{"action":"closed","issue":{"url":"https://api.github.com/repos/AzuraCast/AzuraCast/issues/358","repository_url":"https://api.github.com/repos/AzuraCast/AzuraCast","labels_url":"https://api.github.com/repos/AzuraCast/AzuraCast/issues/358/labels{/name}","comments_url":"https://api.github.com/repos/AzuraCast/AzuraCast/issues/358/comments","events_url":"https://api.github.com/repos/AzuraCast/AzuraCast/issues/358/events","html_url":"https://github.com/AzuraCast/AzuraCast/issues/358","id":284489943,"number":358,"title":"Enable icecast-kh encryption","user":{"login":"amavarick","id":20918832,"avatar_url":"https://avatars2.githubusercontent.com/u/20918832?v=4","gravatar_id":"","url":"https://api.github.com/users/amavarick","html_url":"https://github.com/amavarick","followers_url":"https://api.github.com/users/amavarick/followers","following_url":"https://api.github.com/users/amavarick/following{/other_user}","gists_url":"https://api.github.com/users/amavarick/gists{/gist_id}","starred_url":"https://api.github.com/users/amavarick/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/amavarick/subscriptions","organizations_url":"https://api.github.com/users/amavarick/orgs","repos_url":"https://api.github.com/users/amavarick/repos","events_url":"https://api.github.com/users/amavarick/events{/privacy}","received_events_url":"https://api.github.com/users/amavarick/received_events","type":"User","site_admin":false},"labels":[{"id":366793376,"url":"https://api.github.com/repos/AzuraCast/AzuraCast/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2017-12-26T04:03:26Z","updated_at":"2018-02-04T13:04:42Z","closed_at":"2018-02-04T13:04:42Z","author_association":"NONE","body":"@SlvrEagle23 \r\n\r\nFeels like I've been submitting alot of tickets lately and have been really self conscious about it.  Trying to be respectful of your workload, sending as many coffees as I can and am so excited about being able to contribute.  I really do try to do my work before just submitting a feature request or bug to properly show the issue/recommendation and think through the process of implementation.  If I knew more, I'd create the pull requests too.  I'm learning though and trying to be helpful.\r\n\r\nI ask you to re-evaluate enabling icecast-kh encryption with Azuracast.  icecast-kh has made some drastic improvements to their encryption capability in the last several months.  All dependencies are already installed with AzuraCast docker and it only needs some minor config file updates.  I tested on docker with my implementation and it works great.  Your actual implementation would be smoother as Docker is a weakness of mine at this time.  Either way, its really easy!!!\r\n\r\n**Improvements to icecast-kh**\r\nhttps://karlheyes.github.io/\r\n8/5/2017\r\n--autodetect SSL connections on incoming sockets. No need for <ssl> in listen-socket now but is still there for compatability.  _(THIS IS BIG!!!  We no longer need to use different ports for encrypted and unencrypted dramatically reducing complexity)_\r\n--add ssl-private-key in paths to allow for combined PEM or for separate SSL key/certificate files.  _(THIS IS BIG TOO!  No longer need a separate process after updating let's encrypt to combine your fullchain and private cert into one pem file for icecast to read it!)_\r\n--select https/http URL in autogenerated m3u based on incoming request.\r\n\r\n**How to implement on docker**:\r\n1.  Map Let's Encrypt certificate location for icecast-kh (docker-compose.yml?)\r\n2.  Reference your live (letsencrypt or nginx) fullchain and private pem files in your icecast.xml files using mapped location.  Recommend making this a default for all radios that use icecast-kh with let's Encrypt?\r\n3.  Restart appropriate icecast-kh service to activate icecast.xml config.\r\n4.  Update your Let's Encrypt update process to restart icecast-kh services each time you update certificates.  (Based on a trouble ticket, it appears icecast-kh doesn't need service restart to refresh certificates) https://github.com/karlheyes/icecast-kh/issues/162  (May need some testing though as I don't know if responder to that ticket is the author)\r\n\r\n\r\n**How I implemented on docker because of my lack of docker config knowledge to implement steps above**:\r\n1.  I copied my live fullchain.pem and private.pem files from /var/lib/docker/volumes/azuracast_nginx_letsencrypt_certs/_data/live/myradiodomain.tld/\r\nto\r\n/var/lib/docker/volumes/azuracast_station_data/_data/myradio/config/\r\n\r\n2.  I chown user:group to match the other config files in the config directory\r\n\r\n3.  I updated the icecast.xml file:\r\n/var/lib/docker/volumes/azuracast_station_data/_data/myradio/config/icecast.xml\r\nAdding the following in the paths section:\r\n```\r\n<ssl-private-key>/var/azuracast/stations/myradio/config/privkey.pem</ssl-private-key>\r\n<ssl-certificate>/var/azuracast/stations/myradio/config/fullchain.pem</ssl-certificate>\r\n```\r\nYou can also define the ciphers, otherwise don't include to take application defaults:\r\n`\t<ssl-allowed-ciphers>ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:RSA+AESGCM:RSA+AES:!aNULL:!MD5:!DSS</ssl-allowed-ciphers>`\r\n\r\n4.  I restarted icecast-kh service\r\n\r\nSince icecast-kh allows both http and https off of the same port, no need to update liquidsoap... it will still connect to icecast as it was originally defined.  However, a user can now connect to the stream (same port) either encrypted or unencrypted.  What a Christmas present!!!\r\n\r\nFor anyone using my steps, a docker update will erase your changes to icecast.xml but the certificates if copied to the config folder will remain.  Also if you update certificates, it will not automatically update the certificates copied to your config folder.\r\n\r\nHere is log file showing successful implementation.  I was also able to browse to the icecast page using both http and https as well as connect to the m3u radio location using both http and https. /var/lib/docker/volumes/azuracast_station_data/_data/myradio/config/icecast_error.log\r\n\r\n```\r\n[2017-12-25  18:24:36] INFO connection/get_ssl_certificate SSL certificate found at /var/azuracast/stations/myradio/config/fullchain.pem\r\n[2017-12-25  18:24:36] INFO connection/get_ssl_certificate SSL private key found at /var/azuracast/stations/myradio/config/privkey.pem\r\n[2017-12-25  18:24:36] INFO connection/get_ssl_certificate SSL using ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA\r\n[2017-12-25  18:24:36] INFO connection/connection_setup_sockets 1 listener socket(s) for port 8030\r\n[2017-12-25  18:24:36] INFO connection/connection_setup_sockets 1 listening sockets setup complete\r\n```"}}
{"actor":{"display_login":"SlvrEagle23"}}