[Wien] Online-MoMo am Mo 07.02.2021 ab 19:30 - Notizen für Setup von mqtt.funkfeuer.at

Daniel A. Maierhofer (spam-protected)
Di Feb 8 15:24:12 CET 2022


Servus!

On 05.02.22 10:27, Daniel A. Maierhofer wrote:
> Bei Interesse kann ich das Setup von MQTT im Zusammenspiel mit HAProxy & Let's Encrypt vorführen.
> (Migration von VM auf einen LXC Container - das System welches hinter dem Monitoring der Housing-Temperaturen steckt)

Die Mitschrift dazu findet ihr hier:

apt update
apt full-upgrade
apt install mosquitto
cat >/etc/mosquitto/conf.d/default.conf << EOF
allow_anonymous false
password_file /etc/mosquitto/passwd
acl_file /etc/mosquitto/acl_file

listener 9883 localhost

max_connections 85
EOF

cat >/etc/mosquitto/acl_file << EOF
user root
topic readwrite #

#restrict tasmota devs to their own topics
pattern read cmnd/%u/#
pattern write stat/%u/#
pattern write tele/%u/#

#restrict client to readonly for telemetry
user client
topic read tele/+/SENSOR
EOF

vi /etc/mosquitto/passwd # clients, Sensors and Grafana

service mosquitto restart

apt install nginx
rm /etc/nginx/sites-enabled/default
cat > /etc/nginx/conf.d/letsencrypt.conf << EOF
server_tokens off;
server {
     listen 127.0.0.1:8080 default_server;
     listen [::1]:8080 default_server;
     server_name _;
     access_log /var/log/nginx/letsencrypt-access.log combined;
     error_log /var/log/nginx/letsencrypt-error.log notice;
     location = /.well-known/acme-challenge/ {
         return 404;
     }
     location ^~ /.well-known/acme-challenge/ {
         alias /var/lib/dehydrated/acme-challenges/;
     }
}
EOF

nginx -t && service nginx restart

apt install dehydrated sudo
useradd -c 'dehydrated privsep user' -d /etc/dehydrated/ -s /usr/sbin/nologin _acme
echo mqtt.funkfeuer.at > /etc/dehydrated/domains.txt
cat >> /etc/dehydrated/config << EOF
DEHYDRATED_USER="_acme"
DEHYDRATED_GROUP="_acme"
KEY_ALGO=prime256v1
CONTACT_EMAIL="..."
HOOK="/etc/dehydrated/hook.sh"
EOF

chown -R _acme /etc/ssl/private/ /var/lib/dehydrated
cat > /etc/dehydrated/hook.sh << EOF
#!/usr/bin/env bash

set -e

atomic_concat() {
         local file=${1}; shift
         > ${file}.new
         chmod 600 ${file}.new
         cat "${@}" > ${file}.new
         [ -f ${file} ] && cp -f ${file} ${file}.dehydrated~
         mv -f ${file}.new ${file}
}

haproxy_reload() {
         if [ ! -x /usr/sbin/haproxy ]; then
                 return
         fi

         atomic_concat /etc/ssl/private/${DOMAIN}.pem "$FULLCHAINFILE" "$KEYFILE"
}

deploy_cert() {
     local DOMAIN="${1}" KEYFILE="${2}" CERTFILE="${3}" FULLCHAINFILE="${4}" CHAINFILE="${5}" TIMESTAMP="${6}"

     # This hook is called once for each certificate that has been
     # produced. Here you might, for instance, copy your new certificates
     # to service-specific locations and reload the service.
     #
     # Parameters:
     # - DOMAIN
     #   The primary domain name, i.e. the certificate common
     #   name (CN).
     # - KEYFILE
     #   The path of the file containing the private key.
     # - CERTFILE
     #   The path of the file containing the signed certificate.
     # - FULLCHAINFILE
     #   The path of the file containing the full certificate chain.
     # - CHAINFILE
     #   The path of the file containing the intermediate certificate(s).
     # - TIMESTAMP
     #   Timestamp when the specified certificate was created.

     haproxy_reload
}

HANDLER="$1"; shift
if [[ "${HANDLER}" =~ ^(deploy_cert)$ ]]; then
   "$HANDLER" "$@"
fi
EOF
chmod +x /etc/dehydrated/hook.sh

openssl dhparam -out /etc/haproxy/dhparam.pem 4096

apt install haproxy
echo "mqtt.funkfeuer.at mqtt" > /etc/haproxy/domain.map
cat >/etc/haproxy/haproxy.cfg << EOF
global
	log /dev/log	local0
	log /dev/log	local1 notice
	chroot /var/lib/haproxy
	stats socket /run/haproxy/admin.sock mode 660 level admin expose-fd listeners
	stats timeout 30s
	user haproxy
	group haproxy
	daemon

	# Default SSL material locations
	ca-base /etc/ssl/certs
	crt-base /etc/ssl/private

	# See: https://ssl-config.mozilla.org/#server=haproxy&server-version=2.0.3&config=intermediate

	ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
	ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
	ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

	ssl-default-server-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
	ssl-default-server-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
	ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets

	ssl-dh-param-file /etc/haproxy/dhparam.pem

defaults
	log	global
	mode	http
	option	httplog
	option	dontlognull
	option  http-server-close	
         timeout connect 5000
         timeout client  50000
         timeout server  50000
	errorfile 400 /etc/haproxy/errors/400.http
	errorfile 403 /etc/haproxy/errors/403.http
	errorfile 408 /etc/haproxy/errors/408.http
	errorfile 500 /etc/haproxy/errors/500.http
	errorfile 502 /etc/haproxy/errors/502.http
	errorfile 503 /etc/haproxy/errors/503.http
	errorfile 504 /etc/haproxy/errors/504.http

frontend http
         bind *:80
         bind :::80	
         default_backend default	

         option  forwardfor
         http-request add-header X-Forwarded-Proto https if { ssl_fc }	

         capture request header Host len 32
         capture request header User-Agent len 128	

         bind *:443 ssl crt . alpn h2,http/1.1
         bind :::443 ssl crt . alpn h2,http/1.1
         redirect scheme https code 302 if !{ ssl_fc }

         redirect code 302 location https://wiki.funkfeuer.at/wiki/Services/Organisation/Housing/Temperatur if { path -i -m str / } { hdr(host) -i mqtt.funkfeuer.at }

         http-response set-header Strict-Transport-Security max-age=31536000		

	acl acme_challenge path_beg /.well-known/acme-challenge/	
	use_backend letsencrypt if acme_challenge	

	use_backend %[req.hdr(host),lower,map(/etc/haproxy/domain.map,default)]

backend letsencrypt
         server letsencrypt localhost:8080 check

backend default
         server default localhost:8080 check

listen mqtt
         bind *:1883
         bind :::1883
         bind *:8883 ssl crt .
         bind :::8883 ssl crt .
         mode tcp
         option tcplog
         option clitcpka
         timeout client 3h
         timeout server 3h
         server mqtt localhost:9883 check
EOF
haproxy -c -f /etc/haproxy/haproxy.cfg && service haproxy restart

dehydrated --register --accept-terms
dehydrated -c
crontab -e
#34 03 * * * /usr/bin/dehydrated -c >> /var/log/dehydrated.log 2>&1
#37 03 * * * /sbin/service haproxy reload >> /var/log/dehydrated.log 2>&1

Schöne Grüße,
Daniel A. Maierhofer
  
Schriftführer - FunkFeuer Wien - Verein zur Förderung freier Netze



Mehr Informationen über die Mailingliste Wien