108 lines
3.0 KiB
Markdown
108 lines
3.0 KiB
Markdown
# OPNsense os-acme-client -> RustProxy
|
|
|
|
A simple mechanism for automatically sending a certificate generated by `os-acme-client` on OPNsense to RustProxy via API.
|
|
|
|
## Files
|
|
|
|
- `opnsense-rustproxy-cert-deploy.sh` - sends the certificate and private key to RustProxy.
|
|
- `rustproxy-acme.conf` - connection settings, API token, and certificate file paths.
|
|
- `actions_rustproxy_cert.conf` - optional `configd` action that allows the script to be executed from Cron in OPNsense.
|
|
|
|
## 1. Installation
|
|
|
|
```sh
|
|
cp opnsense-rustproxy-cert-deploy.sh /usr/local/sbin/
|
|
chmod 750 /usr/local/sbin/opnsense-rustproxy-cert-deploy.sh
|
|
|
|
cp rustproxy-acme.conf.example /usr/local/etc/rustproxy-acme.conf
|
|
chmod 600 /usr/local/etc/rustproxy-acme.conf
|
|
```
|
|
|
|
## 2. Configuration
|
|
|
|
Edit:
|
|
|
|
```sh
|
|
vi /usr/local/etc/rustproxy-acme.conf
|
|
```
|
|
|
|
Important parameters:
|
|
|
|
```sh
|
|
RUSTPROXY_URL='https://127.0.0.1:9090'
|
|
RUSTPROXY_KEY_ID='opnsense-acme'
|
|
RUSTPROXY_TOKEN='RUSTPROXY_TOKEN'
|
|
|
|
CERTIFICATE_ID='shared-cert'
|
|
|
|
CERT_FILE='/var/etc/acme-client/certs/CERT_UUID/fullchain.pem'
|
|
KEY_FILE='/var/etc/acme-client/keys/CERT_UUID/private.key'
|
|
```
|
|
|
|
If `os-acme-client` exports the certificate to a custom directory, simply set the correct paths:
|
|
|
|
```sh
|
|
CERT_FILE='/path/to/fullchain.pem'
|
|
KEY_FILE='/path/to/private.key'
|
|
```
|
|
|
|
`CERTIFICATE_ID` is the stable external certificate id. If it does not exist, RustProxy creates a manual certificate entry. If it already exists as a manual certificate, RustProxy rotates it in place. RustProxy-managed ACME ids are rejected to prevent two renewal owners for one lineage.
|
|
|
|
## 3. RustProxy API
|
|
|
|
Create a certificate API key in RustProxy and enter its values in the configuration:
|
|
|
|
```text
|
|
RUSTPROXY_KEY_ID
|
|
RUSTPROXY_TOKEN
|
|
```
|
|
|
|
The script sends the certificate to:
|
|
|
|
```text
|
|
POST /api/certificates/deploy
|
|
```
|
|
|
|
The connection from OPNsense to RustProxy should use HTTPS.
|
|
|
|
## 4. Test
|
|
|
|
Run the certificate reconciliation:
|
|
|
|
```sh
|
|
/usr/local/sbin/opnsense-rustproxy-cert-deploy.sh
|
|
```
|
|
|
|
On success, you should see a message similar to:
|
|
|
|
```text
|
|
RustProxy certificate reconcile succeeded (HTTP 200, id=shared-cert)
|
|
```
|
|
|
|
## 5. OPNsense Automation
|
|
|
|
Optionally install the `configd` action:
|
|
|
|
```sh
|
|
cp actions_rustproxy_cert.conf /usr/local/opnsense/service/conf/actions.d/
|
|
service configd restart
|
|
```
|
|
|
|
Then go to **System -> Settings -> Cron** and add a scheduled execution of the `Deploy ACME certificate to RustProxy` action.
|
|
|
|
The script deliberately reconciles on every run instead of trusting a local cache. The server is the source of truth: an identical RustProxy-owned certificate generation is a no-op, a missing id is created, and changed material is rotated atomically. This also repairs drift when a certificate entry or generation was removed outside OPNsense.
|
|
|
|
## Additional Options
|
|
|
|
If RustProxy uses a private CA:
|
|
|
|
```sh
|
|
RUSTPROXY_CACERT='/usr/local/etc/ssl/rustproxy-ca.pem'
|
|
```
|
|
|
|
If you want to connect to a specific LAN address while keeping proper TLS hostname verification:
|
|
|
|
```sh
|
|
RUSTPROXY_RESOLVE='rustproxy.lan:8443:192.168.1.20'
|
|
```
|