git.iko.soy/obelisk
on master help sign in
Drop ACME v2 backport since we now have it from nixpkgs 19.09
b81f045Elliot Cameron
acme.nixdeleted−397
compare with master
unifiedsplit
@@ -1,397 +0,0 @@
1−### COPIED FROM
2−### https://github.com/NixOS/nixpkgs/blob/1d36ad6d16dbf1d3937f899a087a4360332eb141/nixos/modules/security/acme.nix
3−###
4−### to support new plugins in simp_le for ACMEv2 support.
5−### Changed lines are marked with a comment: ### CHANGED
6−
7−{ config, lib, pkgs, ... }:
8−
9−with lib;
10−
11−let
12−
13− cfg = config.security.acme;
14−
15− certOpts = { name, ... }: {
16− options = {
17− webroot = mkOption {
18− type = types.str;
19− example = "/var/lib/acme/acme-challenges";
20− description = ''
21− Where the webroot of the HTTP vhost is located.
22− <filename>.well-known/acme-challenge/</filename> directory
23− will be created below the webroot if it doesn't exist.
24− <literal>http://example.org/.well-known/acme-challenge/</literal> must also
25− be available (notice unencrypted HTTP).
26− '';
27− };
28−
29− domain = mkOption {
30− type = types.str;
31− default = name;
32− description = "Domain to fetch certificate for (defaults to the entry name)";
33− };
34−
35− email = mkOption {
36− type = types.nullOr types.str;
37− default = null;
38− description = "Contact email address for the CA to be able to reach you.";
39− };
40−
41− user = mkOption {
42− type = types.str;
43− default = "root";
44− description = "User running the ACME client.";
45− };
46−
47− group = mkOption {
48− type = types.str;
49− default = "root";
50− description = "Group running the ACME client.";
51− };
52−
53− allowKeysForGroup = mkOption {
54− type = types.bool;
55− default = false;
56− description = ''
57− Give read permissions to the specified group
58− (<option>security.acme.cert.&lt;name&gt;.group</option>) to read SSL private certificates.
59− '';
60− };
61−
62− postRun = mkOption {
63− type = types.lines;
64− default = "";
65− example = "systemctl reload nginx.service";
66− description = ''
67− Commands to run after new certificates go live. Typically
68− the web server and other servers using certificates need to
69− be reloaded.
70−
71− Executed in the same directory with the new certificate.
72− '';
73− };
74−
75− plugins = mkOption {
76− type = types.listOf (types.enum [
77− "cert.der" "cert.pem" "chain.pem" "external.sh"
78− "fullchain.pem" "full.pem" "key.der" "key.pem" "account_key.json" "account_reg.json" ### CHANGED
79− ]);
80− default = [ "fullchain.pem" "full.pem" "key.pem" "account_key.json" "account_reg.json" ]; ### CHANGED
81− description = ''
82− Plugins to enable. With default settings simp_le will
83− store public certificate bundle in <filename>fullchain.pem</filename>,
84− private key in <filename>key.pem</filename> and those two previous
85− files combined in <filename>full.pem</filename> in its state directory.
86− '';
87− };
88−
89− activationDelay = mkOption {
90− type = types.nullOr types.str;
91− default = null;
92− description = ''
93− Systemd time span expression to delay copying new certificates to main
94− state directory. See <citerefentry><refentrytitle>systemd.time</refentrytitle>
95− <manvolnum>7</manvolnum></citerefentry>.
96− '';
97− };
98−
99− preDelay = mkOption {
100− type = types.lines;
101− default = "";
102− description = ''
103− Commands to run after certificates are re-issued but before they are
104− activated. Typically the new certificate is published to DNS.
105−
106− Executed in the same directory with the new certificate.
107− '';
108− };
109−
110− extraDomains = mkOption {
111− type = types.attrsOf (types.nullOr types.str);
112− default = {};
113− example = literalExample ''
114− {
115− "example.org" = "/srv/http/nginx";
116− "mydomain.org" = null;
117− }
118− '';
119− description = ''
120− A list of extra domain names, which are included in the one certificate to be issued, with their
121− own server roots if needed.
122− '';
123− };
124− };
125− };
126−
127−in
128−
129−{
130−
131− ###### interface
132−
133− options = {
134− security.acme = {
135− directory = mkOption {
136− default = "/var/lib/acme";
137− type = types.str;
138− description = ''
139− Directory where certs and other state will be stored by default.
140− '';
141− };
142−
143− validMin = mkOption {
144− type = types.int;
145− default = 30 * 24 * 3600;
146− description = "Minimum remaining validity before renewal in seconds.";
147− };
148−
149− renewInterval = mkOption {
150− type = types.str;
151− default = "weekly";
152− description = ''
153− Systemd calendar expression when to check for renewal. See
154− <citerefentry><refentrytitle>systemd.time</refentrytitle>
155− <manvolnum>7</manvolnum></citerefentry>.
156− '';
157− };
158−
159− preliminarySelfsigned = mkOption {
160− type = types.bool;
161− default = true;
162− description = ''
163− Whether a preliminary self-signed certificate should be generated before
164− doing ACME requests. This can be useful when certificates are required in
165− a webserver, but ACME needs the webserver to make its requests.
166−
167− With preliminary self-signed certificate the webserver can be started and
168− can later reload the correct ACME certificates.
169− '';
170− };
171−
172− production = mkOption {
173− type = types.bool;
174− default = true;
175− description = ''
176− If set to true, use Let's Encrypt's production environment
177− instead of the staging environment. The main benefit of the
178− staging environment is to get much higher rate limits.
179−
180− See
181− <literal>https://letsencrypt.org/docs/staging-environment</literal>
182− for more detail.
183− '';
184− };
185−
186− certs = mkOption {
187− default = { };
188− type = with types; attrsOf (submodule certOpts);
189− description = ''
190− Attribute set of certificates to get signed and renewed.
191− '';
192− example = literalExample ''
193− {
194− "example.com" = {
195− webroot = "/var/www/challenges/";
196− email = "foo@example.com";
197− extraDomains = { "www.example.com" = null; "foo.example.com" = "/var/www/foo/"; };
198− };
199− "bar.example.com" = {
200− webroot = "/var/www/challenges/";
201− email = "bar@example.com";
202− };
203− }
204− '';
205− };
206− };
207− };
208−
209− ###### implementation
210− config = mkMerge [
211− (mkIf (cfg.certs != { }) {
212−
213− systemd.services = let
214− services = concatLists servicesLists;
215− servicesLists = mapAttrsToList certToServices cfg.certs;
216− certToServices = cert: data:
217− let
218− cpath = lpath + optionalString (data.activationDelay != null) ".staging";
219− lpath = "${cfg.directory}/${cert}";
220− rights = if data.allowKeysForGroup then "750" else "700";
221− cmdline = [ "-v" "-d" data.domain "--default_root" data.webroot "--valid_min" cfg.validMin ]
222− ++ optionals (data.email != null) [ "--email" data.email ]
223− ++ concatMap (p: [ "-f" p ]) data.plugins
224− ++ concatLists (mapAttrsToList (name: root: [ "-d" (if root == null then name else "${name}:${root}")]) data.extraDomains)
225− ++ optionals (!cfg.production) ["--server" "https://acme-staging.api.letsencrypt.org/directory"];
226− acmeService = {
227− description = "Renew ACME Certificate for ${cert}";
228− after = [ "network.target" "network-online.target" ];
229− wants = [ "network-online.target" ];
230− serviceConfig = {
231− Type = "oneshot";
232− SuccessExitStatus = [ "0" "1" ];
233− PermissionsStartOnly = true;
234− User = data.user;
235− Group = data.group;
236− PrivateTmp = true;
237− };
238− path = with pkgs; [ simp_le systemd ];
239− preStart = ''
240− mkdir -p '${cfg.directory}'
241− chown 'root:root' '${cfg.directory}'
242− chmod 755 '${cfg.directory}'
243− if [ ! -d '${cpath}' ]; then
244− mkdir '${cpath}'
245− fi
246− chmod ${rights} '${cpath}'
247− chown -R '${data.user}:${data.group}' '${cpath}'
248− mkdir -p '${data.webroot}/.well-known/acme-challenge'
249− chown -R '${data.user}:${data.group}' '${data.webroot}/.well-known/acme-challenge'
250− '';
251− script = ''
252− cd '${cpath}'
253− set +e
254− simp_le ${escapeShellArgs cmdline}
255− EXITCODE=$?
256− set -e
257− echo "$EXITCODE" > /tmp/lastExitCode
258− exit "$EXITCODE"
259− '';
260− postStop = ''
261− cd '${cpath}'
262−
263− if [ -e /tmp/lastExitCode ] && [ "$(cat /tmp/lastExitCode)" = "0" ]; then
264− ${if data.activationDelay != null then ''
265−
266− ${data.preDelay}
267−
268− if [ -d '${lpath}' ]; then
269− systemd-run --no-block --on-active='${data.activationDelay}' --unit acme-setlive-${cert}.service
270− else
271− systemctl --wait start acme-setlive-${cert}.service
272− fi
273− '' else data.postRun}
274−
275− # noop ensuring that the "if" block is non-empty even if
276− # activationDelay == null and postRun == ""
277− true
278− fi
279− '';
280−
281− before = [ "acme-certificates.target" ];
282− wantedBy = [ "acme-certificates.target" ];
283− };
284− delayService = {
285− description = "Set certificate for ${cert} live";
286− path = with pkgs; [ rsync ];
287− serviceConfig = {
288− Type = "oneshot";
289− };
290− script = ''
291− rsync -a --delete-after '${cpath}/' '${lpath}'
292− '';
293− postStop = data.postRun;
294− };
295− selfsignedService = {
296− description = "Create preliminary self-signed certificate for ${cert}";
297− path = [ pkgs.openssl ];
298− preStart = ''
299− if [ ! -d '${cpath}' ]
300− then
301− mkdir -p '${cpath}'
302− chmod ${rights} '${cpath}'
303− chown '${data.user}:${data.group}' '${cpath}'
304− fi
305− '';
306− script =
307− ''
308− workdir="$(mktemp -d)"
309−
310− # Create CA
311− openssl genrsa -des3 -passout pass:xxxx -out $workdir/ca.pass.key 2048
312− openssl rsa -passin pass:xxxx -in $workdir/ca.pass.key -out $workdir/ca.key
313− openssl req -new -key $workdir/ca.key -out $workdir/ca.csr \
314− -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=Security Department/CN=example.com"
315− openssl x509 -req -days 1 -in $workdir/ca.csr -signkey $workdir/ca.key -out $workdir/ca.crt
316−
317− # Create key
318− openssl genrsa -des3 -passout pass:xxxx -out $workdir/server.pass.key 2048
319− openssl rsa -passin pass:xxxx -in $workdir/server.pass.key -out $workdir/server.key
320− openssl req -new -key $workdir/server.key -out $workdir/server.csr \
321− -subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com"
322− openssl x509 -req -days 1 -in $workdir/server.csr -CA $workdir/ca.crt \
323− -CAkey $workdir/ca.key -CAserial $workdir/ca.srl -CAcreateserial \
324− -out $workdir/server.crt
325−
326− # Copy key to destination
327− cp $workdir/server.key ${cpath}/key.pem
328−
329− # Create fullchain.pem (same format as "simp_le ... -f fullchain.pem" creates)
330− cat $workdir/{server.crt,ca.crt} > "${cpath}/fullchain.pem"
331−
332− # Create full.pem for e.g. lighttpd
333− cat $workdir/{server.key,server.crt,ca.crt} > "${cpath}/full.pem"
334−
335− # Give key acme permissions
336− chown '${data.user}:${data.group}' "${cpath}/"{key,fullchain,full}.pem
337− chmod ${rights} "${cpath}/"{key,fullchain,full}.pem
338− '';
339− serviceConfig = {
340− Type = "oneshot";
341− PermissionsStartOnly = true;
342− PrivateTmp = true;
343− User = data.user;
344− Group = data.group;
345− };
346− unitConfig = {
347− # Do not create self-signed key when key already exists
348− ConditionPathExists = "!${cpath}/key.pem";
349− };
350− before = [
351− "acme-selfsigned-certificates.target"
352− ];
353− wantedBy = [
354− "acme-selfsigned-certificates.target"
355− ];
356− };
357− in (
358− [ { name = "acme-${cert}"; value = acmeService; } ]
359− ++ optional cfg.preliminarySelfsigned { name = "acme-selfsigned-${cert}"; value = selfsignedService; }
360− ++ optional (data.activationDelay != null) { name = "acme-setlive-${cert}"; value = delayService; }
361− );
362− servicesAttr = listToAttrs services;
363− injectServiceDep = {
364− after = [ "acme-selfsigned-certificates.target" ];
365− wants = [ "acme-selfsigned-certificates.target" "acme-certificates.target" ];
366− };
367− in
368− servicesAttr //
369− (if config.services.nginx.enable then { nginx = injectServiceDep; } else {}) //
370− (if config.services.lighttpd.enable then { lighttpd = injectServiceDep; } else {});
371−
372− systemd.timers = flip mapAttrs' cfg.certs (cert: data: nameValuePair
373− ("acme-${cert}")
374− ({
375− description = "Renew ACME Certificate for ${cert}";
376− wantedBy = [ "timers.target" ];
377− timerConfig = {
378− OnCalendar = cfg.renewInterval;
379− Unit = "acme-${cert}.service";
380− Persistent = "yes";
381− AccuracySec = "5m";
382− RandomizedDelaySec = "1h";
383− };
384− })
385− );
386−
387− systemd.targets."acme-selfsigned-certificates" = mkIf cfg.preliminarySelfsigned {};
388− systemd.targets."acme-certificates" = {};
389− })
390−
391− ];
392−
393− meta = {
394− maintainers = with lib.maintainers; [ abbradar fpletz globin ];
395− #doc = ./acme.xml; ### CHANGED
396− };
397−}
default.nix−6
@@ -244,12 +244,6 @@ in rec {
244 imports = [
244 imports = [
245 (serverModules.mkBaseEc2 args)
245 (serverModules.mkBaseEc2 args)
246 (serverModules.mkObeliskApp args)
246 (serverModules.mkObeliskApp args)
247− ./acme.nix
248− ];
249− disabledModules = [
250− (pkgs.path + /nixos/modules/security/acme.nix)
251− ];
252− nixpkgs.overlays = [
253 ];
247 ];
254 };
248 };
255 };
249 };