Renewal of tunnels certs with certbot via cli?

[Reis-A]

In config.json I have a path defined for the LetsEncrpytcertificetes for the tunnel.
Obviously the certs get automatically renewed every so many days. A script replaces the files automatically.
I assumed that a restart of wag would update the certs.
Reading the instructions precisely, i see that the certs are only loaded on first run...
So that doesnt work... it would be great if the certs could some how be reloaded via cli...
my wag server doesnt have its own public ip so it cannot pull acme by itself...

[Reis-A]

well i wrote a python script now that makes api calls of the management api, so the certs get updated by that as workaround.
maybe it becomes easier once it is ansible compatible to update custom certs.

[NHAS]

Howdy, glad to hear that you've found a solution.

Out of interest, how does your certbot setup work? Is it on another machine that then copies it to the wag host?

And yes, once the work for v10.0.0 is done this will be less of an issue as you'll just be able to push a new config to wag and have it update. Just going to take a bit.

[Reis-A]

yes exactly. i use certbot with deploy-hooks on the server that i publiclyaccessible on port 443 /80 that copies the cert over to the wag host machine and then triggers the python script that calls the login endpoint and the webservers and websever put endpoint to exchange the custom cert with the new one...
hmm actually, now thinking about it, i could probably skip the copying step since the proxy could call the api directly with the script.

[Reis-A]

import requests
import json
#############configuration#############
BASE = "http://<management_ip>:<management_port>”

keypath=“<mypath_to_pem-file>"
certpath=“<mypath_to_pem-file>"

credentials = {
    "username": “<managementadmin>”,
    "password": “<sensitive> ”
}
##############################

session = requests.Session()

headers = {
    "Content-Type": "application/json",
    "Origin": f"{BASE}",
    "Referer": f"{BASE}/login",
    "Accept": "application/json, text/plain, */*",
}


# LOGIN (no CSRF header!)
r = session.post(f"{BASE}/api/login", json=credentials, headers=headers)
#print("Login:", r.text)

data = r.json()
csrf_token = data["csrfToken"]
csrf_header = data["csrfHeader"]



headers={
        "Origin": f"{BASE}",
        "Referer": f"{BASE}",
        csrf_header: csrf_token,
    }

resp = session.get(
   f"{BASE}/api/settings/webservers",
    headers=headers
)

#settings list with 3 json, and tunnelsettings are item[2]
settings = resp.json()[2]

with open(f"{certpath}", "r") as f:
    cert_pem = f.read()

with open(f"{keypath}", "r") as f:
    key_pem = f.read()

settings['certificate']=cert_pem
settings['private_key']=key_pem

resp = session.put(
    f"{BASE}/api/settings/webserver",
    json=settings,
    headers=headers
)

print(resp.status_code, resp)
session.close()

[NHAS]

Just letting you know that every http listener wag puts up can handle an acme http request.

So if you proxy just the public registration endpoint to the internet you'd be able to do acme.

Or if you use cloudflare you can use the dns-01 process