Synology → Traefik certificate sync

sync-synology-certs.sh pulls the LE certs that the Synologies already manage (for fids.famfi.dyndns.org / fids2.famfi.dyndns.org) and installs them into Traefik's tls/ dir, so Traefik terminates TLS with a valid cert while the CrowdSec bouncer stays in the request path.

Result: clients get a valid cert, the Synology keeps owning cert acquisition, and we keep HTTP-level protection. The fids/fids2 routers stay tls: {} — once these certs are loaded, Traefik serves them by SNI automatically.

One-time setup

1. SSH key from the Traefik host to each Synology

sudo ssh-keygen -t ed25519 -f /root/.ssh/synology_certsync -N ""   # if no key yet
# DSM: Control Panel → Terminal & SNMP → Enable SSH service
# Add the PUBLIC key to each Synology user's authorized_keys:
ssh-copy-id -i /root/.ssh/synology_certsync.pub admin@192.168.0.245
ssh-copy-id -i /root/.ssh/synology_certsync.pub admin@192.168.0.234

Add to /root/.ssh/config so the script's plain ssh uses the key:

Host 192.168.0.245 192.168.0.234
    User admin
    IdentityFile /root/.ssh/synology_certsync

2. Allow the SSH user to read the certs without a password

The certs live in /usr/syno/etc/certificate/_archive/ (root-only). On each NAS, DSM → Control Panel → Task Scheduler, or edit sudoers, to grant NOPASSWD:

# /etc/sudoers.d/certsync  on the Synology
admin ALL=(root) NOPASSWD: /bin/sh

(Scope this tighter if you prefer; the script calls sudo sh -c '…cat…'.)

3. Test manually

sudo /home/lutz/Projects/Traefik/scripts/sync-synology-certs.sh

Expect "updated cert for fids …". Then verify Traefik serves it:

echo | openssl s_client -connect 192.168.0.142:5001 \
  -servername fids.famfi.dyndns.org 2>/dev/null | openssl x509 -noout -subject -issuer
# subject should be CN=fids.famfi.dyndns.org, issuer Let's Encrypt (not TRAEFIK DEFAULT CERT)

4. Schedule (root cron — daily is plenty; LE renews ~monthly)

# /etc/cron.d/synology-certsync
17 4 * * *  root  /home/lutz/Projects/Traefik/scripts/sync-synology-certs.sh >> /var/log/synology-certsync.log 2>&1

How reload works

The script regenerates traefik.d/tls-synology.yml on every run. That file is in Traefik's watched config dir, so writing it triggers a hot-reload — no restart needed. Until the first successful run, tls-synology.yml does not exist and Traefik keeps serving its self-signed default for fids/fids2 (no errors).

Adding more hosts

Append a line to the TARGETS=( … ) array in the script: "name|user@host|port|domain.to.match".

2.6 KiB Raw Blame History