-
Notifications
You must be signed in to change notification settings - Fork 5.5k
Add HTTPD OL9 image #2959
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
Add HTTPD OL9 image #2959
Conversation
My immediate reaction was that HTTPS/TLS support would be preferable, but that would require either the creation of self-signed certificates (so that Apache actually starts) or a startup script that checked for the existence of certificates (provided via bind mount or some other mechanism) before enabling TLS support. Thoughts? |
I am happy to do this, although is there any problem for us generating openssl certs? (guess it's at runtime so shouldn't matter..) |
Have added something simple, and checked that it works. |
Anything else to do here? |
SERVER_CERT="$CERTIFICATE_DIR/localhost.crt" | ||
SERVER_KEY="$KEY_DIR/localhost.key" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should also check for the existance of the standard ACME files, e.g. privkey.pem
, cert.pem
, fullchain.pem
and ca.pem
.
Or just rename these two to privkey.pem
and fullchain.pem
so they can be overloaded via bind mount to a host-wide ACME certificate.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is just the default for the SSL config - I could do a sed to fix it though. Expecting acme mounts seems logical.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Also, some sort of output to stderr
if we do fallback to self-signed certificates would probably be pretty useful too.
Wanting some review on this, just thinking about default listen ports, should SSL be enabled (i.e dnf install -y mod_ssl), etc.