JaniSoto/mcserver
SHA256
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

docs: document Let's Encrypt TLS provisioning and AutoModpack sync workflow

Browse source 
- Add Section 5 to docs/infrastructure-base.md detailing Certbot setup with Cloudflare DNS API.
- Document PKCS#8 private key conversion and .private/ certificate deployment.
- Document automatic 60-day renewal deploy hook for seamless TLS maintenance.
- Update Data Preservation Reference Matrix in docs/operations-manual.md to classify data/automodpack/.private/ as GitIgnored Secret.
This commit is contained in:
JaniSoto 2026-08-17 16:54:36 +00:00
parent d6f492abbb
commit f3d9137710
2 changed files with 56 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
docs/infrastructure-base.md
View file

@ -77,3 +77,58 @@ sudo resize2fs /dev/sda1
# 4. Verify capacity (Target: ~190G+ available)
df -h /
```
---
## 5. Automated SSL/TLS Certificate Provisioning (AutoModpack)
AutoModpack uses TLS 1.3 to encrypt modpack distribution to clients. To prevent client "Certificate Verification" warnings, host-side Let's Encrypt certificates are issued via DNS-01 challenge and synced to AutoModpack in PKCS#8 format.
### Prerequisites
* **Domain DNS**: `mc.sotohome.top` configured on Cloudflare (DNS Only / Grey Cloud).
* **Cloudflare API Token**: Scoped with `Zone.DNS` edit permissions for `sotohome.top`.
### Package Installation
```bash
sudo apt update && sudo apt install -y certbot python3-certbot-dns-cloudflare
```
### Credentials & Issuance
1. Save token to restricted host path `/etc/letsencrypt/cloudflare.ini`:
```ini
dns_cloudflare_api_token = <YOUR_CLOUDFLARE_API_TOKEN>
```
2. Restrict file permissions:
```bash
sudo chmod 600 /etc/letsencrypt/cloudflare.ini
```
3. Issue Let's Encrypt certificate:
```bash
sudo certbot certonly \
--dns-cloudflare \
--dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
-d mc.sotohome.top \
--non-interactive --agree-tos -m jgsc00@gmail.com
```
### AutoModpack Certificate Sync & PKCS#8 Conversion
AutoModpack requires keys in **PKCS#8 PEM format** placed inside `runtime/data/automodpack/.private/`:
```bash
sudo openssl pkcs8 -topk8 -nocrypt \
-in /etc/letsencrypt/live/mc.sotohome.top/privkey.pem \
-out /tmp/key.pem
sudo cp /etc/letsencrypt/live/mc.sotohome.top/fullchain.pem \
~/mcserver/instances/forge-1.20.1-survival/runtime/data/automodpack/.private/cert.crt
sudo cp /tmp/key.pem \
~/mcserver/instances/forge-1.20.1-survival/runtime/data/automodpack/.private/key.pem
sudo rm /tmp/key.pem
sudo chown -R opc:opc ~/mcserver/instances/forge-1.20.1-survival/runtime/data/automodpack/.private/
sudo chmod 600 ~/mcserver/instances/forge-1.20.1-survival/runtime/data/automodpack/.private/cert.crt
sudo chmod 600 ~/mcserver/instances/forge-1.20.1-survival/runtime/data/automodpack/.private/key.pem
```
### Automatic Renewal Deploy Hook
Certbot executes `/etc/letsencrypt/renewal-hooks/deploy/automodpack.sh` on 60-day auto-renewals to convert keys, update AutoModpack, and restart `mc_forge_server`.

1
docs/operations-manual.md
View file

@ -21,6 +21,7 @@ When performing world resets or maintenance, classify directories according to t
| **Immutable** | `data/eula.txt` | EULA agreement file | **Preserve** |
| **GitIgnored Secret** | `data/server.properties` | Generated server settings (contains RCON password) | Rebuilt on boot |
| **GitIgnored Secret** | `.env` | Container environment variables | **Preserve** |
| **GitIgnored Secret** | `data/automodpack/.private/` | CA-signed TLS certificates (`cert.crt`, `key.pem`) | **Preserve** |
| **GitIgnored Runtime** | `data/config/lts_auth/players.json` | LTS Auth player account credentials | Delete on full reset |
| **GitIgnored Runtime** | `data/config/fiw-mods-api/profiles/` | FIW anti-cheat player profiles | Delete on full reset |
| **Volatile** | `data/world/` | Dynamic terrain & player data | Delete to reset seed |