enable-https

Put a real Let's Encrypt wildcard certificate on a bastion and make its nginx terminate TLS.

Syntax

rumi cloud aws enable-https \
  --profile <profile> \
  --network <network> \
  --key-pair <keypair> \
  --domain <domain> \
  [options]

Options

Option	Short	Description	Default
--profile	-p	AWS profile to use	Required
--region	-r	AWS region	us-east-1
--network	-n	Name of the network	Required
--key-pair	-k	The network key pair	Required
--name	-b	The bastion name to enable HTTPS on; omit for the single (unnamed) bastion	none
--domain	-d	The base domain to secure; the wildcard cert covers <domain> and *.<domain>	Required
--email	-m	Let's Encrypt account email for expiry notices	none (registered without an email)
--force	-f	Re-point a bastion already secured for a DIFFERENT domain; the shared cert is re-issued under <domain>, so any service already proxied under the old domain must be re-launched to re-proxy under the new one	false

Example

rumi cloud aws enable-https \
  --profile my-aws-profile \
  --network my-network \
  --key-pair my-keypair \
  --domain example.com \
  --email [e-mail]

Notes

This obtains a Let's Encrypt wildcard cert via DNS-01 / Route53 and makes the bastion's nginx terminate TLS.

Run it right after launch-bastion and BEFORE launching services, so each proxy is created as a TLS block.

A bastion secures exactly one domain. Re-running with the same domain is an idempotent renew; switching domains needs --force.

The bastion must carry an instance profile granting Route53 access, so launch it with -I.

See Also

• launch-bastion