meshkee-app/dashboards
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix per-tenant dashboard SSL map to use SNI and readable certs.

Browse Source 
Nginx must key the cert map on $ssl_server_name during handshake, and www-data needs ssl-cert group access to Let's Encrypt files when certificates are loaded via variables.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Alireza Hassani
2026-08-26 08:49:43 +03:30
co-authored by Cursor
parent b7bce38131
commit a52f963f52
2 changed files with 27 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/meshkee-dashboard-certs-map.conf
+7 -2
View File
@@ -1,9 +1,14 @@
# Per-tenant dashboard cert paths (default → shared meshkee-dashboards cert).
# Must key on $ssl_server_name (SNI). $host is empty during the TLS handshake,
# so a $host map always falls through to default.
# Tenant rows are appended by deploy/ssl-issue-tenant.sh when Issue SSL runs for one domain.
map $host $meshkee_dashboard_ssl_cert {
#
# Variable ssl_certificate is loaded by nginx workers (www-data), so
# /etc/letsencrypt/{live,archive} must be group-readable by ssl-cert (see ssl-issue-tenant.sh).
map $ssl_server_name $meshkee_dashboard_ssl_cert {
default /etc/letsencrypt/live/meshkee-dashboards/fullchain.pem;
}
map $host $meshkee_dashboard_ssl_key {
map $ssl_server_name $meshkee_dashboard_ssl_key {
default /etc/letsencrypt/live/meshkee-dashboards/privkey.pem;
}