finallycoffee/matrix-docker-ansible-deploy
5
1
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Add guide about certificates for other domains

Browse Source 
We had something like that on the Server Delegation how-to page,
but it's better if we have it on the SSL certificates page.

Relocated there and improved linking.

Fixes #94 (Github Issue)
This commit is contained in:
Slavi Pantaleev
2019-02-08 11:59:00 +02:00
parent f4fa03d4b9
commit 46accfdb3c
2 changed files with 49 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
docs/howto-server-delegation.md
View File

@ -54,20 +54,10 @@ To use DNS SRV record validation, you need to:
How you can obtain a valid certificate for `<your-domain>` on the `matrix.<your-domain>` server is up to you.
If `<your-domain>` and `matrix.<your-domain>` is the same machine, you can let the playbook obtain the certificate for you by redefining the `matrix_ssl_domains_to_obtain_certificates_for` variable. Example:
If `<your-domain>` and `matrix.<your-domain>` are hosted on the same machine, you can let the playbook obtain the certificate for you, by following our [Obtaining SSL certificates for additional domains](configuring-playbook-ssl-certificates.md#obtaining-ssl-certificates-for-additional-domains) guide.
```yaml
matrix_ssl_domains_to_obtain_certificates_for:
- '{{ hostname_matrix }}'
- '{{ hostname_riot }}'
- '{{ hostname_identity }}'
```
This way, the playbook would obtain certificates for your base domain as well (referred to by the `hostname_identity` variable).
The certificate files would be available in `/matrix/ssl/config/live/<your-domain>/...`.
If `<your-domain>` and `matrix.<your-domain>` are not the same machine, you can copy over the certificate files manually.
If they get renewed automatically, you may also have to transfer them periodically. How often you do that is up to you, as long as the certificate files don't expire.
If `<your-domain>` and `matrix.<your-domain>` are not hosted on the same machine, you can copy over the certificate files manually.
Don't forget that they may get renewed once in a while, so you may also have to transfer them periodically. How often you do that is up to you, as long as the certificate files don't expire.
### Serving the Federation API with your certificates