From: "Clément Lassieur" <clement@lassieur.org>
To: 30459@debbugs.gnu.org
Subject: [bug#30459] [PATCH 07/11] services: certbot: Associate one certificate with several domains.
Date: Wed, 14 Feb 2018 22:35:00 +0100 [thread overview]
Message-ID: <20180214213504.29984-7-clement@lassieur.org> (raw)
In-Reply-To: <20180214213504.29984-1-clement@lassieur.org>
* doc/guix.texi (Certificate Services): Document <certificate-configuration>,
the change from domains to certificates and the fact that their path is now
derived from their name.
* gnu/services/certbot.scm (<certificate-configuration>): Add and export it.
(certbot-configuration, certbot-command, certbot-activation,
certbot-nginx-server-configurations, certbot-service-type): Replace 'domains'
with 'certificates'.
(certbot-nginx-server-configurations): Use only one nginx-server-configuration
and use all certificate domains as the server-name.
---
doc/guix.texi | 48 ++++++++++++++++++++++++++------
gnu/services/certbot.scm | 71 ++++++++++++++++++++++++++++--------------------
2 files changed, 81 insertions(+), 38 deletions(-)
diff --git a/doc/guix.texi b/doc/guix.texi
index e951b3274..78508eeac 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -15677,7 +15677,22 @@ staying online in case a Let's Encrypt-initiated revocation happened for
some reason.
@defvr {Scheme Variable} certbot-service-type
-A service type for the @code{certbot} Let's Encrypt client.
+A service type for the @code{certbot} Let's Encrypt client. Its value
+must be a @code{certbot-configuration} record as in this example:
+
+@example
+(service certbot-service-type
+ (certbot-configuration
+ (email "foo@@example.net")
+ (certificates
+ (list
+ (certificate-configuration
+ (domains '("example.net" "www.example.net")))
+ (certificate-configuration
+ (domains '("bar.example.net")))))))
+@end example
+
+See below for details about @code{certbot-configuration}.
@end defvr
@deftp {Data Type} certbot-configuration
@@ -15692,9 +15707,10 @@ The certbot package to use.
The directory from which to serve the Let's Encrypt challenge/response
files.
-@item @code{domains} (default: @code{()})
-A list of domains for which to generate certificates and request
-signatures.
+@item @code{certificates} (default: @code{()})
+A list of @code{certificates-configuration}s for which to generate
+certificates and request signatures. Each certificate has a @code{name}
+and several @code{domains}.
@item @code{email}
Mandatory email used for registration, recovery contact, and important
@@ -15722,12 +15738,28 @@ Pass @code{#f} to not issue a default location.
@end table
@end deftp
-The public key and its signatures will be written to
-@code{/etc/letsencrypt/live/@var{domain}/fullchain.pem}, for each
-@var{domain} in the configuration. The private key is written to
-@code{/etc/letsencrypt/live/@var{domain}/privkey.pem}.
+@deftp {Data Type} certificate-configuration
+Data type representing the configuration of a certificate.
+This type has the following parameters:
+
+@table @asis
+@item @code{name} (default: @i{see below})
+This name is used by Certbot for housekeeping and in file paths; it
+doesn't affect the content of the certificate itself. To see
+certificate names, run @code{certbot certificates}.
+
+Its default is the first provided domain.
+@item @code{domains} (default: @code{()})
+The first domain provided will be the subject CN of the certificate, and
+all domains will be Subject Alternative Names on the certificate.
+
+@end table
+@end deftp
+For each @code{certificate-configuration}, the certificate is saved to
+@code{/etc/letsencrypt/live/@var{name}/fullchain.pem} and the key is
+saved to @code{/etc/letsencrypt/live/@var{name}/privkey.pem}.
@node DNS Services
@subsubsection DNS Services
@cindex DNS (domain name system)
diff --git a/gnu/services/certbot.scm b/gnu/services/certbot.scm
index 379c21143..a70a36591 100644
--- a/gnu/services/certbot.scm
+++ b/gnu/services/certbot.scm
@@ -32,7 +32,8 @@
#:use-module (ice-9 match)
#:export (certbot-service-type
certbot-configuration
- certbot-configuration?))
+ certbot-configuration?
+ certificate-configuration))
;;; Commentary:
;;;
@@ -41,6 +42,14 @@
;;; Code:
\f
+(define-record-type* <certificate-configuration>
+ certificate-configuration make-certificate-configuration
+ certificate-configuration?
+ (name certificate-configuration-name
+ (default #f))
+ (domains certificate-configuration-domains
+ (default '())))
+
(define-record-type* <certbot-configuration>
certbot-configuration make-certbot-configuration
certbot-configuration?
@@ -48,7 +57,7 @@
(default certbot))
(webroot certbot-configuration-webroot
(default "/var/www"))
- (domains certbot-configuration-domains
+ (certificates certbot-configuration-certificates
(default '()))
(email certbot-configuration-email)
(default-location certbot-configuration-default-location
@@ -60,17 +69,19 @@
(define certbot-command
(match-lambda
- (($ <certbot-configuration> package webroot domains email
+ (($ <certbot-configuration> package webroot certificates email
default-location)
(let* ((certbot (file-append package "/bin/certbot"))
(commands
(map
- (lambda (domain)
- (list certbot "certonly" "-n" "--agree-tos"
- "-m" email
- "--webroot" "-w" webroot
- "-d" domain))
- domains)))
+ (match-lambda
+ (($ <certificate-configuration> name domains)
+ (list certbot "certonly" "-n" "--agree-tos"
+ "-m" email
+ "--webroot" "-w" webroot
+ "--cert-name" (or name (car domains))
+ "-d" (string-join domains ","))))
+ certificates)))
(program-file
"certbot-command"
#~(let ((code 0))
@@ -88,7 +99,7 @@
(define (certbot-activation config)
(match config
- (($ <certbot-configuration> package webroot domains email
+ (($ <certbot-configuration> package webroot certificates email
default-location)
(with-imported-modules '((guix build utils))
#~(begin
@@ -98,23 +109,22 @@
(define certbot-nginx-server-configurations
(match-lambda
- (($ <certbot-configuration> package webroot domains email
+ (($ <certbot-configuration> package webroot certificates email
default-location)
- (map
- (lambda (domain)
- (nginx-server-configuration
- (listen '("80" "[::]:80"))
- (ssl-certificate #f)
- (ssl-certificate-key #f)
- (server-name (list domain))
- (locations
- (filter identity
- (list
- (nginx-location-configuration
- (uri "/.well-known")
- (body (list (list "root " webroot ";"))))
- default-location)))))
- domains))))
+ (list
+ (nginx-server-configuration
+ (listen '("80" "[::]:80"))
+ (ssl-certificate #f)
+ (ssl-certificate-key #f)
+ (server-name
+ (apply append (map certificate-configuration-domains certificates)))
+ (locations
+ (filter identity
+ (list
+ (nginx-location-configuration
+ (uri "/.well-known")
+ (body (list (list "root " webroot ";"))))
+ default-location))))))))
(define certbot-service-type
(service-type (name 'certbot)
@@ -126,12 +136,13 @@
(service-extension mcron-service-type
certbot-renewal-jobs)))
(compose concatenate)
- (extend (lambda (config additional-domains)
+ (extend (lambda (config additional-certificates)
(certbot-configuration
(inherit config)
- (domains (append
- (certbot-configuration-domains config)
- additional-domains)))))
+ (certificates
+ (append
+ (certbot-configuration-certificates config)
+ additional-certificates)))))
(description
"Automatically renew @url{https://letsencrypt.org, Let's
Encrypt} HTTPS certificates by adjusting the nginx web server configuration
--
2.16.1
next prev parent reply other threads:[~2018-02-14 21:36 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-14 21:33 [bug#30459] Certbot service patches Clément Lassieur
2018-02-14 21:34 ` [bug#30459] [PATCH 01/11] services: certbot: Listen on IPv6 Clément Lassieur
2018-02-14 21:34 ` [bug#30459] [PATCH 02/11] services: certbot: Run certbot twice a day at a random minute Clément Lassieur
2018-02-14 21:34 ` [bug#30459] [PATCH 03/11] services: certbot: Fix indentation Clément Lassieur
2018-02-14 21:34 ` [bug#30459] [PATCH 04/11] services: certbot: Rename 'host' to 'domain' Clément Lassieur
2018-02-14 21:34 ` [bug#30459] [PATCH 05/11] services: certbot: Refactor certbot command Clément Lassieur
2018-02-14 21:34 ` [bug#30459] [PATCH 06/11] services: certbot: Get certbot to run non-interactively Clément Lassieur
2018-02-17 15:13 ` Marius Bakke
2018-02-19 22:46 ` Clément Lassieur
2018-02-22 13:57 ` Marius Bakke
2018-02-22 20:49 ` Clément Lassieur
2018-03-03 21:52 ` bug#30459: " Ludovic Courtès
2018-03-03 22:09 ` [bug#30459] " Clément Lassieur
2018-02-14 21:35 ` Clément Lassieur [this message]
2018-02-14 21:35 ` [bug#30459] [PATCH 08/11] doc: Fix typo in certbot-configuration description Clément Lassieur
2018-02-14 21:35 ` [bug#30459] [PATCH 09/11] services: certbot: Allow to set RSA key size Clément Lassieur
2018-02-14 21:35 ` [bug#30459] [PATCH 10/11] services: certbot: Add verbosity Clément Lassieur
2018-02-14 21:35 ` [bug#30459] [PATCH 11/11] services: certbot: Allow to set a deploy hook Clément Lassieur
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180214213504.29984-7-clement@lassieur.org \
--to=clement@lassieur.org \
--cc=30459@debbugs.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).