----------------------------------------

	----------------------------------------
	gophernicus TLS howto
	January 20th, 2019
	----------------------------------------

	A few people on mastodon requested a little guide on how to set up
	stunnel4 with gophernicus to offer TLS. As you might know from my
	earlier posts on gopher.black, I prefer to run this gopher server
	as a tor service instead of using the TLS approach alone since it
	does all the same things plus some extra goodies and doesn't
	require modification to your gopher clients. Regardless, gopher
	over TLS is cool in its own right (and I use it on cosmic.voyage).

	Here's how:

	1) Make sure you're using gophernicus and it's Kim's Prison
	Edition, not one of the ancient ones that shows up when you
	google gophernicus, like prologic's

	2) Have an SSL cert. I use letsencrypt because why pay for
	something that's free?

	3) Have stunnel4. I think it was an apt install for me.

	Actually configuring everything is just a matter of tweaking
	2 files:

	1) /etc/default/gophernicus

	OPTIONS="-o UTF-8 -nt -nh -nf -T 7070"

	The important part for TLS is the last bit (-T PORT). The other
	switches hide the /stats page which is a security issue, and get
	rid of titles and footer and stuff, which make for a cleaner
	rendered gophermap. They're cool settings, but not necessary for
	TLS.

	2) /etc/stunnel/gophernicus.conf

	;
	; Gophernicus behind Stunnel4 for gopher over TLS
	;

	; User/group for stunnel daemon
	setuid = stunnel4
	setgid = stunnel4

	; PID file location
	pid = /var/run/stunnel4/gophernicus.pid

	; Log to file, not syslog
	output = /var/log/stunnel4/gophernicus.log
	syslog = no

	; Certificate in pem format is needed for TLS
	cert = /etc/letsencrypt/live/cosmic.voyage/fullchain.pem
	key = /etc/letsencrypt/live/cosmic.voyage/privkey.pem

	; Enable TCP wrappers
	libwrap = yes
	service = in.gophernicus-tls

	; Gopher over TLS service
	[gophernicus]
	accept = :::7070
	connect = 127.0.0.1:70
	protocol = proxy


	So I'm pointing at my letsencrypt cert for cosmic in this file,
	and I've chosen to use port 7070 for TLS. Kensanata says there's
	an argument for port 7443 that was given on the gopher mailing
	list, but I never read it. Use what makes sense to you, but make
	sure it matches what you have in /etc/default/gophernicus.

	And that's it. Oh, I guess you'll need to open up your port with
	your firewall, but everything else should just work(TM).

	Good luck!