redash SSL化メモ

# 概要

* redashをSSL化させる
* ホストはdocker(docker-compose)
* 証明書はLet's Encrypt


# 詳細

* 以下詳細
    * ライブラリあれこれ無いエラー多発で証明書作成までけっこう大変かも
    * 事前にDNS登録しておく

* ホストOSで以下実行

```
$ sudo certbot certonly --dns-route53 -d 'redash.<hoge>.com' --email xxxxx@xxxxx.co.jp -n --agree-tos
/usr/lib/python3/dist-packages/requests/__init__.py:80: RequestsDependencyWarning: urllib3 (1.26.8) or chardet (3.0.4) doesn't match a supported version!
  RequestsDependencyWarning)
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Certificate not yet due for renewal

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Certificate not yet due for renewal; no action taken.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
```

* 作成された証明書確認


```
$ sudo ls -l  /etc/letsencrypt/live/redash.<hoge>.com
total 4
-rw-r--r-- 1 root root 692 Jan 13 14:26 README
lrwxrwxrwx 1 root root  44 Jan 13 14:26 cert.pem -> ../../archive/redash.<hoge>.com/cert1.pem
lrwxrwxrwx 1 root root  45 Jan 13 14:26 chain.pem -> ../../archive/redash.<hoge>.com/chain1.pem
lrwxrwxrwx 1 root root  49 Jan 13 14:26 fullchain.pem -> ../../archive/redash.<hoge>.com/fullchain1.pem
lrwxrwxrwx 1 root root  47 Jan 13 14:26 privkey.pem -> ../../archive/redash.<hoge>.com/privkey1.pem
```

```
$ systemctl list-unit-files  | grep certbot
certbot.service                                static         
certbot.timer                                  enabled        
```

* 証明書自動更新確認

```
$ sudo systemctl list-timers
NEXT                         LEFT          LAST                         PASSED      UNIT                         ACTIVATES
Thu 2022-01-13 15:39:00 JST  16min left    Thu 2022-01-13 15:09:04 JST  12min ago   phpsessionclean.timer        phpsessionclean.service
Thu 2022-01-13 18:33:05 JST  3h 11min left Thu 2022-01-13 07:59:21 JST  7h ago      apt-daily.timer              apt-daily.service
Thu 2022-01-13 22:06:05 JST  6h left       Thu 2022-01-13 08:08:32 JST  7h ago      motd-news.timer              motd-news.service
Fri 2022-01-14 03:43:26 JST  12h left      Thu 2022-01-13 14:14:47 JST  1h 7min ago certbot.timer                certbot.service
Fri 2022-01-14 06:18:45 JST  14h left      Thu 2022-01-13 06:48:20 JST  8h ago      apt-daily-upgrade.timer      apt-daily-upgrade.service
Fri 2022-01-14 15:21:02 JST  23h left      Thu 2022-01-13 15:21:02 JST  1min 1s ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
Mon 2022-01-17 00:00:00 JST  3 days left   Mon 2022-01-10 00:00:07 JST  3 days ago  fstrim.timer                 fstrim.service
```

* 自動更新系のファイル確認


```
$ ls -l /lib/systemd/system/certbot*
-rw-r--r-- 1 root root 233 Dec 18  2020 /lib/systemd/system/certbot.service
-rw-r--r-- 1 root root 156 Dec 18  2020 /lib/systemd/system/certbot.timer
```

* cronもセットされるので確認

```
$ cat /etc/cron.d/certbot
:
0 */12 * * * root test -x /usr/bin/certbot -a \! -d /run/systemd/system && perl -e 'sleep int(rand(43200))' && certbot -q renew
```

* 自動更新されない場合は以下のコマンド
    * 結構なぜかされない場合がある
    * ライブラリが古いなどの場合は更新できないことがある

```
sudo certbot renew
       or
sudo certbot renew --force-renewal
```

# error tips

```
/usr/lib/python3/dist-packages/requests/__init__.py:80: RequestsDependencyWarning: urllib3 (1.26.9) or chardet (5.0.0) doesn't match a supported version!
  RequestsDependencyWarning)
```


* dns-route53がない

    * debian/ubuntuの場合はOS標準の利用を推奨している  [debianのpipについて](python.jp/install/ubuntu/pip.html)


```
sudo certbot -v certonly --dns-route53 -d 'redash.<hoge>.jp' --email <taro>@<hoge>.co.jp -n --agree-tos
Saving debug log to /var/log/letsencrypt/letsencrypt.log
The requested dns-route53 plugin does not appear to be installed //dns-route53がない
Ask for help or search for solutions at https://community.letsencrypt.org. See the logfile /var/log/letsencrypt/letsencrypt.log or re-run Certbot with -v for more details.
```
    * 入れてみる

```
sudo apt-get install python3-certbot-dns-route53
Reading package lists... Done
Building dependency tree... Done
:
Do you want to continue? [Y/n] Y
Get:1 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu jammy/universe amd64 python3-boto3 all 1.20.34+dfsg-1 [68.0 kB]
Get:2 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu jammy/main amd64 python3-pbr all 5.8.0-0ubuntu1 [66.5 kB]
Get:3 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu jammy/universe amd64 python3-mock all 4.0.3-3 [60.4 kB]
Get:4 http://ap-northeast-1.ec2.archive.ubuntu.com/ubuntu jammy/universe amd64 python3-certbot-dns-route53 all 1.3.0-1 [8124 B]
```