Subj : Re: 21:1/100
To   : Oli
From : Avon
Date : Fri Oct 15 2021 07:24 pm


On 14 Oct 2021 at 11:41a, Oli pondered and said...
 
 Ol>  A> now to try and get the secure stuff working on 24553 .. not yet sure h
 Ol>  A> ;-)
 Ol> 
 Ol> # apt-get install nginx

done this bit.

 Ol> then add the following to /etc/nginx.conf
 Ol> 
 Ol> stream {
 Ol>   server {
 Ol>     listen 24553 ssl;
 Ol>     listen [::]:24553 ssl;
 Ol>     ssl_protocols TLSv1.2 TLSv1.3;
 Ol>     ssl_certificate     /srv/certs/fidonet-rsa.key;
 Ol>     ssl_certificate_key /srv/certs/fidonet-rsa.crt;
 Ol>     ssl_certificate     /srv/certs/fidonet-ed25519.key;
 Ol>     ssl_certificate_key /srv/certs/fidonet-ed25519.crt;
 Ol>     proxy_pass 127.0.0.1:24554;
 Ol>   }
 Ol> }

OK done, but commented out for now while I sort the certs.

Question, what is /srv dir for? This sort of stuff?

 Ol> You also need to create a cert (can be self-signed). Of course you can
 Ol> put the certs in any path you like.

OK, so not /srv necessarily?

 Ol> ecdsa cert:
 Ol> $ openssl genpkey -algorithm ed25519 > fidonet-ed25519.key
 Ol> $ openssl req -new -x509 -nodes -days 1200 -key fidonet-ed25519.key -out
 Ol> fidonet-ed25519.crt -text -subj "/CN=localhost"
 Ol> 
 Ol> rsa cert:
 Ol> openssl req -new -newkey rsa -days 1200 -nodes -x509 -keyout
 Ol> fidonet-rsa.key -out fidonet-rsa.crt -text -subj "/CN=localhost"

I know little about this (yet) but am I correct to assume a Lets Encrypt cert would be better / more well known? Not sure I am stating this correctly.

Why for the self signed stuff 1200 days? If I created self signed stuff how could anyone trust it compared to something like Lets Encrypt that is third party?

 Ol> Alternatively use a letsencrypt cert.

Something I'm thinking (will wait until I hear from you) may be the better way to go? Also something I have not ever done but would like to learn how etc. :)

 Ol> restart nginx:
 Ol> 
 Ol> $ systemctl restart nginx
 Ol> 

OK will hold off that until I sort the certs.

Will I also need to have something configured in BinkD to talk to nginx? 

I'd better read the nginx man.

--- Mystic BBS v1.12 A47 2021/09/29 (Linux/64)
 * Origin: Agency BBS | Dunedin, New Zealand | agency.bbs.nz (21:1/101)

.