Skip to content

Commit

Permalink
Add a note about let's encrypt challenge requiring the port 80 to be …
Browse files Browse the repository at this point in the history 
…accessible

Also changes the document category and added an Id.
  • Loading branch information
@cescoffier
cescoffier committed Sep 9, 2024
1 parent fe706f2 commit 2871848
Showing 1 changed file with 24 additions and 1 deletion.
25 changes: 24 additions & 1 deletion docs/src/main/asciidoc/tls-registry-reference.adoc
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,10 @@ This guide is maintained in the main Quarkus repository
and pull requests should be submitted there:
https://github.com/quarkusio/quarkus/tree/main/docs/src/main/asciidoc
////
[id="tls-registry-reference"]
= TLS registry reference

Check warning on line 7 in docs/src/main/asciidoc/tls-registry-reference.adoc

View workflow job for this annotation

GitHub Actions / Linting with Vale 

[vale] reported by reviewdog 🐶
[Quarkus.Headings] Use sentence-style capitalization in 'TLS registry reference'.

Raw Output:
{"message": "[Quarkus.Headings] Use sentence-style capitalization in 'TLS registry reference'.", "location": {"path": "docs/src/main/asciidoc/tls-registry-reference.adoc", "range": {"start": {"line": 7, "column": 3}}}, "severity": "INFO"}
include::_attributes.adoc[]
:categories: network
:categories: web
:summary: TLS registry configuration and usage
:numbered:
:sectnums:
Expand Down Expand Up @@ -1180,6 +1181,27 @@ quarkus.tls.lets-encrypt.enabled=true
quarkus.management.enabled=true
----

[IMPORTANT]
====
.Port 80
The Let's Encrypt ACME challenge requires that the application is reachable on port `80` (basically: `http://your-dns-name`).
Ensure the port `80` is accessible from the Internet.
It might require an explicit security policy depending on your hosting provider.
We also recommend setting `quarkus.http.insecure-requests` to `redirect` to redirect all HTTP requests to HTTPS.

Check warning on line 1191 in docs/src/main/asciidoc/tls-registry-reference.adoc

View workflow job for this annotation

GitHub Actions / Linting with Vale 

[vale] reported by reviewdog 🐶
[Quarkus.Fluff] Depending on the context, consider using 'using more direct instructions' rather than 'recommend'.

Raw Output:
{"message": "[Quarkus.Fluff] Depending on the context, consider using 'using more direct instructions' rather than 'recommend'.", "location": {"path": "docs/src/main/asciidoc/tls-registry-reference.adoc", "range": {"start": {"line": 1191, "column": 9}}}, "severity": "INFO"}
The ACME challenge accepts self-signed certificates and up to 10 redirections:

Check warning on line 1192 in docs/src/main/asciidoc/tls-registry-reference.adoc

View workflow job for this annotation

GitHub Actions / Linting with Vale 

[vale] reported by reviewdog 🐶
[Quarkus.Spelling] Use correct American English spelling. Did you really mean 'redirections'?

Raw Output:
{"message": "[Quarkus.Spelling] Use correct American English spelling. Did you really mean 'redirections'?", "location": {"path": "docs/src/main/asciidoc/tls-registry-reference.adoc", "range": {"start": {"line": 1192, "column": 66}}}, "severity": "WARNING"}
[source, properties]
----
quarkus.tls.lets-encrypt.enabled=true
quarkus.management.enabled=true
quarkus.http.insecure-requests=redirect
----
====

[[lets-encrypt-prepare]]

The challenge is served from the primary HTTP interface (accessible from your DNS domain name).

Check warning on line 1205 in docs/src/main/asciidoc/tls-registry-reference.adoc

View workflow job for this annotation

GitHub Actions / Linting with Vale 

[vale] reported by reviewdog 🐶
[Quarkus.CaseSensitiveTerms] Use 'management console' rather than 'HTTP interface'.

Raw Output:
{"message": "[Quarkus.CaseSensitiveTerms] Use 'management console' rather than 'HTTP interface'.", "location": {"path": "docs/src/main/asciidoc/tls-registry-reference.adoc", "range": {"start": {"line": 1205, "column": 42}}}, "severity": "INFO"}

IMPORTANT: Do not start your application yet.
Expand Down Expand Up @@ -1305,5 +1327,6 @@ Now, because ngrok only forwards ACME challenges over HTTP, start ngrok as follo
ngrok http --domain <YOUR-NGROK-DOMAIN> 8080 --scheme http <1>
----
<1> `8080` is the localhost HTTP port your application is listening on.
Note that the application will be accessible from `http://YOUR-NGROK-DOMAIN` on port `80` but redirected to your local machine on port `8080`.

Check warning on line 1330 in docs/src/main/asciidoc/tls-registry-reference.adoc

View workflow job for this annotation

GitHub Actions / Linting with Vale 

[vale] reported by reviewdog 🐶
[Quarkus.Fluff] Depending on the context, consider using 'Be concise: rewrite the sentence to not use' rather than 'Note that'.

Raw Output:
{"message": "[Quarkus.Fluff] Depending on the context, consider using 'Be concise: rewrite the sentence to not use' rather than 'Note that'.", "location": {"path": "docs/src/main/asciidoc/tls-registry-reference.adoc", "range": {"start": {"line": 1330, "column": 1}}}, "severity": "INFO"}

You can now test the Quarkus Let's Encrypt ACME feature from your local machine.

0 comments on commit 2871848

Please sign in to comment.