adding domain_name article

content/domain_name.rst

@@ -0,0 +1,117 @@
+domain names
+############
+
+:date: 2019-10-17 00:00
+:modified: 2019-10-17 00:00
+:tags: domainname
+:category: documentation
+:slug: domain
+:authors: Ms.Leave-A-Mix
+:summary: How to set up a new domain
+
+---------
+Registrar
+---------
+
+I use Gandi_ as a `*domain name registrar*`_. Buy the domain name (i.e.
+*freepot.es*) and proceed to the following steps.
+
+-----------
+DNS records
+-----------
+
+Use your registrar's interface to fill the DNS records concerning your new
+domain name.
+
+There is several kind of rules for the DNS, depending on your use. For a normal
+permanent redirection, use an `**A** rule`_.
+
+.. code-block:: DNS
+
+    @ 10800 IN A 46.105.123.34
+    mail 10800 IN A 46.105.123.34
+    www 10800 IN A 46.105.123.34
+
+---
+SSL
+---
+
+Let's Encrypt
+-------------
+
+To generate a `Let's Encrypt`_ certificate, we will use the tool they provide :
+**certbot**
+
+:code:`$ certbot certonly -d freepot.es,mail.freepot.es,www.freepot.es --manual`
+
+You will need to add the ACME codes to a machine that is hit on the port 80. For
+freepoteries, this is the "reverse proxy" machine.
+
+On this machine, you will enter some rules that answer to a certain path (that
+is given in the certbot interface), with a certain string.
+
+In my example, this gives :
+
+.. code-block:: nginx
+
+    server {
+        listen 80;
+        server_name freepot.es;
+        location = /.well-known/acme-challenge/0KfBX6QUrQMp9GShsNHphXY1-5eARzc5V1YCFcIMHrU {
+            return 200 0KfBX6QUrQMp9GShsNHphXY1-5eARzc5V1YCFcIMHrU.8oRwv2RYYBM4wyoBd3WQfEX4bVC3AD2qrnorQ1_XUzw;
+        }
+    }
+
+    server {
+        listen 80;
+        server_name mail.freepot.es;
+        location = /.well-known/acme-challenge/89beFwi8o--w_ra3iPB5sbsXnZbAA4kvqAGGXxCC4RY {
+            return 200 89beFwi8o--w_ra3iPB5sbsXnZbAA4kvqAGGXxCC4RY.8oRwv2RYYBM4wyoBd3WQfEX4bVC3AD2qrnorQ1_XUzw;
+        }
+    }
+
+    server {
+        listen 80;
+        server_name www.freepot.es;
+        location = /.well-known/acme-challenge/U6TPMzFi12vfYKUeEMbr9g4UiAr73E4b6XzkjYgy-KY {
+            return 200 U6TPMzFi12vfYKUeEMbr9g4UiAr73E4b6XzkjYgy-KY.8oRwv2RYYBM4wyoBd3WQfEX4bVC3AD2qrnorQ1_XUzw;
+        }
+    }
+
+Of course, reload your web server after saving the configuration file.
+
+Now, try to ping your machine by it's new domain name :
+
+:code:`$ ding freepot.es +short`
+
+If this command outputs your public IP, you're on the right way!
+
+Then, check if you can connect to your public IP on the HTTP port (80) :
+
+:code:`$ nc -w0 freepot.es 80 && echo "You can connect to the port 80!"`
+
+If the command outputs something, you're still good!
+If not, you should check your iptables rules and eventually have to redirect the
+outputting internally generated packets to the right IP.
+
+:code:`# iptables -t nat -I OUTPUT --destination 46.105.123.34 --dport 80 -j
+DNAT --to-destination 192.168.42.22:80`
+
+This is an iptables redirection of the packets originating from my server,
+hitting my public IP (46.105.123.34) on the HTTP port (80), to the local reverse
+proxy that is located at 192.168.42.22.
+
+You can then validate the creation of the certificates, and copy them on the
+virtual machines that will serve the SSL services on the new domains.
+
+:code:`# scp -r /etc/letsencrypt/live/freepot.es www.freepoteries.fr:~/` 
+
+CACert.org
+----------
+
+Todo
+
+.. _Gandi.net: https://www.gandi.net/en
+.. _domain name registrar: https://en.wikipedia.org/wiki/Domain_name_registrar
+.. _**A** rule: https://en.wikipedia.org/wiki/List_of_DNS_record_types#A
+.. _Let's Encrypt: https://letsencrypt.org/