https://github.com/status-im/infra-role-origin-certs
Ansible role for deploying CloudFlare origin cert
https://github.com/status-im/infra-role-origin-certs
ansible-role certificates certs infra
Last synced: 8 months ago
JSON representation
Ansible role for deploying CloudFlare origin cert
- Host: GitHub
- URL: https://github.com/status-im/infra-role-origin-certs
- Owner: status-im
- Created: 2019-03-06T13:35:40.000Z (over 7 years ago)
- Default Branch: master
- Last Pushed: 2022-08-02T19:04:44.000Z (almost 4 years ago)
- Last Synced: 2025-02-22T17:43:27.967Z (over 1 year ago)
- Topics: ansible-role, certificates, certs, infra
- Homepage:
- Size: 7.81 KB
- Stars: 0
- Watchers: 48
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# Descirption
This role installs the certificate and key pair from CloudFlare which is called an __Origin__ certificate and is issued by CloudFlare CA to facilitate an SSL Proxy setup which allows the site to authenticate with the `*.status.im` wildcard certificate from CloudFlare without having it on the host.
>WARNING: The origin certificate alone is not enough to facilitate a valid SSL setup.
Details: https://blog.cloudflare.com/cloudflare-ca-encryption-origin/
# Configuration
```yaml
origin_certs:
- domain: 'status.im'
crt: '-----BEGIN CERTIFICATE-----\nABC...'
key: '-----BEGIN PRIVATE KEY-----\n321...'
default: true
- domain: 'example.org'
crt: '-----BEGIN CERTIFICATE-----\nXYZ...'
key: '-----BEGIN PRIVATE KEY-----\n123...'
```
# Usage
The certificates end up under `/certs/${domain}` like so:
```
/certs/status.im/origin.crt
/certs/status.im/origin.key
/certs/example.org/origin.crt
/certs/example.org/origin.key
/certs/origin.crt -> /certs/status.im/origin.crt
/certs/origin.key -> /certs/status.im/origin.key
```
With the default cert being symlinked under `/certs/origin.{crt,key}` as a workarounf for old setup.
These certificates are used by services like Nginx or Grafana for the purpose of verifying their identity for CloudFlare proxy servers.