Services on wporter.org

Regenerating HTTP certs in an Elasticsearch cluster

Mon, 23 Feb 2026 20:35:00 +0000

Docs. This requires the “minimum security setup” to be complete (Elasticsearch security must be running for SSL to be in use). The automatic initialization will do this for you.

By default, initializing an Elasticsearch cluster will automatically generate some certificates for the transport and HTTP components of the Elastic application:

[root@es9-1 elasticsearch]# ls -l certs
total 24
-rw-rw----. 1 root elasticsearch  1939 Dec 12 16:49 http_ca.crt
-rw-rw----. 1 root elasticsearch 10077 Dec 12 16:49 http.p12
-rw-rw----. 1 root elasticsearch  5838 Dec 12 16:49 transport.p12
[root@es9-1 elasticsearch]# pwd
/etc/elasticsearch

After changing a node’s IP (use DNS, gosh darn it!) or hostname, you may need to regenerate its HTTP certificates, or things will permanently cease to function (Elastic uses mTLS for authentication for the cluster’s transport layer and HTTP REST API - no REST API, Elastic is very unhappy).

Performing a partial or full restore of an Elasticsearch cluster from a snapshot

Mon, 23 Feb 2026 20:30:00 +0000

See the docs at elastic.co/docs.

I’m starting with a three-node cluster (see Deploying a three-node HA Elasticsearch 9 cluster on AlmaLinux 9). It consists of:

3x KVM VM (4 vCPU, 16 GiB RAM, 128 GB of SSD)

es9-1
es9-2
es9-3

DNS is working.

I’ve loaded the Flights sample dataset to the cluster with Kibana just to have something to look at.

I’m adding:

1x KVM VM (2 vCPU, 4 GiB RAM, 128 GB of SSD), for a snapshot repository (NFS server):

Building out a test 3-node Elasticsearch 9 cluster on AlmaLinux 9

Mon, 23 Feb 2026 20:00:00 +0000

Intro

We’ll be configuring a (test) three-node Elasticsearch cluster, then installing and joining Kibana, on Alma 9 hosts.

Hardware:

3x KVM VM (4 vCPU, 16 GiB RAM, 128 GB of SSD):

es9-1
es9-2
es9-3

Installing Elasticsearch

Read the docs: installing Elasticsearch, installing Elasticsearch with RPM.

Add the Elastic signing key to your system:

sudo rpm --import https://artifacts.elastic.co/GPG-KEY-elasticsearch

Add the Elasticsearch 9.x repository to the system:

sudo tee /etc/yum.repos.d/elasticsearch.repo > /dev/null << 'EOT'
[elasticsearch]
name=Elasticsearch repository for 9.x packages
baseurl=https://artifacts.elastic.co/packages/9.x/yum
gpgcheck=1
gpgkey=https://artifacts.elastic.co/GPG-KEY-elasticsearch
enabled=0
type=rpm-md
EOT

Note that the repo’s enabled property is set to 0 so you don’t inadvertantly update Elastic.

Setting up Cockpit with Certbot and a private CA with an ACME endpoint

Wed, 09 Jul 2025 21:35:00 +0000

This is an excerpt from my step-ca post that I felt is useful enough to have its own post.

I have a server running Cockpit that I’d like to use a valid SSL certificate from my CA. I’d like it to renew its own certificate. Let’s do that.

First, be sure to install the root certificate on the system. Since this is a machine running AlmaLinux 10, that looks something like this:

Installing Wiki.js (PostgreSQL, NGINX) on AlmaLinux 10

Mon, 30 Jun 2025 19:35:00 +0000

This guide demonstrates installing Wiki.js, the NGINX reverse proxy, Certbot (an ACME client that we’ll use for automated SSL certificate renewal), a backing PostgreSQL database, and a supporting Elasticsearch container on an AlmaLinux 10 server.

Wiki.js is a Node.js application that relies on a database - we’ll be using PostgreSQL.

We’ll put a NGINX reverse proxy in front of the Wiki.js web application to handle SSL, and configure Wiki.js to listen on only localhost (127.0.0.1:3000) so that only NGINX is exposed to the outside world.