All Projects → kchristensen → Udm Le

kchristensen / Udm Le

Licence: mit
Let's Encrypt support for Ubiquiti UbiOS firmwares

Programming Languages

shell
77523 projects

Projects that are alternatives of or similar to Udm Le

Ceryx
Dynamic reverse proxy based on NGINX OpenResty with an API
Stars: ✭ 688 (+304.71%)
Mutual labels:  ssl, letsencrypt
Greenlock
Automatic SSL renewal for NodeJS
Stars: ✭ 30 (-82.35%)
Mutual labels:  ssl, letsencrypt
Docker Letsencrypt Nginx Proxy Companion
Automated ACME SSL certificate generation for nginx-proxy
Stars: ✭ 6,350 (+3635.29%)
Mutual labels:  letsencrypt, ssl
Nginxconfig.io
⚙️ NGINX config generator on steroids 💉
Stars: ✭ 14,983 (+8713.53%)
Mutual labels:  ssl, letsencrypt
Acme client
Java ACME Client application
Stars: ✭ 77 (-54.71%)
Mutual labels:  ssl, letsencrypt
Ansible Role Certbot
Ansible Role - Certbot (for Let's Encrypt)
Stars: ✭ 477 (+180.59%)
Mutual labels:  ssl, letsencrypt
Acmetool
🔒 acmetool, an automatic certificate acquisition tool for ACME (Let's Encrypt)
Stars: ✭ 1,882 (+1007.06%)
Mutual labels:  ssl, letsencrypt
Echo
High performance, minimalist Go web framework
Stars: ✭ 21,297 (+12427.65%)
Mutual labels:  ssl, letsencrypt
Docker Letsencrypt Certgen
Docker image to generate, renew, revoke RSA and/or ECDSA SSL certificates from LetsEncrypt CA using certbot and acme.sh clients in automated fashion
Stars: ✭ 64 (-62.35%)
Mutual labels:  ssl, letsencrypt
Letsencrypt heroku
Automated letsencrypt setup for heroku
Stars: ✭ 58 (-65.88%)
Mutual labels:  ssl, letsencrypt
Certbot Route53
Helping create Let's Encrypt certificates for AWS Route53
Stars: ✭ 159 (-6.47%)
Mutual labels:  ssl, letsencrypt
Serverpilot Letsencrypt
Automate the installation of Let's Encrypt SSL on the free plan of ServerPilot
Stars: ✭ 129 (-24.12%)
Mutual labels:  ssl, letsencrypt
Ssl Proxy
🔒 Simple zero-config SSL reverse proxy with real autogenerated certificates (LetsEncrypt, self-signed, provided)
Stars: ✭ 427 (+151.18%)
Mutual labels:  ssl, letsencrypt
Ssl Certificate
A class to validate SSL certificates
Stars: ✭ 522 (+207.06%)
Mutual labels:  ssl, letsencrypt
Dnsrobocert
Orchestrate Certbot and Lexicon together to provide Let's Encrypt TLS certificates validated by DNS challenges
Stars: ✭ 420 (+147.06%)
Mutual labels:  ssl, letsencrypt
Docker Mailserver
Production-ready fullstack but simple mail server (SMTP, IMAP, LDAP, Antispam, Antivirus, etc.) running inside a container.
Stars: ✭ 8,115 (+4673.53%)
Mutual labels:  ssl, letsencrypt
Acme Client
Let's Encrypt / ACME client written in PHP for the CLI.
Stars: ✭ 337 (+98.24%)
Mutual labels:  ssl, letsencrypt
Certes
A client implementation for the Automated Certificate Management Environment (ACME) protocol
Stars: ✭ 357 (+110%)
Mutual labels:  ssl, letsencrypt
Certify
SSL Certificate Manager UI for Windows, powered by Let's Encrypt. Download from certifytheweb.com
Stars: ✭ 1,075 (+532.35%)
Mutual labels:  ssl, letsencrypt
Certificaat
General-purpose ACME client
Stars: ✭ 88 (-48.24%)
Mutual labels:  ssl, letsencrypt

Let's Encrypt for Ubiquiti UbiOS firmwares

Overview

This should work on UbiOS based firmware versions 1.7.0 onwards. This includes:

  • UniFi Dream Machine
  • UniFi Dream Machine Pro

It does NOT support the Cloud Key Gen 2 or Gen 2 Plus as they do not ship with Docker (podman) support.

This script supports issuing LetsEncrypt certificates via DNS using Lego.

Out of the box, it has tested support for select DNS providers but with little work you could get it working with any of the supported Lego DNS Providers.

Installation

  1. Copy the contents of this repo to your device at /mnt/data/udm-le.
  2. Edit udm-le.env and tweak variables to meet your needs.
  3. Run /mnt/data/udm-le/udm-le.sh initial. This will handle your initial certificate generation and setup a cron task at /etc/cron.d/udm-le to attempt certificate renewal each morning at 0300.

Persistance

On firmware updates or just reboots, the cron file (/etc/cron.d/udm-le) gets removed, so if you'd like for this to persist, I suggest so you install boostchicken's on-boot-script package.

This script is setup such that if it determines that on-boot-script is enabled, it will set up an additional script at /mnt/data/on_boot.d/99-udm-le.sh which will attempt certificate renewal shortly after a reboot (and subsequently set the cron back up again).

DNS Providers

AWS Route53

AWS Route53 DNS challenge can use configuration and authentication values easily through shared credentials and configuration files as described here. This script will check for and include these files during the initial certificate generation and subsequent renewals. Ensure that route53 is set for DNS_PROVIDER in udm-le.env, create a new directory called .secrets in /mnt/data/udm-le and add credentials and config files as required for your authentication. See the AWS CLI Documentation for more information. Currently only the default profile is supported.

GCP Cloud DNS

GCP Cloud DNS can be configured by establishing a service account with the role roles/dns.admin and exporting a service account key for that service account. Ensure that gcloud is set for DNS_PROVIDER in udm-le.env, and GCE_SERVICE_ACCOUNT_FILE references the path to the service account key (e.g. ./root/.secrets/my_service_account.json) . Create a new directory called .secrets in /mnt/data/udm-le and add the service account file.

Cloudflare

In your Cloudflare account settings, create an API token with the following permissions:

  • Zone > Zone > Read
  • Zone > DNS > Edit

Once you have your token generated, add the value to udm-le.env.

Azure DNS

If not done already, delegate a domain to an Azure DNS zone.

Assuming the DNS zone lives in subscription 00000000-0000-0000-0000-000000000000 and resource group udm-le, with help of the Azure CLI provision an identity to manage the DNS zone by running:

# login
az login

# create a service principal with contributor (default) permissions over the godns resource group
az ad sp create-for-rbac --name godns --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/udm-le --role contributor

The CLI will output a JSON object. Use the printed properties to initialize your configuration in udm-le.env.

Note:

  • The password value is a secret and as such you may want to omit it from udm-le.env and instead set it in a .secrets/client-secret.txt file
  • The appId value is what Lego calls a client id
Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].