Domains of backend APIs and SSL

Contact info

Yueteng | yh958@cornell.edu

Root domain

Root domain is:

diaper.cf

(Note: Do NOT use this root domain directly. Instead, use the subdomains under the Domains to use table below.

Registered as a free domain (renewable every 12 months) at https://www.freenom.com/

User account login info (email, password) are the same as gmail/github/etc

Current registration expires on 2021-12-05 (December 5th) (Must renew at the above website before expiration)

Domains to use

For API callers (i.e. frontend web/app)

Choose the domain accordingly, prepend it with http or https, and append it with port number and path.

SSL Certificate for https

The free SSL cert from Let's Encrypt is used for this purpose.

Let's Encrypt website (no need to visit for this purpose, though): https://letsencrypt.org/

Tutorial for creating SSL cert

[Tutorial: Configure SSL/TLS on Amazon Linux 2 - Amazon Elastic Compute Cloud]

(https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/SSL-on-amazon-linux-2.html#letsencrypt)

On section "Certificate automation: Let’s Encrypt with Certbot on Amazon Linux 2", Use this to instal `certauto`, but not to create

Stop after done `sudo yum install -y certbot python2-certbot-apache`

[Generate Wildcard SSL certificate using Let’s Encrypt/Certbot | by Saurabh Palande | Medium]

(https://medium.com/@saurabh6790/generate-wildcard-ssl-certificate-using-lets-encrypt-certbot-273e432794d7)
Start at Step 3 (skip Step 1/2). Replace `./certbot-auto` with `sudo certbot`
Use the command line below to create
Note: There can be multiple domains in command, e.g. `-d diaper.cf -d *.diaper.cf` (where * is a wildcard)
Note: (The order is important) First deploy DNS TXT record under the prompted domain (do so at website of freenom), pause for 5 minutes for it to activate, use the website below (MxToolbox) to verify it’s been activated (mind the value must be correct) then hit continue (otherwise will fail)
Note: If you include multiple domains, you will be required to enter multiple DNS TXT records
[DNS Lookup Text Record - MxToolbox](https://mxtoolbox.com/TXTLookup.aspx)

Command line to use

sudo certbot certonly --manual --preferred-challenges=dns --email diapertestemail@gmail.com --server https://acme-v02.api.letsencrypt.org/directory --agree-tos -d diaper.cf -d *.diaper.cf

Cert information

Upon success, you'll see some information similar to below

Press Enter to Continue
Waiting for verification...
Cleaning up challenges
Subscribe to the EFF mailing list (email: diapertestemail@gmail.com).

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/diaper.cf/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/diaper.cf/privkey.pem
   Your cert will expire on 2021-03-05. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot
   again. To non-interactively renew *all* of your certificates, run
   "certbot renew"

As shown above, current SSL cert expires on 2021-03-05 (March 5th) (Must renew by the command given "certbot renew" before expiration; Might need to run with "sudo")

Note SSL cert is a separate thing to register besides domain. These two need to be renewed separately.

Copy cert files to somewhere docker can access and give permission

Create a cert folder under project path, and copy both .pem files into the folder. Then change the permissions by:

sudo chown ec2-user:ec2user ./certs/*

This will allow flask and docker to access the cert files.

Specify which yml file to use when launching docker on production and test environment

Separate docker-compose config files named docker-compose-prod.yml and docker-compose-test.yml are created.

Since only production and test environment will use this cert. When launching docker, must specify this yml file.

Command Line

// For production at 35.168.248.57
docker-compose -f docker-compose-prod.yml up -d

// For test at 3.232.82.82
docker-compose -f docker-compose-test.yml up -d