acme为IP地址获取证书并应用于PVE

merecat接管80端口并设置https跳转

apt install -y --no-install-recommends merecat
cat > /etc/merecat.conf <<'EOF'
server default {
    port = 80
    location "/.well-known/acme-challenge/**" {
        path = "acme/.well-known/acme-challenge/"
    }
    location "/.well-known/pki-validation/**" {
        path = "acme/.well-known/pki-validation/"
    }
    redirect "/**" {
        code = 301
        location = "https://$host$request_uri$args"
    }
}
EOF
systemctl edit --drop-in=limits.conf --stdin merecat.service <<'EOF'
[Service]
LimitNOFILE=4096
EOF
systemctl restart merecat
systemctl enable merecat
systemctl status merecat --no-pager

设置443转发,安装acme并签发证书

iptables -t nat -A PREROUTING -p tcp -d [宿主机内网/网卡IP] --dport 443 -j REDIRECT --to-port 8006
curl https://get.acme.sh | sh -s email=10001@qq.com
acme.sh --issue --server letsencrypt -d [YOURIP] -w /var/www/acme --certificate-profile shortlived --days 5
acme.sh --install-cert -d [YOURIP] --key-file /etc/pve/local/pveproxy-ssl.key --fullchain-file /etc/pve/local/pveproxy-ssl.pem --reloadcmd "systemctl restart pveproxy"

Q.E.D.