From: Raghav Gururajan <rg@raghavgururajan.name>
To: Pierre Langlois <pierre.langlois@gmx.com>
Cc: help-guix@gnu.org
Subject: Re: Certbot with DNS Challenge
Date: Sat, 17 Apr 2021 08:27:34 -0400 [thread overview]
Message-ID: <fbc242a8-d916-3ece-58dc-24e0f979d939@raghavgururajan.name> (raw)
In-Reply-To: <87tuo5mcln.fsf@gmx.com>
[-- Attachment #1.1.1: Type: text/plain, Size: 2413 bytes --]
Hi Pierre!
> --8<---------------cut here---------------start------------->8---
> (define certbot-authentication-hook
> (program-file "certbot-authentication-hook"
> (with-imported-modules '((guix build utils))
> #~(let ((gandi (string-append #$gandi.cli "/bin/gandi"))
> (validation (getenv "CERTBOT_VALIDATION")))
> (use-modules ((guix build utils)))
> (setenv "GANDI_CONFIG" "/etc/gandi/config.yaml")
> (invoke gandi "dns" "create" "example.com" "_acme-challenge"
"TXT" validation)))))
>
> (define certbot-cleanup-hook
> (program-file "certbot-cleanup-hook"
> (with-imported-modules '((guix build utils))
> #~(let ((gandi (string-append #$gandi.cli "/bin/gandi")))
> (use-modules ((guix build utils)))
> (setenv "GANDI_CONFIG" "/etc/gandi/config.yaml")
> (invoke gandi "dns" "delete" "--force" "example.com" "_acme-challenge" "TXT")))))
>
> (...)
>
> (service certbot-service-type
> (certbot-configuration
> (email "me@example.com")
> (certificates
> (list
> (certificate-configuration
> (domains '("*.example.com"))
> (challenge "dns")
> (authentication-hook certbot-authentication-hook)
> (cleanup-hook certbot-cleanup-hook))))))
> --8<---------------cut here---------------end--------------->8---
Thank you so much! I appreciate it.
I am using deSEC (https://desec.io) and have their hook.sh
(https://github.com/desec-io/desec-certbot-hook) stored as
"/etc/desec/hook.sh" on my system.
So, in your snippet, I should replace certbot-*-hook with
"/etc/desec/hook.sh", right?
Also, does using "*.example.com" means that the generated cert can be
used both for apex/naked domain and any of the subdomains?
> As a tip, when working on this it was very useful to be able to pass the
> --dry-run option to certbot, and use development acme server
> temporarily. Otherwise if you do too many attempts on the regular server
> you eventually get blocked because of limit rates. But if you use the
> dev server, then you have to use --dry-run as well.
>
> I've actually got patches up for the dry-run flag if you need them:
> https://issues.guix.gnu.org/47136. Let me know if you test them or/and
> have any feedback!
Sure, I'll give it a try.
Regards,
RG.
[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 2649 bytes --]
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 236 bytes --]
next prev parent reply other threads:[~2021-04-17 12:28 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-17 10:14 Certbot with DNS Challenge Raghav Gururajan
2021-04-17 10:25 ` Pierre Langlois
2021-04-17 10:35 ` Vincent Legoll
2021-04-17 16:48 ` Pierre Langlois
2021-04-17 12:27 ` Raghav Gururajan [this message]
2021-04-17 16:40 ` Pierre Langlois
2021-04-17 16:53 ` Raghav Gururajan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=fbc242a8-d916-3ece-58dc-24e0f979d939@raghavgururajan.name \
--to=rg@raghavgururajan.name \
--cc=help-guix@gnu.org \
--cc=pierre.langlois@gmx.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).