Add SSL encription

[Israel-Laguan]

I'd like to enable a fully automated LetsEncrypt workflow for users who do not want to manage their own keys.

With that said, for this to work I want either fully in binary LetsEncrypt client - or perhaps download one. After some searching, I quickly bumped into acme-client, and while it looks great it's also a bit stagnant. I'm concerned that if I implement this flow, I'll have to fork it and manage it myself if it becomes abandoned.

Another option I thought about is finding a no-dependency binary client and having my binary download an external asset if the user wishes to signup for LetsEncrypt.

Because I'm not familiar with LetsEncrypt, might there be something obvious I'm missing? Using acme-client is what I'm leaning towards using, with the assumption that I'll have to fork it if it is indeed abandoned. Any opinions on how you might manage this would be greatly appreciated. Thanks :)

References:

• Thread in reddit: https://www.reddit.com/r/rust/comments/diehvj/easiest_way_to_embed_letsencrypt_functionality/

• Using acme-lib: https://github.com/algesten/acme-lib/pull/54/files

[Israel-Laguan]

I found this amazing tutorial

https://blog.jarrousse.org/2022/04/09/an-elegant-way-to-use-docker-compose-to-obtain-and-renew-a-lets-encrypt-ssl-certificate-with-certbot-and-configure-the-nginx-service-to-use-it/

Key things to consider:

• SSL logic/installation/stuff can and should be OUTSIDE the server
• There are some ready-made boilerplates for this, agnostic from server language
• can be deployed into the server as a stand-alone script

Some follow up to say a true Zero Trust should be using real keys instead of Let's Encrypt

https://smallstep.com/blog/automate-docker-ssl-tls-certificates/

Other refs:

• https://github.com/wmnnd/nginx-certbot
• https://dev.to/dhirajpatra/how-to-setup-ssl-with-docker-4bgh

[Israel-Laguan]

Would try to reproduce the certbot solution to leave server agnostic of SSL/HTTPS stuff

[Israel-Laguan]

I was thinking this is "infrastructure" and should be dependant on certain tools/packages/state-of-the-art. Maybe it is not worth pursuing.