New setup of Traefik with crowdsec

scripts/README-cert-sync.md

@@ -0,0 +1,63 @@
+# Synology → Traefik certificate sync
+
+`sync-synology-certs.sh` pulls the LE certs that the Synologies already manage
+(for `fids.famfi.dyndns.org` / `fids2.famfi.dyndns.org`) and installs them into
+Traefik's `tls/` dir, so Traefik terminates TLS with a **valid** cert while the
+**CrowdSec** bouncer stays in the request path.
+
+Result: clients get a valid cert, the Synology keeps owning cert *acquisition*,
+and we keep HTTP-level protection. The `fids`/`fids2` routers stay `tls: {}` —
+once these certs are loaded, Traefik serves them by SNI automatically.
+
+## One-time setup
+
+### 1. SSH key from the Traefik host to each Synology
+```bash
+sudo ssh-keygen -t ed25519 -f /root/.ssh/synology_certsync -N ""   # if no key yet
+# DSM: Control Panel → Terminal & SNMP → Enable SSH service
+# Add the PUBLIC key to each Synology user's authorized_keys:
+ssh-copy-id -i /root/.ssh/synology_certsync.pub admin@192.168.0.245
+ssh-copy-id -i /root/.ssh/synology_certsync.pub admin@192.168.0.234
+```
+Add to `/root/.ssh/config` so the script's plain `ssh` uses the key:
+```
+Host 192.168.0.245 192.168.0.234
+    User admin
+    IdentityFile /root/.ssh/synology_certsync
+```
+
+### 2. Allow the SSH user to read the certs without a password
+The certs live in `/usr/syno/etc/certificate/_archive/` (root-only). On each NAS,
+DSM → Control Panel → Task Scheduler, or edit sudoers, to grant NOPASSWD:
+```
+# /etc/sudoers.d/certsync  on the Synology
+admin ALL=(root) NOPASSWD: /bin/sh
+```
+(Scope this tighter if you prefer; the script calls `sudo sh -c '…cat…'`.)
+
+### 3. Test manually
+```bash
+sudo /home/lutz/Projects/Traefik/scripts/sync-synology-certs.sh
+```
+Expect "updated cert for fids …". Then verify Traefik serves it:
+```bash
+echo | openssl s_client -connect 192.168.0.142:5001 \
+  -servername fids.famfi.dyndns.org 2>/dev/null | openssl x509 -noout -subject -issuer
+# subject should be CN=fids.famfi.dyndns.org, issuer Let's Encrypt (not TRAEFIK DEFAULT CERT)
+```
+
+### 4. Schedule (root cron — daily is plenty; LE renews ~monthly)
+```
+# /etc/cron.d/synology-certsync
+17 4 * * *  root  /home/lutz/Projects/Traefik/scripts/sync-synology-certs.sh >> /var/log/synology-certsync.log 2>&1
+```
+
+## How reload works
+The script regenerates `traefik.d/tls-synology.yml` on every run. That file is in
+Traefik's watched config dir, so writing it triggers a hot-reload — **no restart
+needed**. Until the first successful run, `tls-synology.yml` does not exist and
+Traefik keeps serving its self-signed default for fids/fids2 (no errors).
+
+## Adding more hosts
+Append a line to the `TARGETS=( … )` array in the script:
+`"name|user@host|port|domain.to.match"`.