Let's Encrypt support

Got an idea? Missing something? Post your feature request here.

Moderator: moderators

Let's Encrypt support

Postby apastuszak » Tue Apr 18, 2017 1:52 am

I'd like to be able to configure Subsonic to use my domain name and then be able to connect to let's encrypt and get a free cert from them.
apastuszak
 
Posts: 78
Joined: Tue Oct 29, 2013 4:00 am

Re: Let's Encrypt support

Postby apastuszak » Tue Apr 18, 2017 4:02 am

Found this script that might do what I need here.

https://pastebin.com/8cSL1uES

Haven't tested it yet, but it does look promising if you run Subsonic on Linux
apastuszak
 
Posts: 78
Joined: Tue Oct 29, 2013 4:00 am

Re: Let's Encrypt support

Postby wl-lankin » Tue Apr 18, 2017 10:29 am

Hi. I solved this by registrating the letsencrypt Certificate to my Domain and implemented this in Apache. Then set up a reverse Proxy in Apache to localhost:4040. Now you have to set up a DNS Server and bind the subsonic Server IP to your Domainname to use your Domain in your private Network instead of IP's that the Certificate will work. You can also do this with nginx. The SSL function of subsonic must be set to off.
Sorry for My bad english
wl-lankin
 
Posts: 4
Joined: Mon Apr 17, 2017 4:41 pm

Re: Let's Encrypt support

Postby b.bassett » Tue May 09, 2017 5:01 pm

I have all my music on a Windows 2012 Server with subsonic installed and I am also using Letsencrypt with IIS. I have gotten it all to work, but I would love to see Subsonic come bundled with Letsencrypt so there is no need to do URL rewrites.
b.bassett
 
Posts: 9
Joined: Thu Jan 19, 2017 10:51 pm

Re: Let's Encrypt support

Postby kulps » Thu May 11, 2017 5:32 am

I would also like this.
kulps
 
Posts: 4
Joined: Mon Apr 24, 2017 4:35 pm

Re: Let's Encrypt support

Postby wendigo » Sat May 13, 2017 5:32 pm

I second that, it would be a very welcome feature for me as well.
wendigo
 
Posts: 24
Joined: Sun Dec 11, 2011 11:50 am

Re: Let's Encrypt support

Postby kulps » Wed May 24, 2017 8:55 pm

Having built-in LetsEncrypt would be really great. I can imagine having an option in the settings that says "only allow https" followed by options for LetsEncrypt.
kulps
 
Posts: 4
Joined: Mon Apr 24, 2017 4:35 pm

Re: Let's Encrypt support

Postby rveach » Thu Jun 01, 2017 6:14 pm

I found this easier to do with an nginx reverse proxy. It has better performance than apache for this kind of thing.

I've removed hosts and passwords from configs.

FIrst, I moved the context root for subsonic to /subsonic.
/etc/default/subsonic:
Code: Select all
SUBSONIC_ARGS="--max-memory=150 --context-path=/subsonic --db=jdbc:mysql:########"


filename /etc/nginx/sites-available/<hostname>
Code: Select all
server {
        listen 80;
        server_name <hostname>;
        access_log /var/log/nginx/<hostname>.log;


        # subsonic - jetty
        location /subsonic {
                proxy_pass http://localhost:4040/subsonic;
                access_log /var/log/nginx/subsonic.access.log;
                error_log /var/log/nginx/subsonic.error.log;
        }


    listen 443 ssl;
        ssl_certificate /etc/letsencrypt/live/<hostname>/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/<hostname>/privkey.pem;
        ssl_session_cache shared:le_nginx_SSL:1m;
        ssl_session_timeout 1440m;

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
        ssl_prefer_server_ciphers on;

        ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-SHA ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-SHA ECDHE-RSA-AES128-SHA256 ECDHE-RSA-AES256-SHA384 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-AES128-SHA DHE-RSA-AES256-SHA DHE-RSA-AES128-SHA256 DHE-RSA-AES256-SHA256 EDH-RSA-DES-CBC3-SHA";

}
rveach
 
Posts: 1
Joined: Thu Jun 01, 2017 6:05 pm

Re: Let's Encrypt support

Postby josquin » Mon Jun 26, 2017 4:32 pm

Hello Guys,

On a linux box (Debian).
I did it like that.

Code: Select all
/opt/letsencrypt/letsencrypt-auto certonly -t --agree-tos --renew-by-default --standalone --preferred-challenges http-01 -d www.foobar.org
cat /etc/letsencrypt/live/www.foobar.org/privkey.pem /etc/letsencrypt/live/www.foobar.org/fullchain.pem > /mnt/msa-foo-store/certs/www.foobar.org.crt
openssl pkcs12 -in /mnt/msa-foo-store/certs/www.foobar.org.crt -export -out /mnt/msa-foo-store/certs/www.foobar.org.pkcs12 -passout pass:mypass
keytool -importkeystore -srckeystore /mnt/msa-foo-store/certs/www.foobar.org.pkcs12 -srcstorepass subsonic -destkeystore /mnt/msa-foo-store/certs/subsonic.keystore -deststorepass mypass --srcstoretype PKCS12 -srcalias 1 -destalias subsonic
cd /mnt/msa-foo-store/certs
zip /usr/share/subsonic/subsonic-booter-jar-with-dependencies.jar subsonic.keystore
/etc/init.d/subsonic restart


Hope this helps.
User avatar
josquin
 
Posts: 21
Joined: Mon Jun 06, 2016 1:51 pm


Return to Feature Requests

Who is online

Users browsing this forum: Bing [Bot] and 21 guests