# Acmelia

Guide on how to issue certificates for `int.bksp.in` and `svc.bksp.in` domains.

@[https://github.com/b4ck5p4c3/acmelia](https://github.com/b4ck5p4c3/acmelia) 

## Intro

As these internal zones delegated to a local name server (ns1.bksp.in), it’s tricky to issue a certificate for them:

* HTTP-01 challenge wouldn’t work because device is behind NAT.
* DNS-01 challenge wouldn’t work as you need to change local zone files.

Acmelia facilitates this by a clever trick:


1. NS1 is configured for 1:1 map of `_acme-challenge.*.int.bksp.in => _acme-challenge.*.int.acme-delegated.bksp.in` to resolve ACME challenges on Cloudflare, rather than NS1.
2. Acmelia implements the `acmeproxy` protocol to make changes in Cloudflare without exposing CF credentials to the entire fleet of devices.

## Acmeproxy

Acmeproxy is a DNS-challenge strategy supported by many ACME clients:

* Lego (Traefik & other Go-based software): <https://go-acme.github.io/lego/dns/httpreq/>
* Acme.sh: <https://github.com/acmesh-official/acme.sh/blob/master/dnsapi/dns_acmeproxy.sh>
* Caddy DNS: <https://github.com/caddy-dns/acmeproxy>

| **Endpoint** | **Username** | **Password** |
|----------|----------|----------|
| https://acmelia.bksp.in | *UUID generated by genkey* | *Generated by genkey* |

## Create a new credential

Acmeproxy uses Basic auth, so you need to create a new username and password.

```bash
# Log in to ru-lnsk-ingress.
tsh ssh root@ru-lnsk-ingress

# Open acmelia deployment.
cd /root/deployments/acmelia

# Generate a new username+password pair.
# Write them down, you'll never see the password again.
docker compose exec app /acmelia genkey

# Open acmelia.yaml and add a new token entry.
nano acmelia.yaml
```

Here is a brief of what you’d find in that config:

```yaml
zones:
  ...

tokens:
  ...

  # Add this at the end of the file
  - id: UUID_GENERATED_BY_GENKEY
    secret: HASH_GENERATED_BY_GENKEY_STARTING_WITH_$argon2
    domains:
      - my-awesome-device.int.bksp.in
      - my-awesome-service.svc.bksp.in
      - ... more
```

Save changes, and return to the console:

```bash
# Restart acmelia to reload config
docker compose restart
```

## Usage

### Caddy

```bash
https://mamont.int.bksp.in {
        tls {
                issuer acme {
                        dir https://acme-v02.api.letsencrypt.org/directory
                        profile tlsserver

                        dns acmeproxy https://acmelia.bksp.in {
                                username your-generated-uuid-here
                                password your-password-here
                        }
                        resolvers 1.1.1.1 8.8.8.8 9.9.9.9
                }
        }
}
```

### acme.sh

```bash
ACMEPROXY_ENDPOINT="https://acmelia.bksp.in" \
ACMEPROXY_USERNAME="your-generated-uuid-here" \
ACMEPROXY_PASSWORD="your-password-here" \
acme.sh \
  --issue \
  --dns dns_acmeproxy \
  -d my-awesome-device.int.bksp.in
```

---

**Documents**

- [BKSP 101](https://wiki.bksp.in/s/public/doc/bksp-101-HvrtlzB32F)
- [Проекты](https://wiki.bksp.in/s/public/doc/proekty-yjWZscgTvo)
- [Infrastructure](https://wiki.bksp.in/s/public/doc/infrastructure-VPKsJwVSVh)
- [Пространство](https://wiki.bksp.in/s/public/doc/prostranstvo-UF1eSbQDi5)
- [Equipment](https://wiki.bksp.in/s/public/doc/equipment-t5MYAVJ8l0)
- [Other](https://wiki.bksp.in/s/public/doc/other-uPW1YJQaRt)