How to get nginx and letsencrypt working on the guix system

How to get nginx and letsencrypt working on the guix system

[Tobias Alexandra Platen]

I installed the guix system on a virtual machine, and changed the
config as documented in the guix manual under 12.9.19 Web Services:

(service certbot-service-type
                    (certbot-configuration
                        (email "tplaten@posteo.de")
                            (certificates (list (certificate-
configuration
                        (domains '("stream.isengaara.de")) (deploy-hook
%nginx-deploy-hook))))))
                 ;;; nginx testing
                 (service nginx-service-type 
                    (nginx-configuration
                      (server-blocks
                        (list (nginx-server-configuration
                          (server-name '("stream.isengaara.de"))
                            (root "/srv/http/stream.isengaara.de"))))))

Certbot needs running nginx to create a certificate, and nginx wont
start without a certificate. The documentation does not explain how
to solve this circular service dependency.

Re: How to get nginx and letsencrypt working on the guix system

[Julien Lepiller]

Usually, this is fixed by not uting ssl at first, let certbot generate certificates, and reconfigure with ssl.

Le 31 octobre 2023 19:23:32 GMT+01:00, Tobias Alexandra Platen <guix@platen-software.de> a écrit :
>I installed the guix system on a virtual machine, and changed the
>config as documented in the guix manual under 12.9.19 Web Services:
>
>(service certbot-service-type
>                    (certbot-configuration
>                        (email "tplaten@posteo.de")
>                            (certificates (list (certificate-
>configuration
>                        (domains '("stream.isengaara.de")) (deploy-hook
>%nginx-deploy-hook))))))
>                 ;;; nginx testing
>                 (service nginx-service-type 
>                    (nginx-configuration
>                      (server-blocks
>                        (list (nginx-server-configuration
>                          (server-name '("stream.isengaara.de"))
>                            (root "/srv/http/stream.isengaara.de"))))))
>
>Certbot needs running nginx to create a certificate, and nginx wont
>start without a certificate. The documentation does not explain how
>to solve this circular service dependency.
>

Re: How to get nginx and letsencrypt working on the guix system

[Tobias Alexandra Platen]

shepherd: Starting service nginx...
..........
Throw to key `%exception' with args `("#<&invoke-error program:
\"/gnu/store/8dgzjx9iirxqbwdcr9nfagjp0mn9g4qy-nginx-1.23.3/sbin/nginx\"
  arguments: (\"-c\" \"/gnu/store/ywl1y1p77sbcm4nf9nahn6q9cndw637f-
nginx.conf\" \"-p\" \"/var/run/nginx\") 
  exit-status: 1 term-signal: #f stop-signal: #f>")'.
  
The directory /var/run/guix does not exist, where is created? How can I
get nginx logs for the failed start?

Re: How to get nginx and letsencrypt working on the guix system

[Clément Lassieur]

On Tue, Oct 31 2023, Tobias Alexandra Platen wrote:

> I installed the guix system on a virtual machine, and changed the
> config as documented in the guix manual under 12.9.19 Web Services:
>
> (service certbot-service-type
>                     (certbot-configuration
>                         (email "tplaten@posteo.de")
>                             (certificates (list (certificate-
> configuration
>                         (domains '("stream.isengaara.de")) (deploy-hook
> %nginx-deploy-hook))))))
>                  ;;; nginx testing
>                  (service nginx-service-type 
>                     (nginx-configuration
>                       (server-blocks
>                         (list (nginx-server-configuration
>                           (server-name '("stream.isengaara.de"))
>                             (root "/srv/http/stream.isengaara.de"))))))
>
> Certbot needs running nginx to create a certificate, and nginx wont
> start without a certificate. The documentation does not explain how
> to solve this circular service dependency.

Hi!  There is some reading about it there:

https://debbugs.gnu.org/cgi/pkgreport.cgi?include=subject%3Acertbot;package=guix

There is a proposal from Brice but it's not implemented yet, as far as I
know (https://debbugs.gnu.org/cgi/bugreport.cgi?bug=46961).

Please talk about it on the bug tracker rather than guix devel, this
allows for better tracking.

Thanks,
Clément