Add binding for acme-io.json in Traefik config

docker-compose.prod.yml

@@ -5,6 +5,7 @@ services:
       - ./services/traefik/traefik.prod.yml:/etc/traefik/traefik.yml:ro
       - ./services/traefik/dynamic.yml:/etc/traefik/dynamic.yml:ro
       - ./services/traefik/acme.json:/acme.json
+      - ./services/traefik/acme-io.json:/acme-io.json
     ports:
       - "80:80"
       - "443:443"

services/nginx/app/routes/authRoute.php

@@ -648,6 +648,14 @@ class authRoute
             $dataToVerify = $rawAuthenticatorData . $clientDataHash;
             $publicKey = $passkey_data['public_key'];
 
+            // If the public key is not in PEM format, assume it's base64url encoded DER
+            if (strpos($publicKey, '-----BEGIN PUBLIC KEY-----') === false) {
+                $rawPublicKey = $decode($publicKey);
+                $publicKey = "-----BEGIN PUBLIC KEY-----\n" .
+                    chunk_split(base64_encode($rawPublicKey), 64, "\n") .
+                    "-----END PUBLIC KEY-----";
+            }
+
             // WebAuthn signatures are DER encoded, which openssl_verify accepts.
             $algo = OPENSSL_ALGO_SHA256;
             $verifyResult = openssl_verify($dataToVerify, $rawSignature, $publicKey, $algo);

services/traefik/acme-io.json

@@ -0,0 +1 @@
+{}

services/traefik/dynamic.yml

@@ -24,6 +24,8 @@ http:
       priority: 1000
       tls:
         certResolver: le
+        domains:
+          - main: api.truckwash.dk
 
     api-preflight-io:
       rule: Host(`api.truckwash.io`) && Method(`OPTIONS`)
@@ -33,6 +35,8 @@ http:
       priority: 1000
       tls:
         certResolver: le
+        domains:
+          - main: api.truckwash.io
 
     cloud-preflight:
       rule: Host(`cloud.truckwash.dk`) && Method(`OPTIONS`)

services/traefik/traefik.prod.yml

@@ -24,5 +24,9 @@ certificatesResolvers:
     acme:
       email: jb@truckwash.dk
       storage: /acme.json
-      httpChallenge:
-        entryPoint: web
+      tlsChallenge: {}
+  le_io:
+    acme:
+      email: jb@truckwash.dk
+      storage: /acme-io.json
+      tlsChallenge: {}

services/traefik/traefik.yml

@@ -42,8 +42,9 @@ certificatesResolvers:
     acme:
       email: jb@truckwash.dk
       storage: /acme.json
-      httpChallenge:
-        entryPoint: web
-      # Using Let's Encrypt STAGING for local runs to avoid rate limits.
-      # Remove the following caServer line to switch to production.
-      caServer: https://acme-staging-v02.api.letsencrypt.org/directory
+      tlsChallenge: {}
+  le_io:
+    acme:
+      email: jb@truckwash.dk
+      storage: /acme-io.json
+      tlsChallenge: {}