iroh icon indicating copy to clipboard operation
iroh copied to clipboard

iroh-relay expects a particular setup of certificate directory

Open link2xt opened this issue 1 year ago • 1 comments

I am trying to setup iroh-relay with this configuration:

addr = "[::]:443"
stun_port = 3478
hostname = "iroh.example.org"
enable_stun = true
enable_relay = true

[tls]
cert_mode = "Manual"
prod_tls = true
contact = "[email protected]"
cert_dir = "/var/lib/acme/live/iroh.example.org/"

The server is using acmetool which creates directory with the following files:

$ ls /var/lib/acme/live/iroh.example.org/
account
cert
chain
fullchain
privkey
url

iroh expects .key and .crt files instead: https://github.com/n0-computer/iroh/blob/b07547b68eb771e789474ad4f1344e02b2223f95/iroh-net/src/bin/iroh-relay.rs#L108-L109

I can create a folder with symlinks that links iroh.example.org.crt to fullchain file and iroh.example.org.key to privkey file, but it would have been easier if instead of cert_dir configuration accepted two explicit paths for the key and for certificate chain.

link2xt avatar Apr 11 '24 15:04 link2xt

As a workaround I did:

$ mkdir cert_dir
$ ln -s /var/lib/acme/live/iroh.testrun.org/privkey cert_dir/iroh.example.org.key
$ ln -s /var/lib/acme/live/iroh.testrun.org/fullchain cert_dir/iroh.example.org.crt

link2xt avatar Apr 11 '24 15:04 link2xt