page generation update for: 2023-01-04 20:54:55.956720379 +0000 UTC m=+7.520331386
This commit is contained in:
idk
@ -72,6 +72,11 @@
|
||||
docs/SERVICES
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="docs/TLS.html">
|
||||
docs/TLS
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="docs/index.html">
|
||||
docs/index.html
|
||||
|
||||
@ -66,6 +66,11 @@
|
||||
SERVICES
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="TLS.html">
|
||||
TLS
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="index.html">
|
||||
index.html
|
||||
|
||||
@ -66,6 +66,11 @@
|
||||
SERVICES
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="TLS.html">
|
||||
TLS
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="index.html">
|
||||
index.html
|
||||
@ -95,7 +100,7 @@
|
||||
<p>
|
||||
When you run a reseed under Docker in this fashion, it will automatically
|
||||
generate a self-signed certificate for your reseed server in a Docker volume
|
||||
mamed reseed-keys.
|
||||
named reseed-keys.
|
||||
<em>
|
||||
Back up this directory
|
||||
</em>
|
||||
|
||||
@ -8,7 +8,7 @@ and group inside the container as I2P.
|
||||
|
||||
When you run a reseed under Docker in this fashion, it will automatically
|
||||
generate a self-signed certificate for your reseed server in a Docker volume
|
||||
mamed reseed-keys. *Back up this directory*, if it is lost it is impossible
|
||||
named reseed-keys. *Back up this directory*, if it is lost it is impossible
|
||||
to reproduce.
|
||||
|
||||
Please note that Docker is not currently compatible with .onion reseeds unless
|
||||
|
||||
@ -66,6 +66,11 @@
|
||||
SERVICES
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="TLS.html">
|
||||
TLS
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="index.html">
|
||||
index.html
|
||||
@ -95,17 +100,6 @@
|
||||
</h3>
|
||||
<pre><code>./reseed-tools reseed --signer=you@mail.i2p --netdb=/home/i2p/.i2p/netDb --p2p
|
||||
</code></pre>
|
||||
<h3>
|
||||
Without a webserver, standalone, upload a single signed .su3 to github
|
||||
</h3>
|
||||
<ul>
|
||||
<li>
|
||||
This one isn’t working yet, I’ll get to it eventually, I’ve got a cooler idea now.
|
||||
<code>
|
||||
./reseed-tools reseed --signer=you@mail.i2p --netdb=/home/i2p/.i2p/netDb --github --ghrepo=reseed-tools --ghuser=eyedeekay
|
||||
</code>
|
||||
</li>
|
||||
</ul>
|
||||
<h3>
|
||||
Without a webserver, standalone, in-network reseed
|
||||
</h3>
|
||||
@ -120,11 +114,6 @@
|
||||
Without a webserver, standalone, Regular TLS, OnionV3 with TLS, and LibP2P
|
||||
</h3>
|
||||
<pre><code>./reseed-tools reseed --tlsHost=your-domain.tld --signer=you@mail.i2p --netdb=/home/i2p/.i2p/netDb --onion --p2p
|
||||
</code></pre>
|
||||
<h3>
|
||||
Without a webserver, standalone, Regular TLS, OnionV3 with TLS, I2P In-Network reseed, and LibP2P, self-supervising
|
||||
</h3>
|
||||
<pre><code>./reseed-tools reseed --tlsHost=your-domain.tld --signer=you@mail.i2p --netdb=/home/i2p/.i2p/netDb --onion --p2p --littleboss=start
|
||||
</code></pre>
|
||||
<div id="sourcecode">
|
||||
<span id="sourcehead">
|
||||
|
||||
@ -13,14 +13,6 @@
|
||||
./reseed-tools reseed --signer=you@mail.i2p --netdb=/home/i2p/.i2p/netDb --p2p
|
||||
```
|
||||
|
||||
### Without a webserver, standalone, upload a single signed .su3 to github
|
||||
|
||||
* This one isn't working yet, I'll get to it eventually, I've got a cooler idea now.
|
||||
|
||||
```
|
||||
./reseed-tools reseed --signer=you@mail.i2p --netdb=/home/i2p/.i2p/netDb --github --ghrepo=reseed-tools --ghuser=eyedeekay
|
||||
```
|
||||
|
||||
### Without a webserver, standalone, in-network reseed
|
||||
|
||||
```
|
||||
@ -38,9 +30,3 @@
|
||||
```
|
||||
./reseed-tools reseed --tlsHost=your-domain.tld --signer=you@mail.i2p --netdb=/home/i2p/.i2p/netDb --onion --p2p
|
||||
```
|
||||
|
||||
### Without a webserver, standalone, Regular TLS, OnionV3 with TLS, I2P In-Network reseed, and LibP2P, self-supervising
|
||||
|
||||
```
|
||||
./reseed-tools reseed --tlsHost=your-domain.tld --signer=you@mail.i2p --netdb=/home/i2p/.i2p/netDb --onion --p2p --littleboss=start
|
||||
```
|
||||
@ -66,6 +66,11 @@
|
||||
SERVICES
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="TLS.html">
|
||||
TLS
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="index.html">
|
||||
index.html
|
||||
|
||||
247
docs/TLS.html
Normal file
247
docs/TLS.html
Normal file
@ -0,0 +1,247 @@
|
||||
<html>
|
||||
<head>
|
||||
<title>
|
||||
I2P Reseed Tools
|
||||
</title>
|
||||
<meta name="author" content="eyedeekay" />
|
||||
<meta name="description" content="reseed-tools" />
|
||||
<meta name="keywords" content="master" />
|
||||
<link rel="stylesheet" type="text/css" href="style.css" />
|
||||
<link rel="stylesheet" type="text/css" href="showhider.css" />
|
||||
</head>
|
||||
<body>
|
||||
<div id="navbar">
|
||||
<a href="#shownav">
|
||||
Show navigation
|
||||
</a>
|
||||
<div id="shownav">
|
||||
<div id="hidenav">
|
||||
<ul>
|
||||
<li>
|
||||
<a href="..">
|
||||
Up one level ^
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href=""></a>
|
||||
</li>
|
||||
<li>
|
||||
<a href=""></a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="index.html">
|
||||
index.html
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="index.html">
|
||||
index.html
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href=""></a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="DEBIAN.html">
|
||||
DEBIAN
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="DOCKER.html">
|
||||
DOCKER
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="EXAMPLES.html">
|
||||
EXAMPLES
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="index.html">
|
||||
index
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="SERVICES.html">
|
||||
SERVICES
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="TLS.html">
|
||||
TLS
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="index.html">
|
||||
index.html
|
||||
</a>
|
||||
</li>
|
||||
</ul>
|
||||
<br>
|
||||
<a href="#hidenav">
|
||||
Hide Navigation
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<a id="returnhome" href="/">
|
||||
/
|
||||
</a>
|
||||
<h1>
|
||||
TLS Configuration for your Reseed Server
|
||||
</h1>
|
||||
<p>
|
||||
By default,
|
||||
<code>
|
||||
reseed-tools
|
||||
</code>
|
||||
will generate self-signed certificates for your reseed service.
|
||||
This is so that it can use TLS by default, and so that it can offer self-signed certificates when operating in
|
||||
<code>
|
||||
.onion
|
||||
</code>
|
||||
mode.
|
||||
It is also possible to configure
|
||||
<code>
|
||||
reseed-tools
|
||||
</code>
|
||||
without TLS certificates,
|
||||
or to configure it to use ACME in order to automtically obtain a certificate from Let’s Encrypt.
|
||||
</p>
|
||||
<p>
|
||||
I2P does not rely on TLS Certificate Authorities to authenticate reseed servers.
|
||||
Instead, the certificates are effectively “Pinned” in the software, after manual review by the I2P developers and the community.
|
||||
It is acceptable to use self-signed certificates in this fashion because they are not summarily trusted.
|
||||
A self-signed certificate which is not configured in the I2P software will not work when serving a reseed to an I2P router.
|
||||
</p>
|
||||
<h2>
|
||||
Disable TLS
|
||||
</h2>
|
||||
<p>
|
||||
If you do this, it is highly recommended that you use a reverse proxy such as
|
||||
<code>
|
||||
Apache2
|
||||
</code>
|
||||
or
|
||||
<code>
|
||||
nginx
|
||||
</code>
|
||||
to provide a TLS connection to clients.
|
||||
Alternatively, you could run
|
||||
<code>
|
||||
reseed-tools
|
||||
</code>
|
||||
as an
|
||||
<code>
|
||||
.onion
|
||||
</code>
|
||||
service and rely on Tor for encryption and authentication.
|
||||
</p>
|
||||
<p>
|
||||
You can disable automatic TLS configuration with the
|
||||
<code>
|
||||
--trustProxy
|
||||
</code>
|
||||
flag like this:
|
||||
</p>
|
||||
<pre><code>
|
||||
./reseed-tools reseed --signer=you@mail.i2p --netdb=/home/i2p/.i2p/netDb --trustProxy
|
||||
</code></pre>
|
||||
<h2>
|
||||
Setup Self-Signed TLS non-interactively
|
||||
</h2>
|
||||
<p>
|
||||
If you don’t want to interactively configure TLS but still want to use self-signed certificates, you can pass the
|
||||
<code>
|
||||
--yes
|
||||
</code>
|
||||
flag, which will use the defaults for all config values.
|
||||
</p>
|
||||
<pre><code>
|
||||
./reseed-tools reseed --signer=you@mail.i2p --netdb=/home/i2p/.i2p/netDb --yes
|
||||
</code></pre>
|
||||
<h2>
|
||||
Use ACME to acquire TLS certificate
|
||||
</h2>
|
||||
<p>
|
||||
Instead of self-signed certificates, if you want to chain up to a TLS CA, you can.
|
||||
To automate this process using an ACME CA, like Let’s Encrypt, you can use the
|
||||
<code>
|
||||
--acme
|
||||
</code>
|
||||
flag.
|
||||
Be sure to change the
|
||||
<code>
|
||||
--acmeserver
|
||||
</code>
|
||||
option in order to use a
|
||||
<strong>
|
||||
production
|
||||
</strong>
|
||||
ACME server, as
|
||||
the software defaults to a
|
||||
<strong>
|
||||
staging
|
||||
</strong>
|
||||
ACME server for testing purposes.
|
||||
</p>
|
||||
<pre><code>
|
||||
./reseed-tools reseed --signer=you@mail.i2p --netdb=/home/i2p/.i2p/netDb --acme --acmeserver="https://acme-v02.api.letsencrypt.org/directory"
|
||||
</code></pre>
|
||||
<div id="sourcecode">
|
||||
<span id="sourcehead">
|
||||
<strong>
|
||||
Get the source code:
|
||||
</strong>
|
||||
</span>
|
||||
<ul>
|
||||
<li>
|
||||
<a href="https://i2pgit.org/idk/reseed-tools">
|
||||
Source Repository: (https://i2pgit.org/idk/reseed-tools)
|
||||
</a>
|
||||
</li>
|
||||
</ul>
|
||||
</div>
|
||||
<div>
|
||||
<a href="#show">
|
||||
Show license
|
||||
</a>
|
||||
<div id="show">
|
||||
<div id="hide">
|
||||
<pre><code>Copyright (c) 2014 Matt Drollette
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
in the Software without restriction, including without limitation the rights
|
||||
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
copies of the Software, and to permit persons to whom the Software is
|
||||
furnished to do so, subject to the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be included in
|
||||
all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
THE SOFTWARE.
|
||||
</code></pre>
|
||||
<a href="#hide">
|
||||
Hide license
|
||||
</a>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div>
|
||||
<iframe src="https://snowflake.torproject.org/embed.html" width="320" height="240" frameborder="0" scrolling="no"></iframe>
|
||||
</div>
|
||||
<div>
|
||||
<a href="https://geti2p.net/">
|
||||
<img src="i2plogo.png"></img>
|
||||
I2P
|
||||
</a>
|
||||
</div>
|
||||
</body>
|
||||
</html>
|
||||
@ -66,6 +66,11 @@
|
||||
SERVICES
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="TLS.html">
|
||||
TLS
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="index.html">
|
||||
index.html
|
||||
|
||||
@ -72,6 +72,11 @@
|
||||
docs/SERVICES
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="docs/TLS.html">
|
||||
docs/TLS
|
||||
</a>
|
||||
</li>
|
||||
<li>
|
||||
<a href="docs/index.html">
|
||||
docs/index.html
|
||||
|
||||
Reference in New Issue
Block a user