From mboxrd@z Thu Jan 1 00:00:00 1970 From: Chris Marusich Subject: Re: certbot service experience Date: Sat, 29 Apr 2017 20:00:16 -0700 Message-ID: <87efwaha67.fsf@gmail.com> References: <87tw56dhlp.fsf@dustycloud.org> <87mvayhc8a.fsf@gmail.com> <87pofud3mt.fsf@dustycloud.org> Mime-Version: 1.0 Content-Type: multipart/signed; boundary="=-=-="; micalg=pgp-sha256; protocol="application/pgp-signature" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:57937) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1d4f61-0000iq-Sp for guix-devel@gnu.org; Sat, 29 Apr 2017 23:00:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1d4f5y-0003je-Pg for guix-devel@gnu.org; Sat, 29 Apr 2017 23:00:25 -0400 Received: from mail-pg0-x241.google.com ([2607:f8b0:400e:c05::241]:35289) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1d4f5y-0003jY-Gf for guix-devel@gnu.org; Sat, 29 Apr 2017 23:00:22 -0400 Received: by mail-pg0-x241.google.com with SMTP id c2so824499pga.2 for ; Sat, 29 Apr 2017 20:00:22 -0700 (PDT) In-Reply-To: <87pofud3mt.fsf@dustycloud.org> (Christopher Allan Webber's message of "Sat, 29 Apr 2017 21:35:06 -0500") List-Id: "Development of GNU Guix and the GNU System distribution." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: guix-devel-bounces+gcggd-guix-devel=m.gmane.org@gnu.org Sender: "Guix-devel" To: Christopher Allan Webber Cc: Guix-devel --=-=-= Content-Type: text/plain Content-Transfer-Encoding: quoted-printable Christopher Allan Webber writes: > [-bug] > > Chris Marusich writes: > >> Christopher Allan Webber writes: >> >>> - I was surprised that I was prompted for an email while doing guix >>> system reconfigure >> >> That does seem odd. Why were you prompted for an email address? Can >> that be fixed somehow? > > It's the certbot initial-setup script firing off here. The email > address is given so you can be notified for security updates, etc. > Maybe recovery? Don't remember about that last bit. I see. Having never used certbot before myself, I don't think I can really give useful advice here. It just seems a little strange to require user interaction during the reconfigure. One would think that one could provide any necessary information declaratively in the operating system configuration file. > >>> 2) Enable the certbot-service-type (and mcron-service-type if you >>> haven't already): >>> >>> (service certbot-service-type >>> (certbot-configuration >>> ;; Replace these with your own domain and web root >>> (hosts '("test.activitypub.rocks")) >>> (webroot "/srv/activitypub.rocks/site/"))) >>> ;; if you don't have an mcron service already >>> (service mcron-service-type) >> >> Where is the certbot-service-type defined? I couldn't find it in the >> master branch. Also, why is mcron required? I don't know much about >> LetsEncrypt, but I thought certbot was a one-time thing that you do >> manually... Why is it a "service" here? > > It's not in the master branch is why. I was looking at the > wip-git-https branch. :) I think it's also in the wip-potluck branch. > That explains it! :) > > It's extending the mcron service so it can install an auto-update rule > for you, which is pretty cool! I see. I would have thought that if service A extends service B, and one defines service A in the operating system configuration file, service B gets pulled in automatically. Is that not true? >>> 3) Okay hopefully that went successfully! It should say. Assuming it >>> did, *now* we can add the keys appropriately to the nginx config. >>> >>> (service nginx-service-type >>> (nginx-configuration >>> (server-blocks >>> (list >>> (nginx-server-configuration >>> ;; Again, adjust to your site >>> (server-name '("test.activitypub.rocks")) >>> (root "/srv/activitypub.rocks/site/") >>> (ssl-certificate >>> "/etc/letsencrypt/live/test.activitypub.rocks/full= chain.pem") >>> (ssl-certificate-key >>> "/etc/letsencrypt/live/test.activitypub.rocks/priv= key.pem")))))) >>> >>> Reconfigure and cross your fingers! >>> >>> 4) At this point I was surprised that it seemed like nginx should have >>> been working with https since everything was in place, but I >>> couldn't access it from my browser over https. Frustrated, I >>> restarted the server. >>> >>> And then it worked! :) >>> >>> So, this involved reconfiguring, reconfiguring, reconfiguring, and then >>> a restart, then it worked for me. (Well, plus a few reconfigures where >>> nothing worked at all because I broke things of course. ;)) I wonder if >>> that can be improved? >> >> I wonder if it is possible to define a custom service which orchestrates >> the execution of nginx and certbot in the way you require, so that you >> can define it all in one place, at once, without needing to reconfigure >> multiple times? > > It might be, I dunno! Maybe in starting the service, if it sees that > the keys have not been generated yet, it pulls up nginx temporarily just > to do the registration with the nginx that doesn't have the keys in it, > does the generation of the keys and verifies them with letsencrypt, then > pulls up the proper nginx at last. > > I don't know how easy/feasible this is. It would be nice if we could just declare what we want in the operating system configuration file, and get it without having to run multiple reconfigures or interact with the user. But hey, anything that works is a step in the right direction! =2D-=20 Chris --=-=-= Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEy/WXVcvn5+/vGD+x3UCaFdgiRp0FAlkFU0AACgkQ3UCaFdgi Rp3gJA//ZrxtGiniG4LeqsA06QDYYdmsOkkfBcwqtHH4BLtMGoetcun97rDE45KF QAFOUmu/Ey34TtJMFcmeKouSi7HmII2nAZbiVAqpdNVmEZdtEVZeB7dTqzl/uaMg ualA+PYKoUYmo4lRyzdQCR3xmXw5pwjvlpYycwcpBrwoogOKVhWzzqq76I7r6NHm d9crIAW3/mFrCpnYaxtn4kYjb5a0I0hCcAZenqVluX3ceFFHNVMWHqhws6O5b9NT Jg0cZrssqsY8dVy3S7m09hiAaiuw251ycTi0eFxs9sxOyLciGOl/L9IOBnvW20Zy mGLstXz13fmaNPPWXxQmp3h/SK86t84iqxn61mExFuDzSDEEih3U/BKUexYKMRiA SVtWrtiMwup3y+8Ce1qEVYBESV/c4vuQnqOsqCYVRlS7Rof3i3efAASdxK5DfB0k FmSG9oPBamR//+6kiwvYDOKpAdYdEDDqkjzh7+5H69ryJDoIpCEORbjwHmp3MLTR Br/4MTSc3KCOKLsSR9HM5b7+w1Vq9BjvnTtYpUOPE375kxuiwtmq+gUh4Gi5Ft9+ 1GGmAmQ8d/LyygiC926kbZUtloP9C94vHjhL0GL/MFedRzhRvJW/logYpJR8xhjN caNhK4x5+G9pOHhDpjFkVy5osHwy/U4ETNewjTm+j13CC1eYYp8= =1n/g -----END PGP SIGNATURE----- --=-=-=--