@@ -7,6 +7,11 @@ let
77 numCerts = length (builtins.attrNames cfg.certs);
88 _24hSecs = 60 * 60 * 24;
99
10+ # Used to make unique paths for each cert/account config set
11+ mkHash = with builtins; val: substring 0 20 (hashString "sha256" val);
12+ mkAccountHash = acmeServer: data: mkHash "${toString acmeServer} ${data.keyType} ${data.email}";
13+ accountDirRoot = "/var/lib/acme/.lego/accounts/";
14+
1015 # There are many services required to make cert renewals work.
1116 # They all follow a common structure:
1217 # - They inherit this commonServiceConfig
@@ -19,7 +24,7 @@ let
1924 Type = "oneshot";
2025 User = "acme";
2126 Group = mkDefault "acme";
22− UMask = 0027;
27+ UMask = 0023;
2328 StateDirectoryMode = 750;
2429 ProtectSystem = "full";
2530 PrivateTmp = true;
@@ -54,23 +59,35 @@ let
5459 '';
5560 };
5661
57− # Previously, all certs were owned by whatever user was configured in
58− # config.security.acme.certs.<cert>.user. Now everything is owned by and
59− # run by the acme user.
60− userMigrationService = {
61− description = "Fix owner and group of all ACME certificates";
62−
63− script = with builtins; concatStringsSep "\n" (mapAttrsToList (cert: data: ''
64− for fixpath in /var/lib/acme/${escapeShellArg cert} /var/lib/acme/.lego/${escapeShellArg cert}; do
62+ # Ensures that directories which are shared across all certs
63+ # exist and have the correct user and group, since group
64+ # is configurable on a per-cert basis.
65+ userMigrationService = let
66+ script = with builtins; ''
67+ chown -R acme .lego/accounts
68+ '' + (concatStringsSep "\n" (mapAttrsToList (cert: data: ''
69+ for fixpath in ${escapeShellArg cert} .lego/${escapeShellArg cert}; do
6570 if [ -d "$fixpath" ]; then
6671 chmod -R u=rwX,g=rX,o= "$fixpath"
6772 chown -R acme:${data.group} "$fixpath"
6873 fi
6974 done
70− '') certConfigs);
75+ '') certConfigs));
76+ in {
77+ description = "Fix owner and group of all ACME certificates";
7178
72− # We don't want this to run every time a renewal happens
73− serviceConfig.RemainAfterExit = true;
79+ serviceConfig = commonServiceConfig // {
80+ # We don't want this to run every time a renewal happens
81+ RemainAfterExit = true;
82+
83+ # These StateDirectory entries negate the need for tmpfiles
84+ StateDirectory = [ "acme" "acme/.lego" "acme/.lego/accounts" ];
85+ StateDirectoryMode = 755;
86+ WorkingDirectory = "/var/lib/acme";
87+
88+ # Run the start script as root
89+ ExecStart = "+" + (pkgs.writeShellScript "acme-fixperms" script);
90+ };
7491 };
7592
7693 certToConfig = cert: data: let
@@ -101,11 +118,10 @@ let
101118 ${toString acmeServer} ${toString data.dnsProvider}
102119 ${toString data.ocspMustStaple} ${data.keyType}
103120 '';
104− mkHash = with builtins; val: substring 0 20 (hashString "sha256" val);
105121 certDir = mkHash hashData;
106122 domainHash = mkHash "${concatStringsSep " " extraDomains} ${data.domain}";
107− othersHash = mkHash "${toString acmeServer} ${data.keyType} ${data.email}";
108− accountDir = "/var/lib/acme/.lego/accounts/" + othersHash;
123+ accountHash = (mkAccountHash acmeServer data);
124+ accountDir = accountDirRoot + accountHash;
109125
110126 protocolOpts = if useDns then (
111127 [ "--dns" data.dnsProvider ]
@@ -142,9 +158,8 @@ let
142158 );
143159
144160 in {
145− inherit accountDir selfsignedDeps;
161+ inherit accountHash cert selfsignedDeps;
146162
147− webroot = data.webroot;
148163 group = data.group;
149164
150165 renewTimer = {
@@ -184,7 +199,10 @@ let
184199
185200 StateDirectory = "acme/${cert}";
186201
187− BindPaths = "/var/lib/acme/.minica:/tmp/ca /var/lib/acme/${cert}:/tmp/${keyName}";
202+ BindPaths = [
203+ "/var/lib/acme/.minica:/tmp/ca"
204+ "/var/lib/acme/${cert}:/tmp/${keyName}"
205+ ];
188206 };
189207
190208 # Working directory will be /tmp
@@ -222,16 +240,22 @@ let
222240 serviceConfig = commonServiceConfig // {
223241 Group = data.group;
224242
225− # AccountDir dir will be created by tmpfiles to ensure correct permissions
226− # And to avoid deletion during systemctl clean
227− # acme/.lego/${cert} is listed so that it is deleted during systemctl clean
228− StateDirectory = "acme/${cert} acme/.lego/${cert} acme/.lego/${cert}/${certDir}";
243+ # Keep in mind that these directories will be deleted if the user runs
244+ # systemctl clean --what=state
245+ # acme/.lego/${cert} is listed for this reason.
246+ StateDirectory = [
247+ "acme/${cert}"
248+ "acme/.lego/${cert}"
249+ "acme/.lego/${cert}/${certDir}"
250+ "acme/.lego/accounts/${accountHash}"
251+ ];
229252
230253 # Needs to be space separated, but can't use a multiline string because that'll include newlines
231− BindPaths =
232− "${accountDir}:/tmp/accounts " +
233− "/var/lib/acme/${cert}:/tmp/out " +
234− "/var/lib/acme/.lego/${cert}/${certDir}:/tmp/certificates ";
254+ BindPaths = [
255+ "${accountDir}:/tmp/accounts"
256+ "/var/lib/acme/${cert}:/tmp/out"
257+ "/var/lib/acme/.lego/${cert}/${certDir}:/tmp/certificates"
258+ ];
235259
236260 # Only try loading the credentialsFile if the dns challenge is enabled
237261 EnvironmentFile = mkIf useDns data.credentialsFile;
@@ -248,13 +272,18 @@ let
248272
249273 # Working directory will be /tmp
250274 script = ''
251− set -euo pipefail
275+ set -euxo pipefail
276+
277+ ${optionalString (data.webroot != null) ''
278+ # Ensure the webroot exists
279+ mkdir -p '${data.webroot}/.well-known/acme-challenge'
280+ chown 'acme:${data.group}' ${data.webroot}/{.well-known,.well-known/acme-challenge}
281+ ''}
252282
253283 echo '${domainHash}' > domainhash.txt
254284
255285 # Check if we can renew
256− # Certificates and account credentials must exist
257− if [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a "$(ls -1 accounts)" ]; then
286+ if [ -e 'certificates/${keyName}.key' -a -e 'certificates/${keyName}.crt' -a -n "$(ls -1 accounts)" ]; then
258287
259288 # When domains are updated, there's no need to do a full
260289 # Lego run, but it's likely renew won't work if days is too low.
@@ -664,21 +693,33 @@ in {
664693
665694 systemd.timers = mapAttrs' (cert: conf: nameValuePair "acme-${cert}" conf.renewTimer) certConfigs;
666695
667− # .lego and .lego/accounts specified to fix any incorrect permissions
668− systemd.tmpfiles.rules = [
669− "d /var/lib/acme/.lego - acme acme"
670− "d /var/lib/acme/.lego/accounts - acme acme"
671− ] ++ (unique (concatMap (conf: [
672− "d ${conf.accountDir} - acme acme"
673− ] ++ (optional (conf.webroot != null) "d ${conf.webroot}/.well-known/acme-challenge - acme ${conf.group}")
674− ) (attrValues certConfigs)));
675−
676− # Create some targets which can be depended on to be "active" after cert renewals
677− systemd.targets = mapAttrs' (cert: conf: nameValuePair "acme-finished-${cert}" {
678− wantedBy = [ "default.target" ];
679− requires = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps;
680− after = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps;
681− }) certConfigs;
696+ systemd.targets = let
697+ # Create some targets which can be depended on to be "active" after cert renewals
698+ finishedTargets = mapAttrs' (cert: conf: nameValuePair "acme-finished-${cert}" {
699+ wantedBy = [ "default.target" ];
700+ requires = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps;
701+ after = [ "acme-${cert}.service" ] ++ conf.selfsignedDeps;
702+ }) certConfigs;
703+
704+ # Create targets to limit the number of simultaneous account creations
705+ # How it works:
706+ # - Pick a "leader" cert service, which will be in charge of creating the account,
707+ # and run first (requires + after)
708+ # - Make all other cert services sharing the same account wait for the leader to
709+ # finish before starting (requiredBy + before).
710+ # Using a target here is fine - account creation is a one time event. Even if
711+ # systemd clean --what=state is used to delete the account, so long as the user
712+ # then runs one of the cert services, there won't be any issues.
713+ accountTargets = mapAttrs' (hash: confs: let
714+ leader = "acme-${(builtins.head confs).cert}.service";
715+ dependantServices = map (conf: "acme-${conf.cert}.service") (builtins.tail confs);
716+ in nameValuePair "acme-account-${hash}" {
717+ requiredBy = dependantServices;
718+ before = dependantServices;
719+ requires = [ leader ];
720+ after = [ leader ];
721+ }) (groupBy (conf: conf.accountHash) (attrValues certConfigs));
722+ in finishedTargets // accountTargets;
682723 })
683724 ];
684725