;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2016 ng0 <ng0@we.make.ritual.n0.is>
+;;; Copyright © 2016 ng0 <ng0@n0.is>
;;; Copyright © 2016 Sou Bunnbu <iyzsong@member.fsf.org>
+;;; Copyright © 2017, 2018 Clément Lassieur <clement@lassieur.org>
+;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>
;;;
;;; This file is part of GNU Guix.
;;;
#:use-module (gnu services web)
#:use-module (gnu system shadow)
#:use-module (gnu packages tls)
+ #:use-module (guix i18n)
#:use-module (guix records)
#:use-module (guix gexp)
#:use-module (srfi srfi-1)
#:use-module (ice-9 match)
#:export (certbot-service-type
certbot-configuration
- certbot-configuration?))
+ certbot-configuration?
+ certificate-configuration))
;;; Commentary:
;;;
;;; Code:
\f
+(define-record-type* <certificate-configuration>
+ certificate-configuration make-certificate-configuration
+ certificate-configuration?
+ (name certificate-configuration-name
+ (default #f))
+ (domains certificate-configuration-domains
+ (default '()))
+ (challenge certificate-configuration-challenge
+ (default #f))
+ (authentication-hook certificate-authentication-hook
+ (default #f))
+ (cleanup-hook certificate-cleanup-hook
+ (default #f))
+ (deploy-hook certificate-configuration-deploy-hook
+ (default #f)))
+
(define-record-type* <certbot-configuration>
certbot-configuration make-certbot-configuration
certbot-configuration?
(default certbot))
(webroot certbot-configuration-webroot
(default "/var/www"))
- (hosts certbot-configuration-hosts
+ (certificates certbot-configuration-certificates
(default '()))
+ (email certbot-configuration-email)
+ (rsa-key-size certbot-configuration-rsa-key-size
+ (default #f))
(default-location certbot-configuration-default-location
(default
(nginx-location-configuration
(body
(list "return 301 https://$host$request_uri;"))))))
-(define certbot-renewal-jobs
+(define certbot-command
(match-lambda
- (($ <certbot-configuration> package webroot hosts default-location)
- (match hosts
- ;; Avoid pinging certbot if we have no hosts.
- (() '())
- (_
- (list
- ;; Attempt to renew the certificates twice a week.
- #~(job (lambda (now)
- (next-day-from (next-hour-from now '(3))
- '(2 5)))
- (string-append #$package "/bin/certbot renew"
- (string-concatenate
- (map (lambda (host)
- (string-append " -d " host))
- #$hosts))))))))))
+ (($ <certbot-configuration> package webroot certificates email
+ rsa-key-size default-location)
+ (let* ((certbot (file-append package "/bin/certbot"))
+ (rsa-key-size (and rsa-key-size (number->string rsa-key-size)))
+ (commands
+ (map
+ (match-lambda
+ (($ <certificate-configuration> custom-name domains challenge
+ authentication-hook cleanup-hook
+ deploy-hook)
+ (let ((name (or custom-name (car domains))))
+ (if challenge
+ (append
+ (list name certbot "certonly" "-n" "--agree-tos"
+ "-m" email
+ "--manual"
+ (string-append "--preferred-challenges=" challenge)
+ "--cert-name" name
+ "--manual-public-ip-logging-ok"
+ "-d" (string-join domains ","))
+ (if rsa-key-size `("--rsa-key-size" ,rsa-key-size) '())
+ (if authentication-hook
+ `("--manual-auth-hook" ,authentication-hook)
+ '())
+ (if cleanup-hook `("--manual-cleanup-hook" ,cleanup-hook) '())
+ (if deploy-hook `("--deploy-hook" ,deploy-hook) '()))
+ (append
+ (list name certbot "certonly" "-n" "--agree-tos"
+ "-m" email
+ "--webroot" "-w" webroot
+ "--cert-name" name
+ "-d" (string-join domains ","))
+ (if rsa-key-size `("--rsa-key-size" ,rsa-key-size) '())
+ (if deploy-hook `("--deploy-hook" ,deploy-hook) '()))))))
+ certificates)))
+ (program-file
+ "certbot-command"
+ #~(begin
+ (use-modules (ice-9 match))
+ (let ((code 0))
+ (for-each
+ (match-lambda
+ ((name . command)
+ (begin
+ (format #t "Acquiring or renewing certificate: ~a~%" name)
+ (set! code (or (apply system* command) code)))))
+ '#$commands) code)))))))
-(define certbot-activation
- (match-lambda
- (($ <certbot-configuration> package webroot hosts default-location)
- (with-imported-modules '((guix build utils))
- #~(begin
- (use-modules (guix build utils))
- (mkdir-p #$webroot)
- (for-each
- (lambda (host)
- (unless (file-exists? (in-vicinity "/etc/letsencrypt/live" host))
- (unless (zero? (system*
- (string-append #$certbot "/bin/certbot")
- "certonly" "--webroot" "-w" #$webroot
- "-d" host))
- (error "failed to acquire cert for host" host))))
- '#$hosts))))))
+(define (certbot-renewal-jobs config)
+ (list
+ ;; Attempt to renew the certificates twice per day, at a random minute
+ ;; within the hour. See https://certbot.eff.org/all-instructions/.
+ #~(job '(next-minute-from (next-hour '(0 12)) (list (random 60)))
+ #$(certbot-command config))))
+
+(define (certbot-activation config)
+ (let* ((certbot-directory "/var/lib/certbot")
+ (script (in-vicinity certbot-directory "renew-certificates"))
+ (message (format #f (G_ "~a may need to be run~%") script)))
+ (match config
+ (($ <certbot-configuration> package webroot certificates email
+ rsa-key-size default-location)
+ (with-imported-modules '((guix build utils))
+ #~(begin
+ (use-modules (guix build utils))
+ (mkdir-p #$webroot)
+ (mkdir-p #$certbot-directory)
+ (copy-file #$(certbot-command config) #$script)
+ (display #$message)))))))
(define certbot-nginx-server-configurations
(match-lambda
- (($ <certbot-configuration> package webroot hosts default-location)
- (map
- (lambda (host)
- (nginx-server-configuration
- (http-port 80)
- (https-port #f)
- (ssl-certificate #f)
- (ssl-certificate-key #f)
- (server-name (list host))
- (locations
- (filter identity
- (list
- (nginx-location-configuration
- (uri "/.well-known")
- (body (list (list "root " webroot ";"))))
- default-location)))))
- hosts))))
+ (($ <certbot-configuration> package webroot certificates email
+ rsa-key-size default-location)
+ (list
+ (nginx-server-configuration
+ (listen '("80" "[::]:80"))
+ (ssl-certificate #f)
+ (ssl-certificate-key #f)
+ (server-name
+ (apply append (map certificate-configuration-domains certificates)))
+ (locations
+ (filter identity
+ (list
+ (nginx-location-configuration
+ (uri "/.well-known")
+ (body (list (list "root " webroot ";"))))
+ default-location))))))))
(define certbot-service-type
(service-type (name 'certbot)
(service-extension mcron-service-type
certbot-renewal-jobs)))
(compose concatenate)
- (extend (lambda (config additional-hosts)
+ (extend (lambda (config additional-certificates)
(certbot-configuration
(inherit config)
- (hosts (append (certbot-configuration-hosts config)
- additional-hosts)))))))
+ (certificates
+ (append
+ (certbot-configuration-certificates config)
+ additional-certificates)))))
+ (description
+ "Automatically renew @url{https://letsencrypt.org, Let's
+Encrypt} HTTPS certificates by adjusting the nginx web server configuration
+and periodically invoking @command{certbot}.")))
HCoop / jackhill / guix / guix.git / blobdiff