TLS Secret

添加 SSL 证书需要创建 Secret。

Nanocl 在 CockroachDB 中以 PEM 内容保存 TLS 证书、私钥、证书颁发机构和 DH 参数。只有 Nginx 需要文件时，ncproxy 才将这些值写入运行时目录。

手动配置

💡

可以直接在部署 Statefile 中创建 Secret。
但我们建议使用 Secret 类型的 Statefile，单独管理它们。

下面是实现这一方式的 Statefile 示例：


ApiVersion: v0.18

Namespace: global

Secrets:
- Name: cert.deploy-example.com
  Kind: nanocl.io/tls
  Data:
    Certificate: |
      -----BEGIN CERTIFICATE-----
      MIIDETCCAfkCFFOJVQs8PxWlcJQDn/AQpSopkhISMA0GCSqGSIb3DQEBCwUAMEUx
      CzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRl
      cm5ldCBXaWRnaXRzIFB0eSBMdGQwHhcNMjMwNTI5MDM0MDQwWhcNMjQwNTI4MDM0
      MDQwWjBFMQswCQYDVQQGEwJBVTETMBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UE
      CgwYSW50ZXJuZXQgV2lkZ2l0cyBQdHkgTHRkMIIBIjANBgkqhkiG9w0BAQEFAAOC
      AQ8AMIIBCgKCAQEAyH+TAzIAxxrMKh88p1emIxsttpjqCHdlQuboves+0vI6ORwU
      BI3HP7gTMQpgK+QnEZw1XIs6/Zdg2VfUiNgQXyh72/0cdurIIqRbF2fLAMSaYElA
      RRT9F60eHqQ12bXf6ITWB/0ZSnacbLIsic1HcVwr0Awx+xu1YsB9ojssXyIIU/yx
      d6FjPtiqJTPT9RhVb6Vmfpclse21qGek8tg88U+TrrJZ/Eg5cZojnQTyxhMGHeQf
      F71nb7no1v5hdki3p50Ik//9lvY/5onWrBUCuAsHi8OkSSyElTQ/JYzuMBjqOaMw
      PYLZf3d2eRqpiEC/5WI8OJDAk3/y83nG3zy3+QIDAQABMA0GCSqGSIb3DQEBCwUA
      A4IBAQAz8b7U0jbgBVEen1vd15V6DAxTmg768OkMRoNqK/y0oSK0qHn3IYSADK6M
      fl6qPnTY3xts+j8ohvNRGR5rJiv25b8koQs6K/ACzMgVlvXeSBVgjBArxgyp3K3q
      Tpeqg11R5YuJLaMKjWTzOzSq6shLO5/TscLGpkDbZ12HElc5hXyLrEZmsdCb1Wg7
      RCaMqsmgD/bYTOgP41DN6MVaSmxCshCGcL78enStPDheCmkk7eLMetMrJZLkf5Ch
      YWs3OUPos4v9GN40VyNWtbrz9g8TzmD4QOfuhuj9nUg9Psa2c22rgr3XaJEU8nyp
      rSHTKorbCvimz1/m0crjE91CP9JE
      -----END CERTIFICATE-----
    CertificateKey: |
      -----BEGIN PRIVATE KEY-----
      MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDIf5MDMgDHGswq
      HzynV6YjGy22mOoId2VC5ui96z7S8jo5HBQEjcc/uBMxCmAr5CcRnDVcizr9l2DZ
      V9SI2BBfKHvb/Rx26sgipFsXZ8sAxJpgSUBFFP0XrR4epDXZtd/ohNYH/RlKdpxs
      siyJzUdxXCvQDDH7G7ViwH2iOyxfIghT/LF3oWM+2KolM9P1GFVvpWZ+lyWx7bWo
      Z6Ty2DzxT5Ousln8SDlxmiOdBPLGEwYd5B8XvWdvuejW/mF2SLennQiT//2W9j/m
      idasFQK4CweLw6RJLISVND8ljO4wGOo5ozA9gtl/d3Z5GqmIQL/lYjw4kMCTf/Lz
      ecbfPLf5AgMBAAECggEAHK2Su5xFXDVLCqNZK55v1wmmKj4JC5j4VO9uTuv9GnMn
      PM/1VQlqfIS5ygPv6ZdCt1QeldQcZfVnFu9nKQOuo83ImZjEn4XJhpr3pItmEAAP
      DMKtfLQZ128dpchbI37OPhXx/0aGfY4lpa5+jF9eXqqOYb280GwQL8XUsoXAPQMC
      MwAOHbgHH5lYxD9fizjrWIFIC9jfHjVM3qjOfmz+NujKs+nmVI5AQRCd6C66hbgr
      2EJe/8ZlDaZX3bfDnRPxhQN8T3VZcwHGj3zqGPnfkr8Ut9nqDhOcqGuTjNdqGEIi
      meDmKzPsssZg5+sPjgzMsPVf/XQ+v4dLQ2GSYuehOQKBgQDTfzD+K5/rR382HWHX
      VnL+KXD7cTA7DQq4ma/7UlJMaxhuA11w/4wF/lRiXKNUTfpUSyIybT8IP23fgFDV
      zLq2G36+mpUXbxPjlFaJfxNOlcr35xvsIC3HMBqOKYm74B9rJbLIwsMZcPi/BuJS
      ve7pj9blvjf8ZUXw8erhFFoGUwKBgQDyr+u7OQyIhqhCOpy9Is/DtYBg3MQSDLTO
      TfmqaaUcDvRNy4pgJ2B5Kbs20yAqgBtGDEP+MdtBo3NgIHOA7xjU5biNSz8R12WR
      UmDrdxIvAo2iixN8TDvIs0EEmE5hrRgPRaf6WP3o1okaWnYuq2VC7HSJJFCtWx9V
      Aj7VEOgnAwKBgGAXWdshVvc+9L1RfDKqRHTVv09+jbtGoahdq2c0b8/omKDjRoEg
      mi3e79gA3vReuW2y9UaT/B9zMihp1FBPREWZGGzhLvwGq7Kqoua1pb/+rskTZ8xQ
      knv9jxMoLDwACEZWSnSMiLf2bA3ewtV1FidoAus/EZDLMovWXjEFXiGhAoGBAIGb
      YhGCzia7g3CbTMnVpY+nhwAz5qKdFpJ3IjbYZM0vT1mcsjHX1bXfi5Qj/LG16Nro
      AgfnKGlNmXhk3EqnZmOMq5sJ7Izis+OAUzJtTNC+VFXSYH2pWOQ+lyKVFIclogvF
      74fLrw6CRIZGeYdDEblD/pifRFbQq1MC9/tiJBlxAoGAAo/XDJSTRlcrJuutk5jG
      CZPG5LBlxvdUbsuu2vZ7XIoWp3BvuK+yM8m9kEQgl3x8F3bqRjoQmMN6cImMYC2W
      F02Hw2EcWWx4w+liGjDy8/rcb9KfYTht3Q3W9RYYPZwn+hg4pmGVb4+yOqd183QQ
      Ug0MvH79P7CUpecFPJliDME=
      -----END PRIVATE KEY-----

# See all options:
# https://docs.next-hat.com/references/nanocl/objects/cargo
Cargoes:
- Name: my-cargo
  Containers:
  - Name: web
    Image: ghcr.io/next-hat/nanocl-get-started:latest

# See all options:
# https://docs.next-hat.com/references/nanocl/objects/resource
Resources:
- Name: deploy-example.com
  Kind: ncproxy.io/rule/v0.15
  Data:
    Rules:
    - Domain: deploy-example.com
      Network: Public
      # Enable usage of our secret
      Ssl: cert.deploy-example.com
      Locations:
      - Path: /
        Target:
          Key: global.my-cargo.c
          Port: 9000

也可以通过 CLI 加载本地 PEM 文件。Nanocl 在创建 Secret 前读取文件，因此 CockroachDB 保存文件内容，而不是本地路径：


nanocl secret create tls tls.secret \
--certificate-path ./server.crt \
--certificate-key-path ./server.key \
--certificate-client-path ./ca.crt

升级到 Nanocl 0.18 后首次启动时，nanocld 将旧数据库 TLS Secret 中可读取的文件路径转换为 PEM 内容。首次启动时保持旧文件可用。如果文件将不可用，请在 0.17 守护进程和文件仍可访问时，将 Secret 更新为 PEM 内容，或在启动 0.18 前恢复文件。

使用 Let’s Encrypt 自动配置

可以用 Certbot 为域名生成证书。
我们提供了通用 Statefile，自动执行任务并创建合适的 Secret。
Secret 名称为 cert.{domain_name}。


nanocl state apply -fs nr.next-hat.com/v0.18/certbot -- --email [email protected] --domain deploy-example.com

命令完成后 SSL 已启用，但还需要更新 ProxyRule。
在下一次部署中使用该 Secret：


ApiVersion: v0.18

Namespace: global

# See all options:
# https://docs.next-hat.com/references/nanocl/objects/cargo
Cargoes:
- Name: my-cargo
  Containers:
  - Name: web
    Image: ghcr.io/next-hat/nanocl-get-started:latest

# See all options:
# https://docs.next-hat.com/references/nanocl/objects/resource
Resources:
- Name: deploy-example.com
  Kind: ncproxy.io/rule/v0.15
  Data:
    Rules:
    - Domain: deploy-example.com
      Network: Public
      # Enable usage of our secret
      Ssl: cert.deploy-example.com
      Locations:
      - Path: /
        Target:
          Key: global.my-cargo.c
          Port: 9000

更多信息见 Secret 参考文档。