64 lines
2.6 KiB
Markdown
64 lines
2.6 KiB
Markdown
# Synology → Traefik certificate sync
|
|
|
|
`sync-synology-certs.sh` pulls the LE certs that the Synologies already manage
|
|
(for `fids.famfi.dyndns.org` / `fids2.famfi.dyndns.org`) and installs them into
|
|
Traefik's `tls/` dir, so Traefik terminates TLS with a **valid** cert while the
|
|
**CrowdSec** bouncer stays in the request path.
|
|
|
|
Result: clients get a valid cert, the Synology keeps owning cert *acquisition*,
|
|
and we keep HTTP-level protection. The `fids`/`fids2` routers stay `tls: {}` —
|
|
once these certs are loaded, Traefik serves them by SNI automatically.
|
|
|
|
## One-time setup
|
|
|
|
### 1. SSH key from the Traefik host to each Synology
|
|
```bash
|
|
sudo ssh-keygen -t ed25519 -f /root/.ssh/synology_certsync -N "" # if no key yet
|
|
# DSM: Control Panel → Terminal & SNMP → Enable SSH service
|
|
# Add the PUBLIC key to each Synology user's authorized_keys:
|
|
ssh-copy-id -i /root/.ssh/synology_certsync.pub admin@192.168.0.245
|
|
ssh-copy-id -i /root/.ssh/synology_certsync.pub admin@192.168.0.234
|
|
```
|
|
Add to `/root/.ssh/config` so the script's plain `ssh` uses the key:
|
|
```
|
|
Host 192.168.0.245 192.168.0.234
|
|
User admin
|
|
IdentityFile /root/.ssh/synology_certsync
|
|
```
|
|
|
|
### 2. Allow the SSH user to read the certs without a password
|
|
The certs live in `/usr/syno/etc/certificate/_archive/` (root-only). On each NAS,
|
|
DSM → Control Panel → Task Scheduler, or edit sudoers, to grant NOPASSWD:
|
|
```
|
|
# /etc/sudoers.d/certsync on the Synology
|
|
admin ALL=(root) NOPASSWD: /bin/sh
|
|
```
|
|
(Scope this tighter if you prefer; the script calls `sudo sh -c '…cat…'`.)
|
|
|
|
### 3. Test manually
|
|
```bash
|
|
sudo /home/lutz/Projects/Traefik/scripts/sync-synology-certs.sh
|
|
```
|
|
Expect "updated cert for fids …". Then verify Traefik serves it:
|
|
```bash
|
|
echo | openssl s_client -connect 192.168.0.142:5001 \
|
|
-servername fids.famfi.dyndns.org 2>/dev/null | openssl x509 -noout -subject -issuer
|
|
# subject should be CN=fids.famfi.dyndns.org, issuer Let's Encrypt (not TRAEFIK DEFAULT CERT)
|
|
```
|
|
|
|
### 4. Schedule (root cron — daily is plenty; LE renews ~monthly)
|
|
```
|
|
# /etc/cron.d/synology-certsync
|
|
17 4 * * * root /home/lutz/Projects/Traefik/scripts/sync-synology-certs.sh >> /var/log/synology-certsync.log 2>&1
|
|
```
|
|
|
|
## How reload works
|
|
The script regenerates `traefik.d/tls-synology.yml` on every run. That file is in
|
|
Traefik's watched config dir, so writing it triggers a hot-reload — **no restart
|
|
needed**. Until the first successful run, `tls-synology.yml` does not exist and
|
|
Traefik keeps serving its self-signed default for fids/fids2 (no errors).
|
|
|
|
## Adding more hosts
|
|
Append a line to the `TARGETS=( … )` array in the script:
|
|
`"name|user@host|port|domain.to.match"`.
|