via DNS-01 (Gandi)
|
|
#
|
|
# DNS-01 chosen because:
|
|
# - Doesn't expose port 80 to public during challenge
|
|
# - Allows wildcard certs (*.s8n.ru, *.veilor.uk)
|
|
# - Works behind WAF / restricted firewall
|
|
#
|
|
# Gandi LiveDNS API token in env var GANDI_TOKEN (set in rc.conf.local or
|
|
# pass via doas wrapper). Do NOT commit token to repo.
|
|
#
|
|
# Run: acme-client -v <domain>
|
|
# Auto-renew: weekly cron (see scripts/cert-renew-check.sh)
|
|
|
|
authority letsencrypt {
|
|
api url "https://acme-v02.api.letsencrypt.org/directory"
|
|
account key "/etc/acme/letsencrypt-privkey.pem"
|
|
}
|
|
|
|
# === s8n.ru wildcard ===
|
|
domain s8n.ru {
|
|
alternative names { "*.s8n.ru" "s8n.ru" }
|
|
domain key "/etc/ssl/private/s8n.ru.key"
|
|
domain certificate "/etc/ssl/s8n.ru.crt"
|
|
domain full chain certificate "/etc/ssl/s8n.ru.fullchain.pem"
|
|
sign with letsencrypt
|
|
challengedir "/var/www/acme"
|
|
# DNS-01 hook script: see scripts/gandi-dns-hook.sh
|
|
}
|
|
|
|
# === veilor.uk wildcard ===
|
|
domain veilor.uk {
|
|
alternative names { "*.veilor.uk" "veilor.uk" }
|
|
domain key "/etc/ssl/private/veilor.uk.key"
|
|
domain certificate "/etc/ssl/veilor.uk.crt"
|
|
domain full chain certificate "/etc/ssl/veilor.uk.fullchain.pem"
|
|
sign with letsencrypt
|
|
challengedir "/var/www/acme"
|
|
}
|