The goal is to configure Synology NAS to use letsencrypt certificate without exposing it to the internet.
To achieve this we use certbot with DNS-01 challenge to Cloudflare.
-
Run install.sh to install pip and certbot. You may need to run this again after DSM upgrades.
-
Setup cloudflare secret.
# mkdir /volume1/system/.secrets
# touch /volume1/system/.secrets/cloudflare.ini