`ACME "directory"` not working when in `RootJail` about pound

[graygnuorg]

Please apply this patch as well: 62f59fe

[graygnuorg]

Yes, it's OK. Service directives (and ACME is a special case of Service) are processed in the order in which they are defined in the configuration file. So, in your config, the requests destined for someotherhost.example.com will be proxied to 192.168.1.22:80. One minor point, though: instead of
HeadRequire I'd suggest using Host, like that:

Host "someotherhost.example.com"

[graygnuorg]

Nice idea. I've enabled it. I'm closing this issue then.

[graygnuorg]

Thanks for reporting that. The problem is that pound tries to open the acme directory too late (after chrooting), and then it is already not visible. I fixed this in commit c2fb6ae. Please pull and give it a try.

[nagyrobi]

Downloaded the repo, unzipped in a separate directory, followed the steps from the readme but getting an error with make:

root@bsd123:~/pound-4.6-dev # make
make  all-recursive
Making all in src
make  all-am
cc -DHAVE_CONFIG_H -I. -I..  -DSYSCONFDIR=\"/usr/local/etc\" -DLOCALSTATEDIR=\"/usr/local/var\" -DPKGDATADIR=\"/usr/local/share/pound\"  -g -O2 -pthread -g -O2 -MT poundctl.o -MD -MP -MF .deps/poundctl.Tpo -c -o poundctl.o poundctl.c
mv -f .deps/poundctl.Tpo .deps/poundctl.Po
make[3]: don't know how to make ./libpound.a. Stop

make[3]: stopped in /root/pound-4.6-dev/src
*** Error code 2
*** Error code 1
*** Error code 1

Didn't experience this with the release (4.6).
All defaults, no special stuff with .configure.

[nagyrobi]

Success!

[nagyrobi]

A question related to ACME: is the order of the objects defined in the configuration taken into account during operation?
I mean, is the config processed like most firewalls do, like from top to bottom first match applies?

Because, in my case, I have an ACME configuration running on the same machine with pound, however, I also have a few machines which are handling their own ACME certificate renewal procedures, their encryption stuff is not handled by pound (certs are used for some other kind of communication on different ports). But they still need to be reachable directly by Let's Encrypt on HTTP port 80 for the challenge, which is occupied by pound.

So for these, I'd just set up simple ListenHTTP service backends without redirect to HTTPS, and pound shouldn't intercept .well-known/acme-challenge for them.

If you look at the config above, that was my attempt. someotherhost.example.com would be matched by a service before the ACME directive, which wouldn't process it.

Do you think that's fine like that?
Or maybe ACME should accept a list witch services to skip?

[nagyrobi]

Thank you. Meanwhile I've found in the doc: Services are tried in the same order as they are defined in configuration. It would be very nice if this feature would remain in the future.

instead of HeadRequire I'd suggest using Host

Thanks, I've changed all my services to the new syntax.

[graygnuorg]

Sure, it will remain so.

[nagyrobi]

Just a tip: maybe you'd like to enable Discussions function for this repo so we don't spam your issues with Q&A.