Stormancer.LettuceEncrypt 1.1.7.2-pre

This Stormancer node plugin adds support for using Let's encrypt to generate HTTPS certificate generation for Stormancer public and admin APIs. This plugin is based on the Lettuce encrypt library, made by Nate McMaster.

Configuration

Currently the plugin must be configured on each node independently.

Configuring lettuce encrypt

The lettuceEncrypt section must be added to the node configuration under the plugins section.

  "plugins": {
    ,
    "lettuceEncrypt": {
      "enabled": true,

      // Email for certificate renewal (required)
      "email": "email@email.com",
      // Domain name(s) to request certificates for
      "domainNames": [ "foo.com","admin.foo.com" ],

      // Use Let's Encrypt staging server for issuing certificate. true for testing ; false for prod
      "useStagingServer": true,
      // Directory to be used to save LettuceEncrypt data. Required.
      "certificateDirectory": "C:/strm-data/lettuceEncrypt",
      // Show detailed LettuceEncrypt (and Kestrel) logs.
      "showLogs": false
    }
  },

Configure the Stormancer Web Apis to use the certificates

To configure both admin and public API to use different domains on the same HTTPS port, use a variant of the following configuration : It configures a single HTTP endpoint setup as https on the port 443, which uses Lettuce Encrypt as certificate provider. Both the public and admin API use this endpoint, and are configured to only be active on the foo.com and admin.foo.com domains. respectively.

  "webApis": {
    "endpoints": {
      "public": {
        "ip": "*",
        "port": "443",
        "settings": { "https":"lettuceEncrypt"}
      }
    },

    "publicApi": {
      "endpoint": [ "public" ],
      "hosts": ["foo.com"],
      "publish": [ "https://foo.com" ]
    },

    "adminApi": {
      "endpoint": [ "public" ],
      "hosts": ["admin.foo.com"],
      "publish": ["https://admin.foo.com" ]
    }
  }

If using the same port for admin and public apis, Firewall rules (IP Whitelisting) cannot be used to limit access to the admin API. If this endpoint configuration is chosen, it's therefore strongly advised to also setup an authentication system on the admin API.