2 ms·
I actually have the reverse model: requesting certs is done by its own isolated and dedicated container and scp’d to the server which needs it. Compromising a
by josteink 8y ago
I actually have the reverse model: requesting certs is done by its own isolated and dedicated container and scp’d to the server which needs it.
Compromising a web-server will thus not compromise my DNS.
- xref 8y agoI like the sound of this idea, happen to have a Dockerfile/scripts for it on GitHub?
- josteink 8y agoNope. I’m using LXC and have set things up manually. It’s just a basic setup with dehydrated[1], some bash scripts for deployment and cron though. [1] https://github.com/lukas2511/dehydrated https://github.com/lukas2511/dehydrated