services: Add nftables-service-type.

[jackhill/guix/guix.git] / gnu / services / certbot.scm

diff --git a/gnu/services/certbot.scm b/gnu/services/certbot.scm
index a70a365..0d3be03 100644 (file)
--- a/gnu/services/certbot.scm
+++ b/gnu/services/certbot.scm
@@ -1,7 +1,8 @@
 ;;; GNU Guix --- Functional package management for GNU
-;;; Copyright © 2016 ng0 <ng0@we.make.ritual.n0.is>
+;;; Copyright © 2016 ng0 <ng0@n0.is>
 ;;; Copyright © 2016 Sou Bunnbu <iyzsong@member.fsf.org>
 ;;; Copyright © 2017, 2018 Clément Lassieur <clement@lassieur.org>
+;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -26,6 +27,7 @@
   #:use-module (gnu services web)
   #:use-module (gnu system shadow)
   #:use-module (gnu packages tls)
+  #:use-module (guix i18n)
   #:use-module (guix records)
   #:use-module (guix gexp)
   #:use-module (srfi srfi-1)
@@ -48,7 +50,15 @@
   (name                certificate-configuration-name
                        (default #f))
   (domains             certificate-configuration-domains
-                       (default '())))
+                       (default '()))
+  (challenge           certificate-configuration-challenge
+                       (default #f))
+  (authentication-hook certificate-authentication-hook
+                       (default #f))
+  (cleanup-hook        certificate-cleanup-hook
+                       (default #f))
+  (deploy-hook         certificate-configuration-deploy-hook
+                       (default #f)))
 
 (define-record-type* <certbot-configuration>
   certbot-configuration make-certbot-configuration
@@ -60,6 +70,8 @@
   (certificates        certbot-configuration-certificates
                        (default '()))
   (email               certbot-configuration-email)
+  (rsa-key-size        certbot-configuration-rsa-key-size
+                       (default #f))
   (default-location    certbot-configuration-default-location
                        (default
                          (nginx-location-configuration
@@ -70,25 +82,52 @@
 (define certbot-command
   (match-lambda
     (($ <certbot-configuration> package webroot certificates email
-                                default-location)
+                                rsa-key-size default-location)
      (let* ((certbot (file-append package "/bin/certbot"))
+            (rsa-key-size (and rsa-key-size (number->string rsa-key-size)))
             (commands
              (map
               (match-lambda
-                (($ <certificate-configuration> name domains)
-                 (list certbot "certonly" "-n" "--agree-tos"
-                       "-m" email
-                       "--webroot" "-w" webroot
-                       "--cert-name" (or name (car domains))
-                       "-d" (string-join domains ","))))
+                (($ <certificate-configuration> custom-name domains challenge
+                                                authentication-hook cleanup-hook
+                                                deploy-hook)
+                 (let ((name (or custom-name (car domains))))
+                   (if challenge
+                     (append
+                      (list name certbot "certonly" "-n" "--agree-tos"
+                            "-m" email
+                            "--manual"
+                            (string-append "--preferred-challenges=" challenge)
+                            "--cert-name" name
+                            "--manual-public-ip-logging-ok"
+                            "-d" (string-join domains ","))
+                      (if rsa-key-size `("--rsa-key-size" ,rsa-key-size) '())
+                      (if authentication-hook
+                          `("--manual-auth-hook" ,authentication-hook)
+                          '())
+                      (if cleanup-hook `("--manual-cleanup-hook" ,cleanup-hook) '())
+                      (if deploy-hook `("--deploy-hook" ,deploy-hook) '()))
+                     (append
+                      (list name certbot "certonly" "-n" "--agree-tos"
+                            "-m" email
+                            "--webroot" "-w" webroot
+                            "--cert-name" name
+                            "-d" (string-join domains ","))
+                      (if rsa-key-size `("--rsa-key-size" ,rsa-key-size) '())
+                      (if deploy-hook `("--deploy-hook" ,deploy-hook) '()))))))
               certificates)))
        (program-file
         "certbot-command"
-        #~(let ((code 0))
-            (for-each
-             (lambda (command)
-               (set! code (or (apply system* command) code)))
-             '#$commands) code))))))
+        #~(begin
+            (use-modules (ice-9 match))
+            (let ((code 0))
+              (for-each
+               (match-lambda
+                 ((name . command)
+                  (begin
+                    (format #t "Acquiring or renewing certificate: ~a~%" name)
+                    (set! code (or (apply system* command) code)))))
+               '#$commands) code)))))))
 
 (define (certbot-renewal-jobs config)
   (list
@@ -98,19 +137,24 @@
           #$(certbot-command config))))
 
 (define (certbot-activation config)
-  (match config
-    (($ <certbot-configuration> package webroot certificates email
-                                default-location)
-     (with-imported-modules '((guix build utils))
-       #~(begin
-           (use-modules (guix build utils))
-           (mkdir-p #$webroot)
-           (zero? (system* #$(certbot-command config))))))))
+  (let* ((certbot-directory "/var/lib/certbot")
+         (script (in-vicinity certbot-directory "renew-certificates"))
+         (message (format #f (G_ "~a may need to be run~%") script)))
+    (match config
+      (($ <certbot-configuration> package webroot certificates email
+                                  rsa-key-size default-location)
+       (with-imported-modules '((guix build utils))
+         #~(begin
+             (use-modules (guix build utils))
+             (mkdir-p #$webroot)
+             (mkdir-p #$certbot-directory)
+             (copy-file #$(certbot-command config) #$script)
+             (display #$message)))))))
 
 (define certbot-nginx-server-configurations
   (match-lambda
     (($ <certbot-configuration> package webroot certificates email
-                                default-location)
+                                rsa-key-size default-location)
      (list
       (nginx-server-configuration
        (listen '("80" "[::]:80"))