Oier Bravo Urtasun
843347ad00
tooling/issue-letsencrypt.sh: manual script, issues one cert per name (apex + LE_SUBDOMAINS) with acme.sh + OVH DNS-01 (no inbound ports), installs to certs/<name>/ and reloads nginx. nginx/ulicraft.conf.tmpl: TLS vhosts for apex/pack (static) + auth (proxy to drasl). OVH creds and LE_EMAIL in .env.example; certs/ gitignored. plan/15-letsencrypt.md. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
43 lines
1.9 KiB
Plaintext
43 lines
1.9 KiB
Plaintext
# Copy to .env and fill in real values
|
|
|
|
# Single base domain for the whole stack; every service is a subdomain of this.
|
|
# Use .lan (NOT .local) — .local is intercepted by mDNS on macOS/Linux and
|
|
# won't resolve through a normal unicast DNS server.
|
|
BASE_DOMAIN=ulicraft.lan
|
|
# The Docker host's LAN IP — every service name resolves here.
|
|
HOST_LAN_IP=192.168.1.10
|
|
|
|
# mDNS toggle. true + BASE_DOMAIN=*.local → an Avahi container publishes the
|
|
# service names over mDNS (zero-config for macOS/Linux guests; Windows needs
|
|
# Bonjour). false → use your own party DNS (records: tooling/dns-records.sh).
|
|
# NOTE: mDNS resolves ONLY *.local; it cannot serve the air-gap upstream-host
|
|
# spoofs — those always need a real DNS server.
|
|
ENABLE_MDNS=false
|
|
|
|
RCON_PASSWORD=change-me-to-something-random
|
|
# Only needed if using CurseForge-exclusive mods:
|
|
# CF_API_KEY=your-curseforge-api-key
|
|
|
|
# ── Let's Encrypt via OVH DNS-01 (tooling/issue-letsencrypt.sh) ───────
|
|
# Only needed to issue real TLS certs. DNS-01 needs no inbound ports.
|
|
LE_EMAIL=you@example.com
|
|
# space-separated subdomains; apex ${BASE_DOMAIN} is always included
|
|
LE_SUBDOMAINS=auth pack
|
|
# OVH API creds (DNS zone write). Create at https://eu.api.ovh.com/createToken/
|
|
# OVH_CK can be blank on first run — acme.sh prints an auth URL, then paste it.
|
|
OVH_END_POINT=ovh-eu
|
|
OVH_AK=
|
|
OVH_AS=
|
|
OVH_CK=
|
|
# LE_STAGING=1 # use the untrusted staging CA for dry runs
|
|
|
|
# ── Blessing Skin auth variant (docker-compose.blessingskin.yml) ──────
|
|
# Only needed when running the Blessing Skin override instead of Drasl.
|
|
BS_DB_NAME=blessingskin
|
|
BS_DB_USER=blessingskin
|
|
BS_DB_PASSWORD=change-me-bs-db
|
|
BS_DB_ROOT_PASSWORD=change-me-bs-root
|
|
# Generate once and paste here so it survives container recreates:
|
|
# docker run --rm azusamikan/blessing-skin-server-docker:latest php artisan key:generate --show
|
|
BS_APP_KEY=base64:replace-with-generated-key
|