pk/atst
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use mounted all-in-one cert for nginx ssl

Browse Source 
Mount the combined key and cert for nginx ssl using flexvol and point the necessary nginx config at it.
This commit is contained in:
tomdds 2019-11-26 17:01:16 -05:00
parent 9b8d5e3662
commit 26bb2f4614
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
deploy/azure/atst-nginx-configmap.yml
View File

@ -39,8 +39,8 @@ data:
# access_log /var/log/nginx/access.log json; # access_log /var/log/nginx/access.log json;
listen ${PORT_PREFIX}442 ssl; listen ${PORT_PREFIX}442 ssl;
listen [::]:${PORT_PREFIX}442 ssl ipv6only=on; listen [::]:${PORT_PREFIX}442 ssl ipv6only=on;
ssl_certificate /etc/ssl/private/atat.crt; ssl_certificate /etc/ssl/atat.crt;
ssl_certificate_key /etc/ssl/private/atat.key; ssl_certificate_key /etc/ssl/atat.crt;
# additional SSL/TLS settings # additional SSL/TLS settings
include /etc/nginx/snippets/ssl.conf include /etc/nginx/snippets/ssl.conf
@ -72,8 +72,8 @@ data:
server_name ${AUTH_DOMAIN}; server_name ${AUTH_DOMAIN};
listen ${PORT_PREFIX}443 ssl; listen ${PORT_PREFIX}443 ssl;
listen [::]:${PORT_PREFIX}443 ssl ipv6only=on; listen [::]:${PORT_PREFIX}443 ssl ipv6only=on;
ssl_certificate /etc/ssl/private/atat.crt; ssl_certificate /etc/ssl/atat.crt;
ssl_certificate_key /etc/ssl/private/atat.key; ssl_certificate_key /etc/ssl/atat.crt;
# Request and validate client certificate # Request and validate client certificate
ssl_verify_client on; ssl_verify_client on;
ssl_verify_depth 10; ssl_verify_depth 10;

4
deploy/azure/azure.yml
View File

@ -146,8 +146,8 @@ spec:
options: options:
usepodidentity: "true" usepodidentity: "true"
keyvaultname: "atat-vault-test" keyvaultname: "atat-vault-test"
keyvaultobjectnames: "dhparam4096" keyvaultobjectnames: "dhparam4096;staging-cert"
keyvaultobjectaliases: "dhparam.pem" keyvaultobjectaliases: "dhparam.pem;atat.crt"
keyvaultobjecttypes: secret keyvaultobjecttypes: secret
tenantid: $TENANT_ID tenantid: $TENANT_ID
--- ---