Fossil SCM
Replaced blockquote-formatted commands in ssl-server doc with indented code blocks for consistency with the other docs.
Commit
f19f5369f9a9418a036a45e4a6bbeb9fdfe61ff8210a6f532267dd77606ce704
Parent
9607f5b4e4d2db8…
1 file changed
+10
-20
+10
-20
| --- www/ssl-server.md | ||
| +++ www/ssl-server.md | ||
| @@ -30,13 +30,11 @@ | ||
| 30 | 30 | ## Usage |
| 31 | 31 | |
| 32 | 32 | To put any of the Fossil server commands into SSL/TLS mode, simply |
| 33 | 33 | add the "--cert" command-line option. |
| 34 | 34 | |
| 35 | -> ~~~ | |
| 36 | -fossil ui --cert unsafe-builtin | |
| 37 | -~~~ | |
| 35 | + fossil ui --cert unsafe-builtin | |
| 38 | 36 | |
| 39 | 37 | The --cert option is what tells Fossil to use TLS encryption. |
| 40 | 38 | Normally, the argument to --cert is the name of a file containing |
| 41 | 39 | the certificate (the "fullchain.pem" file) for the website. In this |
| 42 | 40 | example, the magic name "unsafe-builtin" is used, which causes Fossil |
| @@ -88,21 +86,19 @@ | ||
| 88 | 86 | Fossil wants to read certs and public keys in the |
| 89 | 87 | [PEM format](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail). |
| 90 | 88 | PEM is a pure ASCII text format. The private key consists of text |
| 91 | 89 | like this: |
| 92 | 90 | |
| 93 | -> | |
| 94 | -`-----BEGIN PRIVATE KEY-----` | |
| 95 | -*base-64 encoding of the private key* | |
| 96 | -`-----END PRIVATE KEY-----` | |
| 91 | + -----BEGIN PRIVATE KEY----- | |
| 92 | + *base-64 encoding of the private key* | |
| 93 | + -----END PRIVATE KEY----- | |
| 97 | 94 | |
| 98 | 95 | Similarly, a PEM-encoded cert will look like this: |
| 99 | 96 | |
| 100 | -> | |
| 101 | -`-----BEGIN CERTIFICATE-----` | |
| 102 | -*base-64 encoding of the certificate* | |
| 103 | -`-----END CERTIFICATE-----` | |
| 97 | + -----BEGIN CERTIFICATE----- | |
| 98 | + *base-64 encoding of the certificate* | |
| 99 | + -----END CERTIFICATE----- | |
| 104 | 100 | |
| 105 | 101 | In both formats, text outside of the delimiters is ignored. That means |
| 106 | 102 | that if you have a PEM-formatted private key and a separate PEM-formatted |
| 107 | 103 | certificate, you can concatenate the two into a single file and the |
| 108 | 104 | individual components will still be easily accessible. |
| @@ -109,13 +105,11 @@ | ||
| 109 | 105 | |
| 110 | 106 | If you have a single file that holds both your private key and your |
| 111 | 107 | cert, you can hand it off to the "[fossil server](/help?cmd=server)" |
| 112 | 108 | command using the --cert option. Like this: |
| 113 | 109 | |
| 114 | -> ~~~ | |
| 115 | -fossil server --port 443 --cert mycert.pem /home/www/myproject.fossil | |
| 116 | -~~~ | |
| 110 | + fossil server --port 443 --cert mycert.pem /home/www/myproject.fossil | |
| 117 | 111 | |
| 118 | 112 | The command above is sufficient to run a fully-encrypted web site for |
| 119 | 113 | the "myproject.fossil" Fossil repository. This command must be run as |
| 120 | 114 | root, since it wants to listen on TCP port 443, and only root processes are |
| 121 | 115 | allowed to do that. This is safe, however, since before reading any |
| @@ -126,13 +120,11 @@ | ||
| 126 | 120 | |
| 127 | 121 | If you do not want to combine your cert and private key into a single |
| 128 | 122 | big PEM file, you can keep them separate using the --pkey option to |
| 129 | 123 | Fossil. |
| 130 | 124 | |
| 131 | -> ~~~ | |
| 132 | -fossil server --port 443 --cert fullchain.pem --pkey privkey.pem /home/www/myproject.fossil | |
| 133 | -~~~ | |
| 125 | + fossil server --port 443 --cert fullchain.pem --pkey privkey.pem /home/www/myproject.fossil | |
| 134 | 126 | |
| 135 | 127 | ## The ACME Protocol |
| 136 | 128 | |
| 137 | 129 | The [ACME Protocol][2] is used to prove to a CA that you control a |
| 138 | 130 | website. CAs require proof that you control a domain before they |
| @@ -173,13 +165,11 @@ | ||
| 173 | 165 | should be in that top-level directory. |
| 174 | 166 | |
| 175 | 167 | Thus, to set up a project website, you should first run Fossil in ordinary |
| 176 | 168 | unencrypted HTTP mode like this: |
| 177 | 169 | |
| 178 | -> ~~~ | |
| 179 | -fossil server --port 80 --acme /home/www/myproject.fossil | |
| 180 | -~~~ | |
| 170 | + fossil server --port 80 --acme /home/www/myproject.fossil | |
| 181 | 171 | |
| 182 | 172 | Then you create your public/private key pair and run certbot, giving it |
| 183 | 173 | a --webroot of /home/www. Certbot will create the sub-directory |
| 184 | 174 | named "/home/www/.well-known" and put token files there, which the CA |
| 185 | 175 | will verify. Then certbot will store your new cert in a particular file. |
| 186 | 176 |
| --- www/ssl-server.md | |
| +++ www/ssl-server.md | |
| @@ -30,13 +30,11 @@ | |
| 30 | ## Usage |
| 31 | |
| 32 | To put any of the Fossil server commands into SSL/TLS mode, simply |
| 33 | add the "--cert" command-line option. |
| 34 | |
| 35 | > ~~~ |
| 36 | fossil ui --cert unsafe-builtin |
| 37 | ~~~ |
| 38 | |
| 39 | The --cert option is what tells Fossil to use TLS encryption. |
| 40 | Normally, the argument to --cert is the name of a file containing |
| 41 | the certificate (the "fullchain.pem" file) for the website. In this |
| 42 | example, the magic name "unsafe-builtin" is used, which causes Fossil |
| @@ -88,21 +86,19 @@ | |
| 88 | Fossil wants to read certs and public keys in the |
| 89 | [PEM format](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail). |
| 90 | PEM is a pure ASCII text format. The private key consists of text |
| 91 | like this: |
| 92 | |
| 93 | > |
| 94 | `-----BEGIN PRIVATE KEY-----` |
| 95 | *base-64 encoding of the private key* |
| 96 | `-----END PRIVATE KEY-----` |
| 97 | |
| 98 | Similarly, a PEM-encoded cert will look like this: |
| 99 | |
| 100 | > |
| 101 | `-----BEGIN CERTIFICATE-----` |
| 102 | *base-64 encoding of the certificate* |
| 103 | `-----END CERTIFICATE-----` |
| 104 | |
| 105 | In both formats, text outside of the delimiters is ignored. That means |
| 106 | that if you have a PEM-formatted private key and a separate PEM-formatted |
| 107 | certificate, you can concatenate the two into a single file and the |
| 108 | individual components will still be easily accessible. |
| @@ -109,13 +105,11 @@ | |
| 109 | |
| 110 | If you have a single file that holds both your private key and your |
| 111 | cert, you can hand it off to the "[fossil server](/help?cmd=server)" |
| 112 | command using the --cert option. Like this: |
| 113 | |
| 114 | > ~~~ |
| 115 | fossil server --port 443 --cert mycert.pem /home/www/myproject.fossil |
| 116 | ~~~ |
| 117 | |
| 118 | The command above is sufficient to run a fully-encrypted web site for |
| 119 | the "myproject.fossil" Fossil repository. This command must be run as |
| 120 | root, since it wants to listen on TCP port 443, and only root processes are |
| 121 | allowed to do that. This is safe, however, since before reading any |
| @@ -126,13 +120,11 @@ | |
| 126 | |
| 127 | If you do not want to combine your cert and private key into a single |
| 128 | big PEM file, you can keep them separate using the --pkey option to |
| 129 | Fossil. |
| 130 | |
| 131 | > ~~~ |
| 132 | fossil server --port 443 --cert fullchain.pem --pkey privkey.pem /home/www/myproject.fossil |
| 133 | ~~~ |
| 134 | |
| 135 | ## The ACME Protocol |
| 136 | |
| 137 | The [ACME Protocol][2] is used to prove to a CA that you control a |
| 138 | website. CAs require proof that you control a domain before they |
| @@ -173,13 +165,11 @@ | |
| 173 | should be in that top-level directory. |
| 174 | |
| 175 | Thus, to set up a project website, you should first run Fossil in ordinary |
| 176 | unencrypted HTTP mode like this: |
| 177 | |
| 178 | > ~~~ |
| 179 | fossil server --port 80 --acme /home/www/myproject.fossil |
| 180 | ~~~ |
| 181 | |
| 182 | Then you create your public/private key pair and run certbot, giving it |
| 183 | a --webroot of /home/www. Certbot will create the sub-directory |
| 184 | named "/home/www/.well-known" and put token files there, which the CA |
| 185 | will verify. Then certbot will store your new cert in a particular file. |
| 186 |
| --- www/ssl-server.md | |
| +++ www/ssl-server.md | |
| @@ -30,13 +30,11 @@ | |
| 30 | ## Usage |
| 31 | |
| 32 | To put any of the Fossil server commands into SSL/TLS mode, simply |
| 33 | add the "--cert" command-line option. |
| 34 | |
| 35 | fossil ui --cert unsafe-builtin |
| 36 | |
| 37 | The --cert option is what tells Fossil to use TLS encryption. |
| 38 | Normally, the argument to --cert is the name of a file containing |
| 39 | the certificate (the "fullchain.pem" file) for the website. In this |
| 40 | example, the magic name "unsafe-builtin" is used, which causes Fossil |
| @@ -88,21 +86,19 @@ | |
| 86 | Fossil wants to read certs and public keys in the |
| 87 | [PEM format](https://en.wikipedia.org/wiki/Privacy-Enhanced_Mail). |
| 88 | PEM is a pure ASCII text format. The private key consists of text |
| 89 | like this: |
| 90 | |
| 91 | -----BEGIN PRIVATE KEY----- |
| 92 | *base-64 encoding of the private key* |
| 93 | -----END PRIVATE KEY----- |
| 94 | |
| 95 | Similarly, a PEM-encoded cert will look like this: |
| 96 | |
| 97 | -----BEGIN CERTIFICATE----- |
| 98 | *base-64 encoding of the certificate* |
| 99 | -----END CERTIFICATE----- |
| 100 | |
| 101 | In both formats, text outside of the delimiters is ignored. That means |
| 102 | that if you have a PEM-formatted private key and a separate PEM-formatted |
| 103 | certificate, you can concatenate the two into a single file and the |
| 104 | individual components will still be easily accessible. |
| @@ -109,13 +105,11 @@ | |
| 105 | |
| 106 | If you have a single file that holds both your private key and your |
| 107 | cert, you can hand it off to the "[fossil server](/help?cmd=server)" |
| 108 | command using the --cert option. Like this: |
| 109 | |
| 110 | fossil server --port 443 --cert mycert.pem /home/www/myproject.fossil |
| 111 | |
| 112 | The command above is sufficient to run a fully-encrypted web site for |
| 113 | the "myproject.fossil" Fossil repository. This command must be run as |
| 114 | root, since it wants to listen on TCP port 443, and only root processes are |
| 115 | allowed to do that. This is safe, however, since before reading any |
| @@ -126,13 +120,11 @@ | |
| 120 | |
| 121 | If you do not want to combine your cert and private key into a single |
| 122 | big PEM file, you can keep them separate using the --pkey option to |
| 123 | Fossil. |
| 124 | |
| 125 | fossil server --port 443 --cert fullchain.pem --pkey privkey.pem /home/www/myproject.fossil |
| 126 | |
| 127 | ## The ACME Protocol |
| 128 | |
| 129 | The [ACME Protocol][2] is used to prove to a CA that you control a |
| 130 | website. CAs require proof that you control a domain before they |
| @@ -173,13 +165,11 @@ | |
| 165 | should be in that top-level directory. |
| 166 | |
| 167 | Thus, to set up a project website, you should first run Fossil in ordinary |
| 168 | unencrypted HTTP mode like this: |
| 169 | |
| 170 | fossil server --port 80 --acme /home/www/myproject.fossil |
| 171 | |
| 172 | Then you create your public/private key pair and run certbot, giving it |
| 173 | a --webroot of /home/www. Certbot will create the sub-directory |
| 174 | named "/home/www/.well-known" and put token files there, which the CA |
| 175 | will verify. Then certbot will store your new cert in a particular file. |
| 176 |