mathstodon.xyz is one of the many independent Mastodon servers you can use to participate in the fediverse.
A Mastodon instance for maths people. We have LaTeX rendering in the web interface!

Server stats:

2.7K
active users

#letsencrypt

5 posts5 participants1 post today

How to Install #PeerTube on #Ubuntu VPS

This article provides an in-depth guide demonstrating how to install PeerTube on Ubuntu VPS.
What is PeerTube?
PeerTube is a decentralized, federated video hosting platform powered by WebTorrent and ActivityPub. It enables users to self-host video services and interact with other PeerTube ...
Continued 👉 blog.radwebhosting.com/how-to- #fediverse #opensource #installguide #vpsguide #selfhosting #letsencrypt #nodejs #videostreaming #decentralized #selfhosted

How to Install Centmin Mod on #AlmaLinux #VPS (5 Minute Quick-Start Guide) Here's a detailed step-by-step guide on how to install Centmin Mod on AlmaLinux VPS server.
What is Centmin Mod?
Centmin Mod is a shell-based, menu-driven installer that automates the deployment of a LEMP (Linux, Nginx, MariaDB/MySQL, PHP-FPM) stack on CentOS, AlmaLinux, and Rocky Linux servers. Designed for efficiency and performance, it ...
Continued 👉 blog.radwebhosting.com/how-to- #php #letsencrypt #csf #centminmod

How to Install Centmin Mod on AlmaLinux VPS
RadWeb, LLC · How To Install Centmin Mod On AlmaLinux VPS (5 Minute Quick-Start Guide) - VPS Hosting Blog | Dedicated Servers | Reseller HostingHere's a detailed step-by-step guide on how to install Centmin Mod on AlmaLinux VPS server.
Replied in thread

@litchipi

configuring nginx to auto-redirect from port 80 to 443 may be useful

if #nginx can automatically do #acme that'd be news to me, you might want to try #caddy for that

personally i use #nixos options to configure nginx and tls/ssl, which achieve this by creating a cert-renewing #systemd service that calls out to #letsencrypt. i assume that's sort of the canonical solution for not generating certs manually - even if you don't want to use nixos you may want to look into how they do it

Outdated #android TVs are such a (security) shit show, it's unbelievable.

I recently started self-hosting a streaming service on a domain using #letsencrypt and it did not work with my Android TV because it did not have the "new" letsencrypt roots or CAs in the trust store.

- I could not trust certs via UI because such does not exist
- I could not trust certs via adb because some intent does not work (thx Sony)
- I can't manually copy the cert somewhere
- I can't get root

1/2

Things are getting dangerous for #YunoHost!

Once I understood the logic behind the email addresses, I created five domains. After all of them were equipped with a #letsencrypt certificate, I created five accounts for the required #email addresses. The successful setup of the #cli mail program #aerc confirmed my thoughts. Joy... only briefly.

Now the websites should be back online. So I fed #FileZilla the new information. No connection. I could only access the #server with the administrator credentials, but not a public_html directory. So I checked via #ssh. There's no "Document_root" defined in #nginx, and under "sites-available" there is only "default" (without a document_root).

Why doesn't YunoHost create a corresponding data structure for the domains? Especially since there's no mention of it in the documentation. My blood pressure is rising 😤

Es wird gefährlich für #YunoHost!

Als ich die Logik mit den E-Mail-Adressen verstanden hatte, habe ich 5 Domänen angelegt. Nachdem alle mit einem #letsencrypt-Zertifikat ausgestattet waren, legte ich 5 Konten für die benötigten #Mail-Adressen an. Die erfolgreiche Einrichtung vom #cli Mailprogramm #aerc bestätigte meine Überlegungen. Freude … nur kurz.

Nun sollten die Webseiten wieder online gehen. Also #Filezilla mit den neuen Angaben gefüttert. Keine Verbindung. Nur mit den Daten des Administrators kam ich auf den #Server, jedoch nicht in ein public_html-Verzeichnis. Also per #ssh nachgesehen. In #nginx ist keine "Document_root" definiert und unter "sites-available" existiert nur "default" (ohne ein document-root).

Wieso legt YunoHost zu den Domänen keine zugehörige Datenstruktur an? Zumal in der Dokumentation kein Wort darüber zu finden ist. Mein Blutdruck steigt 😤

Ooh, what’s this?… Look Over There!
(With apologies to Jaida Essence Hall)

So the little app I teased earlier is ready and deployed and I have our own instance running at:

look-over-there.small-web.org

Look Over There! lets you forward multiple domains to different URLs with full HTTPS support.

Why?

We have a number of older sites that are becoming a chore/expensive to maintain and yet I don’t want to break the web. So I thought, hey, I’ll just use the “url forwarding” feature of my domain registrar to forward them to their archived versions on archive.org.

Ah, not so fast, young cricket… seems some domain registrars’ implementations of this feature do not work if the domain being forwarded is accessed via HTTPS (yes, in 2025).

So, given Kitten¹ uses Auto Encrypt² to automatically provision Let’s Encrypt certificates, I added a domain forwarding feature to it and created Look Over There! as a friendly/simple app that provides a visual interface to it.

To see it in action, hit cleanuptheweb.org and you should get forwarded to the archived version of it on archive.org. I’m going to be adding more of our sites to the list in the coming days as part of an effort to reduce my maintenance load and cut down our expenses at Small Technology Foundation.

Since it’s Small Web, this particular instance is just for us. However, you can run your own copy on a VPS (or even a little single-board computer at home, etc.) A link to the source code repository is on the site. Once Domain³ is ready for use (later this year 🤞), setting up your own instance of a Small Web app at your own server will take less than a minute.

I hope this little tool, along with the 404→307 (evergreen web) technique⁴, helps us to nurture an evergreen web and avoid link rot. (And the source code, as little as there is because Kitten does so much for you, is a good resource if you want to learn about Kitten’s new class-based component and page model which I haven’t yet had a chance to properly document.)

Enjoy!

:kitten:💕

¹ kitten.small-web.org
² codeberg.org/small-tech/auto-e
³ codeberg.org/domain/app
4042307.org

🔐⏰ La durée de validité des certificats SSL/TLS va être drastiquement réduite dans les années à venir :

- Actuellement, la durée maximale est de 398 jours
- À partir de mars 2026, elle passera à 200 jours
- À partir de mars 2027 : 100 jours
- À partir de mars 2029 : 47 jours

#SSL#TLS#Sysadmin

Out of habit, every time I've registered a new server with #LetsEncrypt, I've used a unique email address, which up until recently has neither been an advantage or a disadvantage. Sadly recently it's become a pretty major disadvantage, because every time LetsEncrypt send out another email announcing that they're stopping sending emails, I get fifty bloody copies of it :@

"When Let’s Encrypt, a free certificate authority, started issuing 90 day TLS certificates for websites, it was considered a bold move that helped push the ecosystem towards shorter certificate life times. Beforehand, certificate authorities normally issued certificate lifetimes lasting a year or more. With 4.0, Certbot is now supporting Let’s Encrypt’s new capability for six day certificates through ACME profiles and dynamic renewal at:

- 1/3rd of lifetime left
- 1/2 of lifetime left, if the lifetime is shorter than 10 days"

eff.org/deeplinks/2025/04/cert

Electronic Frontier Foundation · Certbot 4.0: Long Live Short-Lived Certs!When Let’s Encrypt, a free certificate authority, started issuing 90 day TLS certificates for websites, it was considered a bold move that helped push the ecosystem towards shorter certificate life times. Beforehand, certificate authorities normally issued certificate lifetimes lasting a year or...

Well, it certainly seems like #redhat has gone down the Embrace, Extend, Extinguish path with #freeipa.

Wanted to try to add a plugin to their docker image. Turns out in the process of building their docker image they break it entirely and have the setup.sh script fix it again so the only way to extend it would be to do something unholy with systemd or patch the setup.sh script in the dockerfile.

Fine, have it your way, I'll just install it on a raw Alma VM. Now, how do we get #letsencrypt working?

Oh, there's a howto. Cool.

Oh, it doesn't work.

Well, the howto references a script in a github repo. Maybe that'll work?

It gets farther, but it still errors out because apparently they're manually downloading the letsencrypt CAs and adding them to FreeIPA, rather than pulling them from the system ca store.

And aside from a github issue or two, all the documentation on this is hidden behind #redhat's paywall.

Swear to dog, I'm'a fire the next person who buys IBM.

I recently started to replace #nginx with @caddy and it's as satisfying as it is scary to replace a complex config that spans five included files and a total of about 400 lines with a single Caddyfile of around 80 lines.

And on top of that #Caddy also made certbot redundant as it takes care of fetching and renewing the tls certs from #LetsEncrypt and keeps a #ZeroSSL backup for all of my domains.

I think I'm in love..