Need help with special Dyn-DNS setup

[dpaessler]

Hey Guys,

I don't know, if it's even possible at all, so I just ask here.

I own a TLD, which is hosted at my Hosting Provider providing my Website, let's say "server.org". Additionally I use a Dyn-DNS provider (NO-IP, at "https://noip.com", which is not in the DDNS-List of available Providers), which gives me a subdomain that points to my home-IP, let's call it "server.servebeer.com".
Some services are directly accessible by "server.servebeer.com" with forwarded Ports on my Router, but for some services I created a CNAME-record at my Hosting Provider, pointing to the Dyn-DNS subdomain. For example, "home.server.org" is a CNAME-record pointing to "server.servebeer.com" where my "intranet website" is accessible.

I'm currently using cert bot with Apache at home as a Webserver and Reverse-Proxy, but want to give ngingx-ignition a try, as it looks very promising, but I'm unable to figure out if and how this is possible.

Thanks in advance.

[lucasdillmann]

Hi @dpaessler, I hope you're doing well.

First of all, thanks for your interest in trying nginx ignition. I’d be happy to help you with your setup, but first, I want to make sure I’ve understood your current configuration correctly. Feel free to correct me if I missed anything:

1. You own a domain purchased through a registrar and have full control over its DNS.
2. Most of your site's content is hosted on a third-party server (e.g., a VPS on DigitalOcean/Linode), but a subset of subdomains is hosted in your homelab (using port forwarding on your router).
3. One of the subdomains in your homelab uses DDNS, while the others are CNAME records pointing to that DDNS-managed subdomain.
4. Your Apache server currently acts as both a web server and a reverse proxy.

If the above is correct, you should be able to migrate to nginx ignition by following these points:

• SSL Certificates: Ignition can manage the certificates currently handled by Certbot. You’ll need to create a new SSL Certificate in the UI and select your DNS provider from the list. For example, if your domain’s DNS is hosted by AWS Route53, you would select that and input your credentials so Ignition can validate and issue the Let's Encrypt certificate.
  • Note that you don't need to select your DDNS provider, but rather the provider that manages your main domain's DNS.
  • If your DNS provider doesn't show up in the list, please let me know.
• Hosts: For each subdomain (DDNS-managed or otherwise), you’ll need to create a new "Host" and configure it accordingly. For example, for a subdomain like server.servebeer.com, you can create a host and configure it to forward requests to your homelab services (such as Vaultwarden, Firefly III, etc.).

The only part that is not quite clear for me is how Apache acts as a "server" for you. Does it serve only static content, or dynamic content (e.g., using PHP)? If it’s static content (even directory listings), Ignition can handle this easily in the Host configuration (by selecting responses content or directory in the route type). The UI doesn't support dynamic content like PHP or CGI natively, but nginx itself supports it and you should be able to make it work by inputting the raw nginx configuration parameters in the advanced section of the host's route.

I hope this helps. If anything is unclear, just let me know.

[dpaessler]

Hi @lucasdillmann,

Thanks for the quick reply.
For your questions, 1-4 are all correct.
The Apache Webserver serves only static Websites (.html), nothing fancy, just some Links to my internal Services.

My Webhosting Provider is 1blu ("https://1blu.de"), a German Provider and it's not in the list of Providers, so I can't select it.

Greetings from Germany

[lucasdillmann]

Under the hood, Ignition uses go-acme lego to issue SSL certificates and handle the DNS validation. Unfortunately, they don't support 1blu yet, which means Ignition doesn't either.

Although there's some ways to go around this using Ignition as-is, I don't know if they are viable or practical for you:

1. Migrate to a supported DNS provider. This can even be done for just a specific subdomain if you don't want to move your entire domain.
2. Continue generating the SSL certificates using Certbot, and then manually import/upload the files through the Ignition UI.

If it helps, I could implement a third option where Ignition uses an external file path directly. With this, Ignition wouldn't be managing the certificates itself, but it would pick up the certificates Certbot generates, eliminating the need for manual intervention/upload every three months or so (when certificate expires).

[dpaessler]

I'd personally go with option 2. or 3., but for 2. I didn't found a way to manually import/upload a certificate.
Is this already implemented? If yes, where do I find this?

Thanks

[lucasdillmann]

It's already available, yes. You can find it under SSL Certificates > Issue certificate. When asked for the provider, select "Custom certificate".

PS: I've just noticed that the UI has a bug and don't show the file selection field right away, only after changing the "Upload mode" value. If the field is not showing for you, doing this can fix the problem. I will work on a definitive fix and release a version with it soon.

[lucasdillmann]

@dpaessler, just a quick update: Version 2.27.0 is now available, which includes a fix for the certificate upload bug. This version also allows you to customize the index file for static file routes (under the route advanced settings), which might be useful for your use case.

[dpaessler]

Okay, this seems to work.
I was able to import my current certificate, but only if I'm not selecting the optional "certificate chain". If I select this option and select either "chainXX.pem" or fullchainXX.pem, I get an error saying "That didn't work", without this option, certificate gets imported successfully.

I will try further, but thank you for your support and the great work.
Have a great day.

[lucasdillmann]

Glad to hear it's working now, @dpaessler.

Regarding the error, it could be related to the fullchain file including the certificate itself rather than just the intermediate CAs (if there are any).

Have a great day as well. Please let me know if you encounter any further issues I can help with.

[dpaessler]

Thanks a lot.
Just one more question:
Setting up a host with the option "static files", the "Target directory path" doesn't reflect the path on the host, but the path inside the container.
So I guess I have to set up an extra "volume" to bind the path on the host to the path inside the container, right?

[lucasdillmann]

That's correct. Since you're running Ignition using Docker, the "Target directory path" is a path inside the container (and a volume/bind is necessary).

[dpaessler]

Thanks!