nicofrand

Install CozyCloud along with YunoHost

nicofrand -

This article expects:

  • you already installed Cozy and created your instance manually (without cozy-coclyclo) on a subdomain
  • you are able to edit your DNS zone

Generate your wildcard certificate

YunoHost uses acme-tiny (a python script) to generate its certificates, but it's quite difficult to use manually, so we'll use certbot-auto.

Download certbot

The version 0.22 at least is required to obtain a wildcard certificate, which means you cannot (currently) install it through apt install certbot. We'll download it from the EFF's website.

cd /usr/local/bin
wget https://dl.eff.org/certbot-auto
chmod +x ./certbot-auto

If you want to check the integrity of the file in addition to HTTPS, there are instructions on this page: https://certbot.eff.org/docs/install.html.

Create the certificates & the challenge

certbot-auto certonly \
--server https://acme-v02.api.letsencrypt.org/directory \
--manual \
--manual-public-ip-logging-ok \
--preferred-challenges dns \
-d *.cozy.domain.tld,cozy.domain.tld

It will ask you to deploy two DNS TXT records under the name _acme-challenge.cozy.domain.tld, please proceed (see with your hoster how to do so).

You can check your DNS records with dig:

dig TXT _acme-challenge.cozy.domain.tld. +short @8.8.8.8

The DNS method is the only way allowed to obtain a wildcard certificate.

Note the path of your certificates that are provided.

Add a cron to automatically renew your certs

I actually did not manage to automatically renew a cert using the DNS authentifier :(.

Create the VirtualHost

Create manually a virtual host in /etc/nginx/sites-available named cozy.domain.tld with the content below. Replace /path/to/cert and /path/to/key by the paths returned by certbot earlier.

server {
    listen 80;
    server_name .cozy.domain.tld cozy.domain.tld;
    
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name .cozy.domain.tld cozy.domain.tld;

    ssl_certificate /path/to/cert;
    ssl_certificate_key /path/to/key;
    
    # Here set the max file size you might want to upload
    client_max_body_size 2G;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_redirect http:// https://;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }

    access_log /var/log/nginx/cozy.domain.tld.log;
    error_log /var/log/nginx/cozy.domain.tld.error.log;
}

Reload nginx: service nginx reload.