This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revision | Next revisionBoth sides next revision | ||
computing:proxmux [2023/12/23 21:45] – oemb1905 | computing:proxmux [2023/12/23 22:09] – oemb1905 | ||
---|---|---|---|
Line 77: | Line 77: | ||
sudo apt install nginx | sudo apt install nginx | ||
- | sudo nano / | + | sudo nano / |
| | ||
Enter this in the file | Enter this in the file | ||
server { | server { | ||
- | server_name | + | server_name |
location / { | location / { | ||
- | proxy_pass http:// | + | proxy_pass http:// |
- | # | + | # |
} | } | ||
} | } | ||
- | Repeat this as needed for each VM within PVE. Once this is done, set up TLS on the PVE/RP instance as follows: | + | Repeat this as needed for each VM within PVE. For example, here's another entry for an instance doing nextcloud instead of music: |
+ | |||
+ | sudo nano / | ||
+ | |||
+ | Enter this in the file | ||
+ | |||
+ | server { | ||
+ | server_name | ||
+ | location / { | ||
+ | proxy_pass http:// | ||
+ | # | ||
+ | } | ||
+ | } | ||
+ | |||
+ | Once this is done, set up TLS on the PVE/RP instance as follows: | ||
sudo apt install certbot letsencrypt python3-certbot-nginx | sudo apt install certbot letsencrypt python3-certbot-nginx | ||
sudo certbot --authenticator standalone --installer nginx -d example.domain.com --pre-hook " | sudo certbot --authenticator standalone --installer nginx -d example.domain.com --pre-hook " | ||
+ | Remember, it the reverse proxy web server does not need to match the upstream web server on the LAN at the two different clients '' | ||
+ | |||
+ | sudo nano /etc/hosts [inside VM1] | ||
+ | < | ||
+ | sudo nano / | ||
+ | < | ||
+ | <Header add myheader " | ||
+ | < | ||
+ | |||
+ | That takes care of VM1, now let's do VM2: | ||
+ | |||
+ | sudo nano /etc/hosts [inside VM2] | ||
+ | < | ||
+ | sudo nano / | ||
+ | < | ||
+ | <Header add myheader " | ||
+ | < | ||
| | ||
+ | Once this id done, restart your web server. In my case, the VMs are using apache and only the PVE / reverse proxy server is using nginx. After restarting the web servers inside each VM, you now can create the matching certs inside each VM. Here's the commands for VM1: | ||
+ | |||
+ | sudo apt install certbot letsencrypt python3-certbot-apache | ||
+ | sudo certbot --authenticator standalone --installer apache -d music.example.com --pre-hook " | ||
+ | | ||
+ | Here are the commands inside VM2: | ||
+ | |||
+ | sudo apt install certbot letsencrypt python3-certbot-apache | ||
+ | sudo certbot --authenticator standalone --installer apache -d nextcloud.example.com --pre-hook " | ||
+ | | ||
+ | Once that's done, make sure that you have cron jobs set for both VMs and for the reverse proxy server / PVE instance. Just enter the following in crontab for all three: | ||
+ | |||
+ | 30 2 * * 1 / | ||
+ | |||
+ | This should now make Chrome happy since the VM cert will match the cert of the reverse proxy. Why does this work you might ask? Well, when you run certbot inside the VM, it merely cares whether it can be reached externally where you've declared it to be and since it can, it creates the cert without issue. The reverse proxy / PVE instance itself is also able to handle requests for these domains so certbot likewise has no problems issuing the cert there either. This not only makes the Chrome happy, but it addresses what the Chrome developers and rfc 6844 is concerned about, namely, that without this ... connections inside the LAN could potentially be non-TLS or non-header matching. So, this is a best of both worlds. | ||
+ | |||
--- // | --- // |