* Certbot service: no http -> https redirection
@ 2020-10-20 7:40 divoplade
2020-10-20 9:42 ` jbranso
0 siblings, 1 reply; 7+ messages in thread
From: divoplade @ 2020-10-20 7:40 UTC (permalink / raw)
To: help-guix
Dear guix,
I have a certbot service with a nginx service. If I understand
correctly, certbot should hack the nginx configuration in order to
register itself for all .well-known/acme-challenge (I'm not sure for
the path syntax, but that's not the point) requests, and basically
redirect all other HTTP requests to HTTPS.
However, my system does not seem to do that.
How does guix know that my web server configuration needs to be
extended with certbot's anyway? Should I add a configuration entry?
For now my web configuration is:
https://code.divoplade.fr/divoplade-site.git/tree/divoplade/services/web.scm
Notice that there's no configuration entry for certbot.
My certbot configuration is:
https://code.divoplade.fr/divoplade-site.git/tree/divoplade/services/certbot.scm
Best regards,
divoplade
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Certbot service: no http -> https redirection
2020-10-20 7:40 Certbot service: no http -> https redirection divoplade
@ 2020-10-20 9:42 ` jbranso
2020-10-20 10:17 ` divoplade
0 siblings, 1 reply; 7+ messages in thread
From: jbranso @ 2020-10-20 9:42 UTC (permalink / raw)
To: divoplade, help-guix
Perhaps my guix configuration will help you figure out how to write your config.scm properly. The below file is what's running gnucode.me
https://notabug.org/jbranso/linode-guix-system-configuration/src/master/linode-locke-lamora-current-config.scm
Best of luck,
Joshua
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Certbot service: no http -> https redirection
2020-10-20 9:42 ` jbranso
@ 2020-10-20 10:17 ` divoplade
2020-10-20 12:04 ` Julien Lepiller
0 siblings, 1 reply; 7+ messages in thread
From: divoplade @ 2020-10-20 10:17 UTC (permalink / raw)
To: jbranso, help-guix
Hello Joshua,
Le mardi 20 octobre 2020 à 09:42 +0000, jbranso@dismail.de a écrit :
> gnucode.me
I think you have the same problem. This site does not have HTTPS
automatic redirection.
www.gnu-hurd.com does try to do HTTPS redirection though (be careful,
you don't have a valid certificate), which is very puzzling to me.
Anyway, I see you do these redirections yourself. So I will do the
same.
Best regards,
divoplade
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Certbot service: no http -> https redirection
2020-10-20 10:17 ` divoplade
@ 2020-10-20 12:04 ` Julien Lepiller
2020-10-20 18:34 ` Joshua Branson
0 siblings, 1 reply; 7+ messages in thread
From: Julien Lepiller @ 2020-10-20 12:04 UTC (permalink / raw)
To: help-guix, divoplade, jbranso
Weird, I have the certbot and nginx services, and I don't need to redirect manually: https://git.lepiller.eu/system-configuration/tree/-/systems/ene.scm
Le 20 octobre 2020 06:17:00 GMT-04:00, divoplade <d@divoplade.fr> a écrit :
>Hello Joshua,
>
>Le mardi 20 octobre 2020 à 09:42 +0000, jbranso@dismail.de a écrit :
>> gnucode.me
>
>I think you have the same problem. This site does not have HTTPS
>automatic redirection.
>
>www.gnu-hurd.com does try to do HTTPS redirection though (be careful,
>you don't have a valid certificate), which is very puzzling to me.
>
>Anyway, I see you do these redirections yourself. So I will do the
>same.
>
>Best regards,
>
>divoplade
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Certbot service: no http -> https redirection
2020-10-20 12:04 ` Julien Lepiller
@ 2020-10-20 18:34 ` Joshua Branson
2020-10-20 19:57 ` Julien Lepiller
0 siblings, 1 reply; 7+ messages in thread
From: Joshua Branson @ 2020-10-20 18:34 UTC (permalink / raw)
To: Julien Lepiller; +Cc: help-guix, divoplade
Oh, now that you guys mention it, isn't a http to https re-direct a
potential security risk, via a man in the middle attack?
--
Joshua Branson
Sent from Emacs and Gnus
https://gnucode.me
https://video.hardlimit.com/accounts/joshua_branson/video-channels
"You can have whatever you want, as long as you help enough other people get what they want." - Zig Ziglar
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Certbot service: no http -> https redirection
2020-10-20 18:34 ` Joshua Branson
@ 2020-10-20 19:57 ` Julien Lepiller
2020-10-20 21:01 ` Joshua Branson
0 siblings, 1 reply; 7+ messages in thread
From: Julien Lepiller @ 2020-10-20 19:57 UTC (permalink / raw)
To: Joshua Branson; +Cc: help-guix
Le 20 octobre 2020 14:34:29 GMT-04:00, Joshua Branson <jbranso@dismail.de> a écrit :
>
>Oh, now that you guys mention it, isn't a http to https re-direct a
>potential security risk, via a man in the middle attack?
How could it be worse than serving your site on http?
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: Certbot service: no http -> https redirection
2020-10-20 19:57 ` Julien Lepiller
@ 2020-10-20 21:01 ` Joshua Branson
0 siblings, 0 replies; 7+ messages in thread
From: Joshua Branson @ 2020-10-20 21:01 UTC (permalink / raw)
To: Julien Lepiller; +Cc: help-guix
Well I serve my sites on https. If you access the https version, then
the browser will redirect you to the https version.
--
Joshua Branson
Sent from Emacs and Gnus
https://gnucode.me
https://video.hardlimit.com/accounts/joshua_branson/video-channels
"You can have whatever you want, as long as you help enough other people get what they want." - Zig Ziglar
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2020-10-20 21:02 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-10-20 7:40 Certbot service: no http -> https redirection divoplade
2020-10-20 9:42 ` jbranso
2020-10-20 10:17 ` divoplade
2020-10-20 12:04 ` Julien Lepiller
2020-10-20 18:34 ` Joshua Branson
2020-10-20 19:57 ` Julien Lepiller
2020-10-20 21:01 ` Joshua Branson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).