ACME improvements, WAF, DNS integrations, descriptive LB errors, Proxmox storage selection, Quick links, DNSMasq improvements, bug fixes

[runleveldev]

Replace Lego with Acme.sh

Do before updating the Nginx template.

curl -fsSL https://get.acme.sh | sh
/root/.acme.sh/acme.sh --upgrade --auto-upgrade
export CF_Token="...."
export CF_Account_ID="..."
/root/.acme.sh/acme.sh --register-account -m devops@mieweb.com
/root/.acme.sh/acme.sh --issue --dns dns_cf -d example.com -d *.example.com
/root/.acme.sh/acme.sh --install-cert -d example.com --fullchain-file /etc/ssl/certs/example.com.crt --key-file /etc/ssl/private/example.com.key --reloadcmd "nginx -s reload"

DNSMasq Improvements

DNSMasq config split into several files to minimize restarts. pull-config needs reinstalled and the monolithic dnsmasq config removed.

ModSecurity WAF

Installation to existing manager

rm /etc/apt/sources.list.d/nginx.list /usr/share/keyrings/nginx-archive-keyring.gpg /etc/apt/preferences.d/99nginx
apt-get update -qq
apt-get install --download-only --allow-downgrades -y \
  nginx=1.26.3-3+deb13u2 \
  libnginx-mod-stream \
  libnginx-mod-http-modsecurity
DEBIAN_FRONTEND=noninteractive apt-get install --allow-downgrades -o Dpkg::Options::="--force-confold" -y \
  nginx=1.26.3-3+deb13u2 \
  libnginx-mod-stream \
  libnginx-mod-http-modsecurity
sed -i '/^pid/a\\ninclude /etc/nginx/modules-enabled/*.conf;' /etc/nginx/nginx.conf
ln -sf /usr/share/nginx/modules-available/mod-stream.conf \
  /etc/nginx/modules-enabled/
systemctl start nginx

Images

Descriptive error pages

Container quick links

[cmyers-mieweb]

We will merge this on Monday to the new cluster

[Bobzemob]

LGTM