stunnel TLS 1.3 In Front Of Plain-Text Services, Unprivileged

stunnel

stunnel from BaseOS: TLS in front of services that speak only plain text - TLS 1.3 only by default, a client certificate required where you ask for one, stunnel running as its own unprivileged user, and every configuration checked by starting a copy of it before it lands. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No download, and no version to pin. EL 10 packages stunnel, so the role installs it by name and takes what the distribution ships: a security update arrives through dnf, not through a new release of this role. What the role owns is the configuration and the proof that the service works.

The distribution's unit, our configuration. The role installs stunnel and openssl, writes /etc/stunnel/stunnel.conf (root:stunnel 0640) and enables the package's stunnel.service, which reads that file. Each tunnel in stunnel_services accepts TLS on its accept address and connects in plain text to its connect address; the example accepts on 127.0.0.1:8443, and the live test reads the listening sockets and expects loopback only.

Its own user, because the package makes none. stunnel runs as whoever starts it, and the package creates no account, so the stock service runs as root. The role makes a system user, stunnel, binds as root and then drops to it (setuid/setgid): the live test finds every stunnel process running as that user. The key is root:stunnel 0640, because stunnel reads it again as that user on a reload.

TLS 1.3 only, by default. A TLS 1.3 client reads the backend's page through the tunnel and a TLS 1.2 client is refused ("protocol version", measured); stunnel_tls12: true accepts TLS 1.2 for older clients. Give a service a client_ca and stunnel requires a client certificate issued by it: a client without one was refused with "certificate required" (measured in a probe; the live test runs the example service, which asks for none).

Checked by running it. stunnel has no test mode. The role's /usr/local/libexec/iacbazaar-stunnel-check starts a copy of the candidate in the foreground with every accept moved to a free loopback port, so nothing listening now is disturbed: a good file logs "Configuration successful" and is still running when the check stops it; an unknown option, an invalid protocol version or a certificate that cannot be loaded exits at once with the file, the line and the reason (measured). That is the template's validate.

A certificate is made if you bring none. Self-signed, P-256, 825 days, the common name from stunnel_tls_common_name. Point stunnel_tls_cert and stunnel_tls_key at your own and set stunnel_tls_generate: false.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.