Certbot with alternative certificate authority

Certbot with alternative certificate authority

[Jack Hill]

Hi Guix,

I'm working on making the certbot service work with any certificate 
authority that implements ACME, not just Let's Encrypt. I've done this by 
adding a server field to the certbot-configuration, and then using it in 
the match for certbot-command as follows:

```
diff --git a/gnu/services/certbot.scm b/gnu/services/certbot.scm
index 0d3be03383..3e71026387 100644
--- a/gnu/services/certbot.scm
+++ b/gnu/services/certbot.scm
@@ -70,6 +70,8 @@
    (certificates        certbot-configuration-certificates
                         (default '()))
    (email               certbot-configuration-email)
+  (server              certbot-configuration-server
+                       (default #f))
    (rsa-key-size        certbot-configuration-rsa-key-size
                         (default #f))
    (default-location    certbot-configuration-default-location
@@ -82,7 +84,7 @@
  (define certbot-command
    (match-lambda
      (($ <certbot-configuration> package webroot certificates email
-                                rsa-key-size default-location)
+                                server rsa-key-size default-location)
       (let* ((certbot (file-append package "/bin/certbot"))
              (rsa-key-size (and rsa-key-size (number->string rsa-key-size)))
              (commands
@@ -101,6 +103,7 @@
                              "--cert-name" name
                              "--manual-public-ip-logging-ok"
                              "-d" (string-join domains ","))
+                      (if server `("--server" ,server) '())
                        (if rsa-key-size `("--rsa-key-size" ,rsa-key-size) '())
                        (if authentication-hook
                            `("--manual-auth-hook" ,authentication-hook)
@@ -113,6 +116,7 @@
                              "--webroot" "-w" webroot
                              "--cert-name" name
                              "-d" (string-join domains ","))
+                      (if server `("--server" ,server) '())
                        (if rsa-key-size `("--rsa-key-size" ,rsa-key-size) '())
                        (if deploy-hook `("--deploy-hook" ,deploy-hook) '()))))))
                certificates)))
```


However, reconfiguring with the following certbot service:

```
(service certbot-service-type
 	  (certbot-configuration
 		   (email "jackhill@jackhill.us")
 		   (rsa-key-size 4096)
 		   (server "https://example.com/acme/api")
 		   (certificates
 		    (list
 		     (certificate-configuration
 		      (domains '("test.jackhill.us")))))))
```

fails with:

```
Backtrace:
            1 (primitive-load "/tmp/cerbot-test2/bin/guix")
In guix/ui.scm:
   1826:12  0 (run-guix-command _ . _)

guix/ui.scm:1826:12: In procedure run-guix-command:
Throw to key `match-error' with args `("match" "no matching pattern" 4096)'.
```

When removing "(rsa-key-size 4096)" from my configuration, everthing works 
as expected with the default key size.

What error have I made?

Best,
Jack

Re: Certbot with alternative certificate authority

[Jack Hill]

On Thu, 5 Mar 2020, Jack Hill wrote:

> What error have I made?

Thanks to Tobias Geerinckx-Rice on IRC, it looks like I forgot additional 
record changes as well. Even though Tobias was not able to reproduce my 
exact problem, making the following additional changes fixed it for me:


```
diff --git a/gnu/services/certbot.scm b/gnu/services/certbot.scm
index 3e71026387..f2cc00e97f 100644
--- a/gnu/services/certbot.scm
+++ b/gnu/services/certbot.scm
@@ -146,7 +146,7 @@
           (message (format #f (G_ "~a may need to be run~%") script)))
      (match config
        (($ <certbot-configuration> package webroot certificates email
-                                  rsa-key-size default-location)
+                                  server rsa-key-size default-location)
         (with-imported-modules '((guix build utils))
           #~(begin
               (use-modules (guix build utils))
@@ -158,7 +158,7 @@
  (define certbot-nginx-server-configurations
    (match-lambda
      (($ <certbot-configuration> package webroot certificates email
-                                rsa-key-size default-location)
+                                server rsa-key-size default-location)
       (list
        (nginx-server-configuration
```

I will clean up these changes and submit a proper patch to improve our 
certbot service.

Best,
Jack

Re: Certbot with alternative certificate authority

[Jack Hill]

On Thu, 5 Mar 2020, Jack Hill wrote:

> I will clean up these changes and submit a proper patch to improve our 
> certbot service.

Submitted at https://issues.guix.gnu.org/issue/39934

Thanks,
Jack