gnu/services/certbot.scm

   1 ;;; GNU Guix --- Functional package management for GNU
   2 ;;; Copyright © 2016 ng0 <ng0@we.make.ritual.n0.is>
   3 ;;; Copyright © 2016 Sou Bunnbu <iyzsong@member.fsf.org>
   4 ;;; Copyright © 2017, 2018 Clément Lassieur <clement@lassieur.org>
   5 ;;;
   6 ;;; This file is part of GNU Guix.
   7 ;;;
   8 ;;; GNU Guix is free software; you can redistribute it and/or modify it
   9 ;;; under the terms of the GNU General Public License as published by
  10 ;;; the Free Software Foundation; either version 3 of the License, or (at
  11 ;;; your option) any later version.
  12 ;;;
  13 ;;; GNU Guix is distributed in the hope that it will be useful, but
  14 ;;; WITHOUT ANY WARRANTY; without even the implied warranty of
  15 ;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16 ;;; GNU General Public License for more details.
  17 ;;;
  18 ;;; You should have received a copy of the GNU General Public License
  19 ;;; along with GNU Guix.  If not, see <http://www.gnu.org/licenses/>.
  20
  21 (define-module (gnu services certbot)
  22   #:use-module (gnu services)
  23   #:use-module (gnu services base)
  24   #:use-module (gnu services shepherd)
  25   #:use-module (gnu services mcron)
  26   #:use-module (gnu services web)
  27   #:use-module (gnu system shadow)
  28   #:use-module (gnu packages tls)
  29   #:use-module (guix records)
  30   #:use-module (guix gexp)
  31   #:use-module (srfi srfi-1)
  32   #:use-module (ice-9 match)
  33   #:export (certbot-service-type
  34             certbot-configuration
  35             certbot-configuration?
  36             certificate-configuration))
  37
  38 ;;; Commentary:
  39 ;;;
  40 ;;; Automatically obtaining TLS certificates from Let's Encrypt.
  41 ;;;
  42 ;;; Code:
  43
  44 \f
  45 (define-record-type* <certificate-configuration>
  46   certificate-configuration make-certificate-configuration
  47   certificate-configuration?
  48   (name                certificate-configuration-name
  49                        (default #f))
  50   (domains             certificate-configuration-domains
  51                        (default '()))
  52   (deploy-hook         certificate-configuration-deploy-hook
  53                        (default #f)))
  54
  55 (define-record-type* <certbot-configuration>
  56   certbot-configuration make-certbot-configuration
  57   certbot-configuration?
  58   (package             certbot-configuration-package
  59                        (default certbot))
  60   (webroot             certbot-configuration-webroot
  61                        (default "/var/www"))
  62   (certificates        certbot-configuration-certificates
  63                        (default '()))
  64   (email               certbot-configuration-email)
  65   (rsa-key-size        certbot-configuration-rsa-key-size
  66                        (default #f))
  67   (default-location    certbot-configuration-default-location
  68                        (default
  69                          (nginx-location-configuration
  70                           (uri "/")
  71                           (body
  72                            (list "return 301 https://$host$request_uri;"))))))
  73
  74 (define certbot-command
  75   (match-lambda
  76     (($ <certbot-configuration> package webroot certificates email
  77                                 rsa-key-size default-location)
  78      (let* ((certbot (file-append package "/bin/certbot"))
  79             (rsa-key-size (and rsa-key-size (number->string rsa-key-size)))
  80             (commands
  81              (map
  82               (match-lambda
  83                 (($ <certificate-configuration> custom-name domains
  84                                                 deploy-hook)
  85                  (let ((name (or custom-name (car domains))))
  86                    (append
  87                     (list name certbot "certonly" "-n" "--agree-tos"
  88                           "-m" email
  89                           "--webroot" "-w" webroot
  90                           "--cert-name" name
  91                           "-d" (string-join domains ","))
  92                     (if rsa-key-size `("--rsa-key-size" ,rsa-key-size) '())
  93                     (if deploy-hook `("--deploy-hook" ,deploy-hook) '())))))
  94               certificates)))
  95        (program-file
  96         "certbot-command"
  97         #~(begin
  98             (use-modules (ice-9 match))
  99             (let ((code 0))
 100               (for-each
 101                (match-lambda
 102                  ((name . command)
 103                   (begin
 104                     (format #t "Acquiring or renewing certificate: ~a~%" name)
 105                     (set! code (or (apply system* command) code)))))
 106                '#$commands) code)))))))
 107
 108 (define (certbot-renewal-jobs config)
 109   (list
 110    ;; Attempt to renew the certificates twice per day, at a random minute
 111    ;; within the hour.  See https://certbot.eff.org/all-instructions/.
 112    #~(job '(next-minute-from (next-hour '(0 12)) (list (random 60)))
 113           #$(certbot-command config))))
 114
 115 (define (certbot-activation config)
 116   (match config
 117     (($ <certbot-configuration> package webroot certificates email
 118                                 rsa-key-size default-location)
 119      (with-imported-modules '((guix build utils))
 120        #~(begin
 121            (use-modules (guix build utils))
 122            (mkdir-p #$webroot)
 123            (zero? (system* #$(certbot-command config))))))))
 124
 125 (define certbot-nginx-server-configurations
 126   (match-lambda
 127     (($ <certbot-configuration> package webroot certificates email
 128                                 rsa-key-size default-location)
 129      (list
 130       (nginx-server-configuration
 131        (listen '("80" "[::]:80"))
 132        (ssl-certificate #f)
 133        (ssl-certificate-key #f)
 134        (server-name
 135         (apply append (map certificate-configuration-domains certificates)))
 136        (locations
 137         (filter identity
 138                 (list
 139                  (nginx-location-configuration
 140                   (uri "/.well-known")
 141                   (body (list (list "root " webroot ";"))))
 142                  default-location))))))))
 143
 144 (define certbot-service-type
 145   (service-type (name 'certbot)
 146                 (extensions
 147                  (list (service-extension nginx-service-type
 148                                           certbot-nginx-server-configurations)
 149                        (service-extension activation-service-type
 150                                           certbot-activation)
 151                        (service-extension mcron-service-type
 152                                           certbot-renewal-jobs)))
 153                 (compose concatenate)
 154                 (extend (lambda (config additional-certificates)
 155                           (certbot-configuration
 156                            (inherit config)
 157                            (certificates
 158                             (append
 159                              (certbot-configuration-certificates config)
 160                              additional-certificates)))))
 161                 (description
 162                  "Automatically renew @url{https://letsencrypt.org, Let's
 163 Encrypt} HTTPS certificates by adjusting the nginx web server configuration
 164 and periodically invoking @command{certbot}.")))