Let's Encrypt Without Port 80
=============================

If you're an regular reader of this 
irregular phlog, you'll know that my 
VPS hosting company discontinued its 
OpenVZ service a few days ago, which 
disrupted the circumlunar.space 
XMPP service that I host, and left 
me scrambling to find a new VPS. 
One of my self-imposed conditions was 
to find a VPS outside the United 
States. I would have preferred a 
server in Canada (like the old one), 
but could not find one at a reasonable 
price. The new one is in Germany.

My absolutely favoured solution would 
have been to host the XMPP service 
from home, on the raspberry pi zero w 
that hosts my personal gopher site. 
But that seemed near impossible. My 
ISP blocks port 80 and a host of 
others. Without port 80, obtaining a 
Let's Encrypt certificate was a 
challenge. I need the certificate to 
secure the XMPP tx/rx, and also wanted 
it so that I could host webdav / 
caldav / cardav in the future. This 
could be done with a self-signed 
certificate, but getting the 
certificate out to a number of people 
(and having them all install it) 
seemed too awkward. 

After getting the new server set up, I 
learned that my ISP does not block 
port 443 (which is used for secure 
http connections). That led me to 
acme.sh[1], which provides a means to 
obtain a Let's Encrypt certificate 
over port 443. The remainder of this 
phlog entry is in the nature of some 
"how-to" notes, so that I don't forget 
how to do this in the future, when I 
will move the XMPP server to the 
raspberry pi. Since many of you 
self-host, I thought it would be great 
information to share.

This all applies to a server running 
Debian 9 (actually, Raspbian in my 
case). I should also add that while 
this setup will work well for my 
purposes (dav and XMPP), it is not a 
great method for serving web pages, 
since there's no way (that I know of 
yet) to force https, given that port 
80 is blocked so the regular methods 
of pushing a visitor from http to 
https don't work. That means that 
visitors have to enter 
https://yourwebsite.com in order to 
see it. Entering either 
http://yourwebsite.com or 
yourwebsite.com will lead them to a 
dead end.


Certificates
============

acme.sh installation: various methods 
are described on the official github 
README.md. I used the following 
method, though I know many people 
cringe at the curl/sh combination:

curl https://get.acme.sh | sh

acme.sh will tell you to install a 
couple of other pieces of software 
that it needs to work. Make a note of 
them and do it before proceeding to 
the next step.

To install the certificates and make 
it so that they will work with the 
lighttpd web server, I cobbled 
together the following script from 
various sources on the internet:



#!/bin/bash

/root/.acme.sh/acme.sh --issue -d yourserver.com --alpn --force \
--cert-file      /path/to/your/server/yourserver.com/cert.pem  \
--key-file       /path/to/your/server/yourserver.com/privkey.pem  \
--fullchain-file /path/to/your/server/yourserver.com/fullchain.crt \
--capath         /path/to/your/server/yourserver.com/chain.pem

cat /path/to/your/server/yourserver.com/privkey.pem /path/to/your/server/yourserver.com/cert.pem > /path/to/your/server/yourserver.com/merged.pem



The path is simply a path to wherever 
you want to store your certificates. A 
typical choice would be:
/etc/letsencrypt/yourserver.com/

You can omit the --force switch if you 
like. I included it in case I need to 
use the script to renew in the future.

Set the permissions on those 
directories (/etc/letsencrypt/ and 
/etc/letsencrypt/yourserver/) in the 
manner described in step 3 of this 
guide: 
https://www.vultr.com/docs/setup-let-s-encrypt-with-lighttpd-on-ubuntu-16-04

The final 'cat' line is lighttpd 
specific, to produce the  merged 
certificate lighttpd needs. I also 
included instructions to acme.sh to 
install all of the certificates I 
thought that I might possibly need in 
the future.

When you run acme.sh, it will set up a 
cron job for renewal. I don't know if 
it will work properly. I doubt it, 
because it needs the webserver shut 
down in order to work.

As noted, I want to set up various dav 
servers and XMPP.


DAV Setup
=========

For the dav portion, I am using 
lighttpd.

Lighttpd Setup Notes:

Lighttpd with SSL Guide:
https://www.vultr.com/docs/setup-let-s-encrypt-with-lighttpd-on-ubuntu-16-04

You won't need steps one and two. 
Adapt steps three through five to your 
purpose.

Lighttpd Webdav Guide:
https://www.howtoforge.com/tutorial/how-to-install-webdav-with-lighttpd-on-debian-jessie/


XMPP Setup
==========

Prosody (XMPP) Setup:

Use the official documentation. 
https://prosody.im/doc

Prosody is one of the best-documented 
pieces of open source software that I 
have come across.


[1] https://github.com/acmesh-official/acme.sh