nixo
/
guix-devel
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

services: certbot: Associate one certificate with several domains. 

* doc/guix.texi (Certificate Services): Document <certificate-configuration>,
the change from domains to certificates and the fact that their path is now
derived from their name.
* gnu/services/certbot.scm (<certificate-configuration>): Add and export it.
(certbot-configuration, certbot-command, certbot-activation,
certbot-nginx-server-configurations, certbot-service-type): Replace 'domains'
with 'certificates'.
(certbot-nginx-server-configurations): Use only one nginx-server-configuration
and use all certificate domains as the server-name.
This commit is contained in:
Clément Lassieur 2018-02-10 17:20:22 +01:00
parent 65fc1d890d
commit c3215d2f9d
No known key found for this signature in database
GPG Key ID: 89F96D4808F359C7
2 changed files with 81 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
doc/guix.texi
View File

@ -15746,7 +15746,22 @@ can be found there:
@url{https://acme-v01.api.letsencrypt.org/directory}. @url{https://acme-v01.api.letsencrypt.org/directory}.
@defvr {Scheme Variable} certbot-service-type @defvr {Scheme Variable} certbot-service-type
A service type for the @code{certbot} Let's Encrypt client. A service type for the @code{certbot} Let's Encrypt client. Its value
must be a @code{certbot-configuration} record as in this example:
@example
(service certbot-service-type
(certbot-configuration
(email "foo@@example.net")
(certificates
(list
(certificate-configuration
(domains '("example.net" "www.example.net")))
(certificate-configuration
(domains '("bar.example.net")))))))
@end example
See below for details about @code{certbot-configuration}.
@end defvr @end defvr
@deftp {Data Type} certbot-configuration @deftp {Data Type} certbot-configuration
@ -15761,9 +15776,10 @@ The certbot package to use.
The directory from which to serve the Let's Encrypt challenge/response The directory from which to serve the Let's Encrypt challenge/response
files. files.
@item @code{domains} (default: @code{()}) @item @code{certificates} (default: @code{()})
A list of domains for which to generate certificates and request A list of @code{certificates-configuration}s for which to generate
signatures. certificates and request signatures. Each certificate has a @code{name}
and several @code{domains}.
@item @code{email} @item @code{email}
Mandatory email used for registration, recovery contact, and important Mandatory email used for registration, recovery contact, and important
@ -15791,12 +15807,28 @@ Pass @code{#f} to not issue a default location.
@end table @end table
@end deftp @end deftp
The public key and its signatures will be written to @deftp {Data Type} certificate-configuration
@code{/etc/letsencrypt/live/@var{domain}/fullchain.pem}, for each Data type representing the configuration of a certificate.
@var{domain} in the configuration. The private key is written to This type has the following parameters:
@code{/etc/letsencrypt/live/@var{domain}/privkey.pem}.
@table @asis
@item @code{name} (default: @i{see below})
This name is used by Certbot for housekeeping and in file paths; it
doesn't affect the content of the certificate itself. To see
certificate names, run @code{certbot certificates}.
Its default is the first provided domain.
@item @code{domains} (default: @code{()})
The first domain provided will be the subject CN of the certificate, and
all domains will be Subject Alternative Names on the certificate.
@end table
@end deftp
For each @code{certificate-configuration}, the certificate is saved to
@code{/etc/letsencrypt/live/@var{name}/fullchain.pem} and the key is
saved to @code{/etc/letsencrypt/live/@var{name}/privkey.pem}.
@node DNS Services @node DNS Services
@subsubsection DNS Services @subsubsection DNS Services
@cindex DNS (domain name system) @cindex DNS (domain name system)

71
gnu/services/certbot.scm
View File

@ -32,7 +32,8 @@
#:use-module (ice-9 match) #:use-module (ice-9 match)
#:export (certbot-service-type #:export (certbot-service-type
certbot-configuration certbot-configuration
certbot-configuration?)) certbot-configuration?
certificate-configuration))
;;; Commentary: ;;; Commentary:
;;; ;;;
@ -41,6 +42,14 @@
;;; Code: ;;; Code:
(define-record-type* <certificate-configuration>
certificate-configuration make-certificate-configuration
certificate-configuration?
(name certificate-configuration-name
(default #f))
(domains certificate-configuration-domains
(default '())))
(define-record-type* <certbot-configuration> (define-record-type* <certbot-configuration>
certbot-configuration make-certbot-configuration certbot-configuration make-certbot-configuration
certbot-configuration? certbot-configuration?
@ -48,7 +57,7 @@
(default certbot)) (default certbot))
(webroot certbot-configuration-webroot (webroot certbot-configuration-webroot
(default "/var/www")) (default "/var/www"))
(domains certbot-configuration-domains (certificates certbot-configuration-certificates
(default '())) (default '()))
(email certbot-configuration-email) (email certbot-configuration-email)
(default-location certbot-configuration-default-location (default-location certbot-configuration-default-location
@ -60,17 +69,19 @@
(define certbot-command (define certbot-command
(match-lambda (match-lambda
(($ <certbot-configuration> package webroot domains email (($ <certbot-configuration> package webroot certificates email
default-location) default-location)
(let* ((certbot (file-append package "/bin/certbot")) (let* ((certbot (file-append package "/bin/certbot"))
(commands (commands
(map (map
(lambda (domain) (match-lambda
(list certbot "certonly" "-n" "--agree-tos" (($ <certificate-configuration> name domains)
"-m" email (list certbot "certonly" "-n" "--agree-tos"
"--webroot" "-w" webroot "-m" email
"-d" domain)) "--webroot" "-w" webroot
domains))) "--cert-name" (or name (car domains))
"-d" (string-join domains ","))))
certificates)))
(program-file (program-file
"certbot-command" "certbot-command"
#~(let ((code 0)) #~(let ((code 0))
@ -88,7 +99,7 @@
(define (certbot-activation config) (define (certbot-activation config)
(match config (match config
(($ <certbot-configuration> package webroot domains email (($ <certbot-configuration> package webroot certificates email
default-location) default-location)
(with-imported-modules '((guix build utils)) (with-imported-modules '((guix build utils))
#~(begin #~(begin
@ -98,23 +109,22 @@
(define certbot-nginx-server-configurations (define certbot-nginx-server-configurations
(match-lambda (match-lambda
(($ <certbot-configuration> package webroot domains email (($ <certbot-configuration> package webroot certificates email
default-location) default-location)
(map (list
(lambda (domain) (nginx-server-configuration
(nginx-server-configuration (listen '("80" "[::]:80"))
(listen '("80" "[::]:80")) (ssl-certificate #f)
(ssl-certificate #f) (ssl-certificate-key #f)
(ssl-certificate-key #f) (server-name
(server-name (list domain)) (apply append (map certificate-configuration-domains certificates)))
(locations (locations
(filter identity (filter identity
(list (list
(nginx-location-configuration (nginx-location-configuration
(uri "/.well-known") (uri "/.well-known")
(body (list (list "root " webroot ";")))) (body (list (list "root " webroot ";"))))
default-location))))) default-location))))))))
domains))))
(define certbot-service-type (define certbot-service-type
(service-type (name 'certbot) (service-type (name 'certbot)
@ -126,12 +136,13 @@
(service-extension mcron-service-type (service-extension mcron-service-type
certbot-renewal-jobs))) certbot-renewal-jobs)))
(compose concatenate) (compose concatenate)
(extend (lambda (config additional-domains) (extend (lambda (config additional-certificates)
(certbot-configuration (certbot-configuration
(inherit config) (inherit config)
(domains (append (certificates
(certbot-configuration-domains config) (append
additional-domains))))) (certbot-configuration-certificates config)
additional-certificates)))))
(description (description
"Automatically renew @url{https://letsencrypt.org, Let's "Automatically renew @url{https://letsencrypt.org, Let's
Encrypt} HTTPS certificates by adjusting the nginx web server configuration Encrypt} HTTPS certificates by adjusting the nginx web server configuration