gnu/services/certbot.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2016 ng0 <ng0@we.make.ritual.n0.is>
   3 ;;; Copyright © 2016 Sou Bunnbu <iyzsong@member.fsf.org>
   4 ;;;
   5 ;;; This file is part of GNU Guix.
   6 ;;;
   7 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   8 ;;; under the terms of the GNU General Public License as published by
   9 ;;; the Free Software Foundation; either version 3 of the License, or (at
  10 ;;; your option) any later version.
  11 ;;;
  12 ;;; GNU Guix is distributed in the hope that it will be useful, but
  13 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  14 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 ;;; GNU General Public License for more details.
  16 ;;;
  17 ;;; You should have received a copy of the GNU General Public License
  18 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  19
  20 (define-module (gnu services certbot)
  21   #:use-module (gnu services)
  22   #:use-module (gnu services base)
  23   #:use-module (gnu services shepherd)
  24   #:use-module (gnu services mcron)
  25   #:use-module (gnu services web)
  26   #:use-module (gnu system shadow)
  27   #:use-module (gnu packages tls)
  28   #:use-module (guix records)
  29   #:use-module (guix gexp)
  30   #:use-module (srfi srfi-1)
  31   #:use-module (ice-9 match)
  32   #:export (certbot-service-type
  33             certbot-configuration
  34             certbot-configuration?))
  35
  36 ;;; Commentary:
  37 ;;;
  38 ;;; Automatically obtaining TLS certificates from Let's Encrypt.
  39 ;;;
  40 ;;; Code:
  41
  42 \f
  43 (define-record-type* <certbot-configuration>
  44   certbot-configuration make-certbot-configuration
  45   certbot-configuration?
  46   (package             certbot-configuration-package
  47                        (default certbot))
  48   (webroot             certbot-configuration-webroot
  49                        (default "/var/www"))
  50   (hosts               certbot-configuration-hosts
  51                        (default '()))
  52   (default-location    certbot-configuration-default-location
  53                        (default
  54                          (nginx-location-configuration
  55                           (uri "/")
  56                           (body
  57                            (list "return 301 https://$host$request_uri;"))))))
  58
  59 (define certbot-renewal-jobs
  60   (match-lambda
  61     (($ <certbot-configuration> package webroot hosts default-location)
  62      (match hosts
  63        ;; Avoid pinging certbot if we have no hosts.
  64        (() '())
  65        (_
  66         (list
  67          ;; Attempt to renew the certificates twice a week.
  68          #~(job (lambda (now)
  69                   (next-day-from (next-hour-from now '(3))
  70                                  '(2 5)))
  71                 (string-append #$package "/bin/certbot renew"
  72                                (string-concatenate
  73                                 (map (lambda (host)
  74                                        (string-append " -d " host))
  75                                      #$hosts))))))))))
  76
  77 (define certbot-activation
  78   (match-lambda
  79     (($ <certbot-configuration> package webroot hosts default-location)
  80      (with-imported-modules '((guix build utils))
  81        #~(begin
  82            (use-modules (guix build utils))
  83            (mkdir-p #$webroot)
  84            (for-each
  85             (lambda (host)
  86               (unless (file-exists? (in-vicinity "/etc/letsencrypt/live" host))
  87                 (unless (zero? (system*
  88                                 (string-append #$certbot "/bin/certbot")
  89                                 "certonly" "--webroot" "-w" #$webroot
  90                                 "-d" host))
  91                   (error "failed to acquire cert for host" host))))
  92             '#$hosts))))))
  93
  94 (define certbot-nginx-server-configurations
  95   (match-lambda
  96     (($ <certbot-configuration> package webroot hosts default-location)
  97      (map
  98       (lambda (host)
  99         (nginx-server-configuration
 100          (http-port 80)
 101          (https-port #f)
 102          (ssl-certificate #f)
 103          (ssl-certificate-key #f)
 104          (server-name (list host))
 105          (locations
 106           (filter identity
 107                   (list
 108                    (nginx-location-configuration
 109                     (uri "/.well-known")
 110                     (body (list (list "root " webroot ";"))))
 111                    default-location)))))
 112       hosts))))
 113
 114 (define certbot-service-type
 115   (service-type (name 'certbot)
 116                 (extensions
 117                  (list (service-extension nginx-service-type
 118                                           certbot-nginx-server-configurations)
 119                        (service-extension activation-service-type
 120                                           certbot-activation)
 121                        (service-extension mcron-service-type
 122                                           certbot-renewal-jobs)))
 123                 (compose concatenate)
 124                 (extend (lambda (config additional-hosts)
 125                           (certbot-configuration
 126                            (inherit config)
 127                            (hosts (append (certbot-configuration-hosts config)
 128                                           additional-hosts)))))
 129                 (default-value (certbot-configuration))
 130                 (description
 131                  "Automatically renew @url{https://letsencrypt.org, Let's
 132 Encrypt} HTTPS certificates by adjusting the nginx web server configuration
 133 and periodically invoking @command{certbot}.")))