# Synology → Traefik certificate sync

`sync-synology-certs.sh` pulls the LE certs that the Synologies already manage
(for `fids.famfi.dyndns.org` / `fids2.famfi.dyndns.org`) and installs them into
Traefik's `tls/` dir, so Traefik terminates TLS with a **valid** cert while the
**CrowdSec** bouncer stays in the request path.

Result: clients get a valid cert, the Synology keeps owning cert *acquisition*,
and we keep HTTP-level protection. The `fids`/`fids2` routers stay `tls: {}` —
once these certs are loaded, Traefik serves them by SNI automatically.

## One-time setup

### 1. SSH key from the Traefik host to each Synology
```bash
sudo ssh-keygen -t ed25519 -f /root/.ssh/synology_certsync -N ""   # if no key yet
# DSM: Control Panel → Terminal & SNMP → Enable SSH service
# Add the PUBLIC key to each Synology user's authorized_keys:
ssh-copy-id -i /root/.ssh/synology_certsync.pub admin@192.168.0.245
ssh-copy-id -i /root/.ssh/synology_certsync.pub admin@192.168.0.234
```
Add to `/root/.ssh/config` so the script's plain `ssh` uses the key:
```
Host 192.168.0.245 192.168.0.234
    User admin
    IdentityFile /root/.ssh/synology_certsync
```

### 2. Allow the SSH user to read the certs without a password
The certs live in `/usr/syno/etc/certificate/_archive/` (root-only). On each NAS,
DSM → Control Panel → Task Scheduler, or edit sudoers, to grant NOPASSWD:
```
# /etc/sudoers.d/certsync  on the Synology
admin ALL=(root) NOPASSWD: /bin/sh
```
(Scope this tighter if you prefer; the script calls `sudo sh -c '…cat…'`.)

### 3. Test manually
```bash
sudo /home/lutz/Projects/Traefik/scripts/sync-synology-certs.sh
```
Expect "updated cert for fids …". Then verify Traefik serves it:
```bash
echo | openssl s_client -connect 192.168.0.142:5001 \
  -servername fids.famfi.dyndns.org 2>/dev/null | openssl x509 -noout -subject -issuer
# subject should be CN=fids.famfi.dyndns.org, issuer Let's Encrypt (not TRAEFIK DEFAULT CERT)
```

### 4. Schedule (root cron — daily is plenty; LE renews ~monthly)
```
# /etc/cron.d/synology-certsync
17 4 * * *  root  /home/lutz/Projects/Traefik/scripts/sync-synology-certs.sh >> /var/log/synology-certsync.log 2>&1
```

## How reload works
The script regenerates `traefik.d/tls-synology.yml` on every run. That file is in
Traefik's watched config dir, so writing it triggers a hot-reload — **no restart
needed**. Until the first successful run, `tls-synology.yml` does not exist and
Traefik keeps serving its self-signed default for fids/fids2 (no errors).

## Adding more hosts
Append a line to the `TARGETS=( … )` array in the script:
`"name|user@host|port|domain.to.match"`.