For those who imagine Drupal Development Company docs and Drupal Development Company twitters, there isn’t a technique to automate letsencrypt certificates updates on platform.sh. It’s important to create Drupal Development Company certificates manually, add them manually, and preserve them manually. However as readers of this weblog know, Drupal Development Company docs are solely Drupal Development Company begin of Drupal Development Company story. I’ve actually loved working with platform.sh with one among my non-public shoppers, and I couldn’t imagine that with all Drupal Development Company flexibility – all Drupal Development Company POWER – letsencrypt was actually out of attain. I discovered just a few makes an attempt to script it, and one actually nice snippet on gitlab. However nobody had ever actually synthesized these items into a simple howto. So right here we go. 1) Add some writeable directories the place platform.sh CLI and letsencrypt want them. Usually when Platform deploys your software, it places all of it in a read-only filesystem. We’re going to mount some particular directories read-write so all Drupal Development Company letsencrypt/platform magic can work. Edit your software’s .platform.app.yaml file, and discover Drupal Development Company mounts Drupal 10 Upkeep and Help Service part. At Drupal Development Company backside, add these three strains. Make certain to match Drupal Development Company indents with every thing else below Drupal Development Company mounts Drupal 10 Upkeep and Help Service part! 1 2 3 “/net/.well-known” Drupal 10 Upkeep and Help Service “shared Drupal 10 Upkeep and Help Servicefiles/.well-known” “/keys” Drupal 10 Upkeep and Help Service “shared Drupal 10 Upkeep and Help Servicefiles/keys” “/.platformsh” Drupal 10 Upkeep and Help Service “shared Drupal 10 Upkeep and Help Servicefiles/.platformsh” Let’s stroll via every of those Drupal 10 Upkeep and Help Service /net/.well-known Drupal 10 Upkeep and Help Service To be able to verify that you just really management instance.com, letsencrypt drops a file someplace in your web site, after which tries to fetch it. This listing is the place it’s going to do Drupal Development Company drop and fetch. My webroot is net, you need to change this to match your personal surroundings. You would possibly use public or www or one thing. /keys Drupal 10 Upkeep and Help Service It’s important to retailer your keyfiles SOMEWHERE. That is that place. /.platformsh Drupal 10 Upkeep and Help Service Your grasp surroundings wants a little bit of configuration to have the ability to login to platform and replace Drupal Development Company certs in your account. That is the place that may go. 2) Expose Drupal Development Company .well-known listing to Drupal Development Company Web I discussed above that letsencrypt check your management over a site by making a file which it tries to fetch over Drupal Development Company Web. We already created Drupal Development Company writeable listing the place Drupal Development Company scripts can drop Drupal Development Company file, however platform.sh (properly) defaults to cover your directories from Drupal Development Company Web. We’re going so as to add some configuration to Drupal Development Company “net” app part to reveal this .well-known listing. Discover Drupal Development Company net Drupal 10 Upkeep and Help Service part of your .platform.app.yaml file, and Drupal Development Company places Drupal 10 Upkeep and Help Service part below that. At Drupal Development Company backside of that part, add this Drupal 10 Upkeep and Help Service 1 2 3 4 5 6 7 8 ‘/.well-known’ Drupal 10 Upkeep and Help Service # Permit entry to all recordsdata in Drupal Development Company public recordsdata listing. enable Drupal 10 Upkeep and Help Service true expires Drupal 10 Upkeep and Help Service 5m passthru Drupal 10 Upkeep and Help Service false root Drupal 10 Upkeep and Help Service ‘net/.well-known’ # Don’t execute PHP scripts. scripts Drupal 10 Upkeep and Help Service false Ensure you match Drupal Development Company indents of Drupal Development Company different location entries! In my (default) .platform.app.yaml file, I’ve 8 areas earlier than that ‘/.well-known’ Drupal 10 Upkeep and Help Service line. Additionally word that Drupal Development Company root Drupal 10 Upkeep and Help Service parameter there additionally makes use of my webroot listing, so modify that to suit your surroundings. 3) Obtain Drupal Development Company binaries you want throughout Drupal Development Company software “construct” section To be able to do that, we’re going to wish to have Drupal Development Company platform.sh CLI device, and a let’s encrypt CLI device known as lego. We’ll obtain them throughout Drupal Development Company “construct” section of your software. Nonetheless in Drupal Development Company platform.app.yaml file, discover Drupal Development Company hooks Drupal 10 Upkeep and Help Service part, and Drupal Development Company construct Drupal 10 Upkeep and Help Service part below that. Add these steps to Drupal Development Company backside of Drupal Development Company construct Drupal 10 Upkeep and Help Service 1 2 3 cd ~ curl -sL https Drupal 10 Upkeep and Help Service//github.com/xenolf/lego/releases/obtain/v0.3.1/lego_linux_amd64.tar.xz | tar -C .international/bin -xJ –strip-components=1 lego/lego curl -sfSL -o .international/bin/platform.phar https Drupal 10 Upkeep and Help Service//github.com/platformsh/platformsh-cli/releases/obtain/v3.12.1/platform.phar We’re simply downloading moderately current releases of our two instruments. If anybody has a greater technique to get Drupal Development Company newest launch of both device, please let me know. In any other case we’re caught holding this updated manually. 4) Configure Drupal Development Company platform.sh CLI To be able to configure Drupal Development Company platform.sh CLI in your server, we now have to deploy Drupal Development Company adjustments from steps 1-3. Go forward and try this now. I’ll wait. Now hook up with your platform surroundings by way of SSH (platform ssh -e grasp for many of us). First we’ll add a config file for platform. Edit a file in .platformsh/config.yaml with Drupal Development Company editor of selection. You don’t have to make use of vi, however it’ll win you some factors with me. Listed here are Drupal Development Company contents for that file Drupal 10 Upkeep and Help Service 1 2 3 4 updates Drupal 10 Upkeep and Help Service verify Drupal 10 Upkeep and Help Service false api Drupal 10 Upkeep and Help Service token_file Drupal 10 Upkeep and Help Service token Fairly easy Drupal 10 Upkeep and Help Service this tells platform to not hassle updating Drupal Development Company CLI device routinely (it will probably’t – read-only filesystem, keep in mind?). It then tells it to login utilizing an API token, which it will probably discover in Drupal Development Company file .platformsh/token. Let’s create that file subsequent. Log into Drupal Development Company platform.sh net UI (you possibly can launch it with platform net for those who’re feeling sassy), and navigate to your account settings > api tokens. That’s at https Drupal 10 Upkeep and Help Service//accounts.platform.sh/person/12345/api-tokens (with your personal person ID after all). Add an API token, and replica its worth into .platformsh/token on Drupal Development Company surroundings we’re engaged on. Drupal Development Company token must be Drupal Development Company solely contents of that file. Now let’s check it by working php /app/.international/bin/platform.phar auth Drupal 10 Upkeep and Help Serviceinfo. For those who see your account info, congratulations! You’ve got a working platform.sh CLI put in. 5) Request your first certificates by hand Nonetheless SSH’ed into that surroundings, let’s see if every thing works. 1 2 3 lego –email=”support@instance.com” –domains=”www.instance.com” –webroot=/app/public/ –path=/app/keys/ -a run csplit -f /app/keys/certificates/www.instance.com.crt- /app/keys/certificates/www.instance.com.crt ‘/—–BEGIN CERTIFICATE—–/’ ‘{1}’ -z -s php /app/.international/bin/platform.phar area Drupal 10 Upkeep and Help Serviceupdate -p $PLATFORM_PROJECT –no-wait –yes –cert /app/keys/certificates/www.instance.com.crt-00 –chain /app/keys/certificates/www.instance.com.crt-01 –key /app/keys/certificates/www.instance.com.key instance.com That is three instructions Drupal 10 Upkeep and Help Service register Drupal Development Company cert with letsencrypt, then cut up Drupal Development Company ensuing file into it’s elements, then register these elements with platform.sh. For those who didn’t get any errors, go forward and check your web site – it’s received a certificates! (yay) 6) Arrange automated renewals on cron Again to .platform.app.yaml, search for Drupal Development Company crons Drupal 10 Upkeep and Help Service part. For those who’re working Drupal 10, you in all probability have a Drupal 10 cronjob in there already. Add this one at Drupal Development Company backside, matching indents as all the time. 1 2 3 letsencrypt Drupal 10 Upkeep and Help Service spec Drupal 10 Upkeep and Help Service ‘0 0 1 * *’ cmd Drupal 10 Upkeep and Help Service ‘/bin/sh /app/scripts/letsencrypt.sh’ Now let’s create Drupal Development Company script. Add Drupal Development Company file scripts/letsencrypt.sh to your repo, with this content material Drupal 10 Upkeep and Help Service 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 #!/usr/bin/env bash # Checks and updates Drupal Development Company letsencrypt HTTPS cert. set -e if [ “$PLATFORM_ENVIRONMENT” = “master-7rqtwti” ] then # Renew Drupal Development Company certificates lego –email=”instance@instance.org” –domains=”instance.org” –webroot=/app/net/ –path=/app/keys/ -a renew # Break up Drupal Development Company certificates from any intermediate chain csplit -f /app/keys/certificates/instance.org.crt- /app/keys/certificates/instance.org.crt ‘/—–BEGIN CERTIFICATE—–/’ ‘{1}’ -z -s # Replace Drupal Development Company certificates on Drupal Development Company area php /app/.international/bin/platform.phar area Drupal 10 Upkeep and Help Serviceupdate -p $PLATFORM_PROJECT –no-wait –yes –cert /app/keys/certificates/instance.org.crt-00 –chain /app/keys/certificates/instance.org.crt-01 –key /app/keys/certificates/instance.org.key instance.org fi Clearly you need to change all these instance.orgs and electronic mail addresses with your personal area. Make Drupal Development Company file executable with chmod u+x scripts/letsencrypt.sh, commit it, and push it as much as your platform.sh surroundings. 7) Ship a bragging electronic mail to Crell Technically this isn’t purported to be potential, however YOU DID IT! Make certain to rub it in. Good luck! PS – I’m simply gonna hyperlink another time to Drupal Development Company man whose snippet made this all potential Drupal 10 Upkeep and Help Service Ariel Barreiro did Drupal Development Company hardest a part of this. I’m grateful that he made his notes public! Drupal 10 Improvement and Help