119 lines
3.4 KiB
ReStructuredText
119 lines
3.4 KiB
ReStructuredText
domain names
|
|
############
|
|
|
|
:date: 2019-10-17 00:00
|
|
:modified: 2019-10-17 00:00
|
|
:tags: domainname
|
|
:category: documentation
|
|
:slug: domain
|
|
:authors: Ms.Leave-A-Mix
|
|
:summary: How to set up a new domain
|
|
|
|
---------
|
|
Registrar
|
|
---------
|
|
|
|
I use Gandi_ as a *`domain name registrar`_*. Buy the domain name (i.e.
|
|
*freepot.es*) and proceed to the following steps.
|
|
|
|
-----------
|
|
DNS records
|
|
-----------
|
|
|
|
Use your registrar's interface to fill the DNS records concerning your new
|
|
domain name.
|
|
|
|
There is several kind of rules for the DNS, depending on your use. For a normal
|
|
permanent redirection, use an `**A** rule`_.
|
|
|
|
.. code-block:: DNS
|
|
|
|
@ 10800 IN A 46.105.123.34
|
|
mail 10800 IN A 46.105.123.34
|
|
www 10800 IN A 46.105.123.34
|
|
|
|
---
|
|
SSL
|
|
---
|
|
|
|
Let's Encrypt
|
|
-------------
|
|
|
|
To generate a `Let's Encrypt`_ certificate, we will use the tool they provide :
|
|
**certbot**
|
|
|
|
:code:`$ certbot certonly -d freepot.es,mail.freepot.es,www.freepot.es --manual`
|
|
|
|
You will need to add the ACME codes to a machine that is hit on the port 80. For
|
|
freepoteries, this is the "reverse proxy" machine.
|
|
|
|
On this machine, you will enter some rules that answer to a certain path (that
|
|
is given in the certbot interface), with a certain string.
|
|
|
|
In my example, this gives :
|
|
|
|
.. code-block:: nginx
|
|
|
|
server {
|
|
listen 80;
|
|
server_name freepot.es;
|
|
location = /.well-known/acme-challenge/0KfBX6QUrQMp9GShsNHphXY1-5eARzc5V1YCFcIMHrU {
|
|
return 200 0KfBX6QUrQMp9GShsNHphXY1-5eARzc5V1YCFcIMHrU.8oRwv2RYYBM4wyoBd3WQfEX4bVC3AD2qrnorQ1_XUzw;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name mail.freepot.es;
|
|
location = /.well-known/acme-challenge/89beFwi8o--w_ra3iPB5sbsXnZbAA4kvqAGGXxCC4RY {
|
|
return 200 89beFwi8o--w_ra3iPB5sbsXnZbAA4kvqAGGXxCC4RY.8oRwv2RYYBM4wyoBd3WQfEX4bVC3AD2qrnorQ1_XUzw;
|
|
}
|
|
}
|
|
|
|
server {
|
|
listen 80;
|
|
server_name www.freepot.es;
|
|
location = /.well-known/acme-challenge/U6TPMzFi12vfYKUeEMbr9g4UiAr73E4b6XzkjYgy-KY {
|
|
return 200 U6TPMzFi12vfYKUeEMbr9g4UiAr73E4b6XzkjYgy-KY.8oRwv2RYYBM4wyoBd3WQfEX4bVC3AD2qrnorQ1_XUzw;
|
|
}
|
|
}
|
|
|
|
Of course, reload your web server after saving the configuration file.
|
|
|
|
Now, try to ping your machine by it's new domain name :
|
|
|
|
:code:`$ ding freepot.es +short`
|
|
|
|
If this command outputs your public IP, you're on the right way!
|
|
|
|
Then, check if you can connect to your public IP on the HTTP port (80) :
|
|
|
|
:code:`$ nc -w0 freepot.es 80 && echo "You can connect to the port 80!"`
|
|
|
|
If the command outputs something, you're still good!
|
|
If not, you should check your iptables rules and eventually have to redirect the
|
|
outputting internally generated packets to the right IP.
|
|
|
|
:code:`# iptables -t nat -I OUTPUT --destination 46.105.123.34 --dport 80 -j
|
|
DNAT --to-destination 192.168.42.22:80`
|
|
|
|
This is an iptables redirection of the packets originating from my server,
|
|
hitting my public IP (46.105.123.34) on the HTTP port (80), to the local reverse
|
|
proxy that is located at 192.168.42.22.
|
|
|
|
You can then validate the creation of the certificates, and copy them on the
|
|
virtual machines that will serve the SSL services on the new domains.
|
|
|
|
:code:`# scp -r /etc/letsencrypt/live/freepot.es www.freepoteries.fr:~/`
|
|
|
|
CACert.org
|
|
----------
|
|
|
|
Todo
|
|
|
|
|
|
.. _Gandi: https://www.gandi.net/en
|
|
.. _domain name registrar: https://en.wikipedia.org/wiki/Domain_name_registrar
|
|
.. _**A** rule: https://en.wikipedia.org/wiki/List_of_DNS_record_types#A
|
|
.. _Let's Encrypt: https://letsencrypt.org/
|