2015-12-06 16:55:09 +01:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
|
|
|
2015-12-11 17:42:17 +01:00
|
|
|
cfg = config.security.acme;
|
2015-12-06 16:55:09 +01:00
|
|
|
|
2018-02-06 22:08:57 +01:00
|
|
|
certOpts = { name, ... }: {
|
2015-12-06 16:55:09 +01:00
|
|
|
options = {
|
|
|
|
webroot = mkOption {
|
2020-01-15 10:17:11 +01:00
|
|
|
type = types.nullOr types.str;
|
|
|
|
default = null;
|
2018-02-06 22:08:57 +01:00
|
|
|
example = "/var/lib/acme/acme-challenges";
|
2015-12-08 19:09:19 +01:00
|
|
|
description = ''
|
|
|
|
Where the webroot of the HTTP vhost is located.
|
|
|
|
<filename>.well-known/acme-challenge/</filename> directory
|
2017-06-08 08:46:40 +02:00
|
|
|
will be created below the webroot if it doesn't exist.
|
2015-12-08 19:09:19 +01:00
|
|
|
<literal>http://example.org/.well-known/acme-challenge/</literal> must also
|
|
|
|
be available (notice unencrypted HTTP).
|
|
|
|
'';
|
2015-12-06 16:55:09 +01:00
|
|
|
};
|
|
|
|
|
2019-10-26 00:40:51 +02:00
|
|
|
server = mkOption {
|
|
|
|
type = types.nullOr types.str;
|
|
|
|
default = null;
|
|
|
|
description = ''
|
|
|
|
ACME Directory Resource URI. Defaults to let's encrypt
|
|
|
|
production endpoint,
|
|
|
|
https://acme-v02.api.letsencrypt.org/directory, if unset.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2017-04-11 18:28:05 +02:00
|
|
|
domain = mkOption {
|
2018-02-06 22:08:57 +01:00
|
|
|
type = types.str;
|
|
|
|
default = name;
|
2017-04-11 18:28:05 +02:00
|
|
|
description = "Domain to fetch certificate for (defaults to the entry name)";
|
|
|
|
};
|
|
|
|
|
2015-12-06 16:55:09 +01:00
|
|
|
email = mkOption {
|
|
|
|
type = types.nullOr types.str;
|
2020-02-03 22:37:22 +01:00
|
|
|
default = cfg.email;
|
2015-12-06 16:55:09 +01:00
|
|
|
description = "Contact email address for the CA to be able to reach you.";
|
|
|
|
};
|
|
|
|
|
2015-12-08 19:09:19 +01:00
|
|
|
user = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
default = "root";
|
2015-12-11 17:42:17 +01:00
|
|
|
description = "User running the ACME client.";
|
2015-12-08 19:09:19 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
group = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
default = "root";
|
2015-12-11 17:42:17 +01:00
|
|
|
description = "Group running the ACME client.";
|
2015-12-08 19:09:19 +01:00
|
|
|
};
|
|
|
|
|
2016-01-06 02:59:14 +01:00
|
|
|
allowKeysForGroup = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
2017-06-08 08:46:40 +02:00
|
|
|
description = ''
|
|
|
|
Give read permissions to the specified group
|
2018-02-07 00:27:28 +01:00
|
|
|
(<option>security.acme.cert.<name>.group</option>) to read SSL private certificates.
|
2017-06-08 08:46:40 +02:00
|
|
|
'';
|
2016-01-06 02:59:14 +01:00
|
|
|
};
|
|
|
|
|
2015-12-08 19:09:19 +01:00
|
|
|
postRun = mkOption {
|
|
|
|
type = types.lines;
|
|
|
|
default = "";
|
|
|
|
example = "systemctl reload nginx.service";
|
|
|
|
description = ''
|
2017-11-19 16:41:28 +01:00
|
|
|
Commands to run after new certificates go live. Typically
|
2015-12-08 19:09:19 +01:00
|
|
|
the web server and other servers using certificates need to
|
|
|
|
be reloaded.
|
2017-11-19 16:41:28 +01:00
|
|
|
|
|
|
|
Executed in the same directory with the new certificate.
|
2015-12-08 19:09:19 +01:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2019-08-29 16:32:59 +02:00
|
|
|
directory = mkOption {
|
|
|
|
type = types.str;
|
|
|
|
readOnly = true;
|
|
|
|
default = "/var/lib/acme/${name}";
|
|
|
|
description = "Directory where certificate and other state is stored.";
|
2017-11-19 16:41:28 +01:00
|
|
|
};
|
|
|
|
|
2015-12-06 16:55:09 +01:00
|
|
|
extraDomains = mkOption {
|
2015-12-08 19:09:19 +01:00
|
|
|
type = types.attrsOf (types.nullOr types.str);
|
|
|
|
default = {};
|
2017-06-08 08:46:40 +02:00
|
|
|
example = literalExample ''
|
|
|
|
{
|
2020-04-29 21:31:17 +02:00
|
|
|
"example.org" = null;
|
2017-06-08 08:46:40 +02:00
|
|
|
"mydomain.org" = null;
|
|
|
|
}
|
|
|
|
'';
|
2015-12-08 19:09:19 +01:00
|
|
|
description = ''
|
2020-04-29 21:31:17 +02:00
|
|
|
A list of extra domain names, which are included in the one certificate to be issued.
|
|
|
|
Setting a distinct server root is deprecated and not functional in 20.03+
|
2015-12-08 19:09:19 +01:00
|
|
|
'';
|
2015-12-06 16:55:09 +01:00
|
|
|
};
|
2020-01-12 22:05:57 +01:00
|
|
|
|
2020-01-19 19:24:04 +01:00
|
|
|
keyType = mkOption {
|
|
|
|
type = types.str;
|
nixos/acme: change default keyType to ec256
Previously, the NixOS ACME module defaulted to using P-384 for
TLS certificates. I believe that this is a mistake, and that we
should use P-256 instead, despite it being theoretically
cryptographically weaker.
The security margin of a 256-bit elliptic curve cipher is substantial;
beyond a certain level, more bits in the key serve more to slow things
down than add meaningful protection. It's much more likely that ECDSA
will be broken entirely, or some fatal flaw will be found in the NIST
curves that makes them all insecure, than that the security margin
will be reduced enough to put P-256 at risk but not P-384. It's also
inconsistent to target a curve with a 192-bit security margin when our
recommended nginx TLS configuration allows 128-bit AES. [This Stack
Exchange answer][pornin] by cryptographer Thomas Pornin conveys the
general attitude among experts:
> Use P-256 to minimize trouble. If you feel that your manhood is
> threatened by using a 256-bit curve where a 384-bit curve is
> available, then use P-384: it will increases your computational and
> network costs (a factor of about 3 for CPU, a few extra dozen bytes
> on the network) but this is likely to be negligible in practice (in a
> SSL-powered Web server, the heavy cost is in "Web", not "SSL").
[pornin]: https://security.stackexchange.com/a/78624
While the NIST curves have many flaws (see [SafeCurves][safecurves]),
P-256 and P-384 are no different in this respect; SafeCurves gives
them the same rating. The only NIST curve Bernstein [thinks better of,
P-521][bernstein] (see "Other standard primes"), isn't usable for Web
PKI (it's [not supported by BoringSSL by default][boringssl] and hence
[doesn't work in Chromium/Chrome][chromium], and Let's Encrypt [don't
support it either][letsencrypt]).
[safecurves]: https://safecurves.cr.yp.to/
[bernstein]: https://blog.cr.yp.to/20140323-ecdsa.html
[boringssl]: https://boringssl.googlesource.com/boringssl/+/e9fc3e547e557492316932b62881c3386973ceb2
[chromium]: https://bugs.chromium.org/p/chromium/issues/detail?id=478225
[letsencrypt]: https://letsencrypt.org/docs/integration-guide/#supported-key-algorithms
So there's no real benefit to using P-384; what's the cost? In the
Stack Exchange answer I linked, Pornin estimates a factor of 3×
CPU usage, which wouldn't be so bad; unfortunately, this is wildly
optimistic in practice, as P-256 is much more common and therefore
much better optimized. [This GitHub comment][openssl] measures the
performance differential for raw Diffie-Hellman operations with OpenSSL
1.1.1 at a whopping 14× (even P-521 fares better!); [Caddy disables
P-384 by default][caddy] due to Go's [lack of accelerated assembly
implementations][crypto/elliptic] for it, and the difference there seems
even more extreme: [this golang-nuts post][golang-nuts] measures the key
generation performance differential at 275×. It's unlikely to be the
bottleneck for anyone, but I still feel kind of bad for anyone having
lego generate hundreds of certificates and sign challenges with them
with performance like that...
[openssl]: https://github.com/mozilla/server-side-tls/issues/190#issuecomment-421831599
[caddy]: https://github.com/caddyserver/caddy/blob/2cab475ba516fa725d012f53ca417c3e039607de/modules/caddytls/values.go#L113-L124
[crypto/elliptic]: https://github.com/golang/go/tree/2910c5b4a01a573ebc97744890a07c1a3122c67a/src/crypto/elliptic
[golang-nuts]: https://groups.google.com/forum/#!topic/golang-nuts/nlnJkBMMyzk
In conclusion, there's no real reason to use P-384 in general: if you
don't care about Web PKI compatibility and want to use a nicer curve,
then Ed25519 or P-521 are better options; if you're a NIST-fearing
paranoiac, you should use good old RSA; but if you're a normal person
running a web server, then you're best served by just using P-256. Right
now, NixOS makes an arbitrary decision between two equally-mediocre
curves that just so happens to slow down ECDH key agreement for every
TLS connection by over an order of magnitude; this commit fixes that.
Unfortunately, it seems like existing P-384 certificates won't get
migrated automatically on renewal without manual intervention, but
that's a more general problem with the existing ACME module (see #81634;
I know @yegortimoshenko is working on this). To migrate your
certificates manually, run:
$ sudo find /var/lib/acme/.lego/certificates -type f -delete
$ sudo find /var/lib/acme -name '*.pem' -delete
$ sudo systemctl restart 'acme-*.service' nginx.service
(No warranty. If it breaks, you get to keep both pieces. But it worked
for me.)
2020-03-22 06:27:20 +01:00
|
|
|
default = "ec256";
|
2020-01-19 19:24:04 +01:00
|
|
|
description = ''
|
|
|
|
Key type to use for private keys.
|
|
|
|
For an up to date list of supported values check the --key-type option
|
|
|
|
at https://go-acme.github.io/lego/usage/cli/#usage.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2020-01-12 22:05:57 +01:00
|
|
|
dnsProvider = mkOption {
|
|
|
|
type = types.nullOr types.str;
|
|
|
|
default = null;
|
2020-01-15 10:17:11 +01:00
|
|
|
example = "route53";
|
2020-01-19 19:24:04 +01:00
|
|
|
description = ''
|
|
|
|
DNS Challenge provider. For a list of supported providers, see the "code"
|
|
|
|
field of the DNS providers listed at https://go-acme.github.io/lego/dns/.
|
|
|
|
'';
|
2020-01-12 22:05:57 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
credentialsFile = mkOption {
|
2020-01-19 19:24:04 +01:00
|
|
|
type = types.path;
|
2020-01-12 22:05:57 +01:00
|
|
|
description = ''
|
2020-01-19 19:24:04 +01:00
|
|
|
Path to an EnvironmentFile for the cert's service containing any required and
|
|
|
|
optional environment variables for your selected dnsProvider.
|
|
|
|
To find out what values you need to set, consult the documentation at
|
|
|
|
https://go-acme.github.io/lego/dns/ for the corresponding dnsProvider.
|
2020-01-12 22:05:57 +01:00
|
|
|
'';
|
|
|
|
example = "/var/src/secrets/example.org-route53-api-token";
|
|
|
|
};
|
|
|
|
|
|
|
|
dnsPropagationCheck = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = true;
|
|
|
|
description = ''
|
2020-01-19 19:24:04 +01:00
|
|
|
Toggles lego DNS propagation check, which is used alongside DNS-01
|
|
|
|
challenge to ensure the DNS entries required are available.
|
2020-01-12 22:05:57 +01:00
|
|
|
'';
|
|
|
|
};
|
2020-02-23 02:51:19 +01:00
|
|
|
|
|
|
|
ocspMustStaple = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
|
|
|
description = ''
|
|
|
|
Turns on the OCSP Must-Staple TLS extension.
|
|
|
|
Make sure you know what you're doing! See:
|
|
|
|
<itemizedlist>
|
|
|
|
<listitem><para><link xlink:href="https://blog.apnic.net/2019/01/15/is-the-web-ready-for-ocsp-must-staple/" /></para></listitem>
|
|
|
|
<listitem><para><link xlink:href="https://blog.hboeck.de/archives/886-The-Problem-with-OCSP-Stapling-and-Must-Staple-and-why-Certificate-Revocation-is-still-broken.html" /></para></listitem>
|
|
|
|
</itemizedlist>
|
|
|
|
'';
|
|
|
|
};
|
2020-02-23 03:02:44 +01:00
|
|
|
|
2020-06-08 02:17:55 +02:00
|
|
|
extraLegoFlags = mkOption {
|
|
|
|
type = types.listOf types.str;
|
|
|
|
default = [];
|
|
|
|
description = ''
|
|
|
|
Additional global flags to pass to all lego commands.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2020-02-23 03:02:44 +01:00
|
|
|
extraLegoRenewFlags = mkOption {
|
|
|
|
type = types.listOf types.str;
|
|
|
|
default = [];
|
|
|
|
description = ''
|
|
|
|
Additional flags to pass to lego renew.
|
|
|
|
'';
|
|
|
|
};
|
2015-12-06 16:55:09 +01:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
in
|
|
|
|
|
|
|
|
{
|
|
|
|
|
|
|
|
###### interface
|
2019-10-26 00:40:51 +02:00
|
|
|
imports = [
|
|
|
|
(mkRemovedOptionModule [ "security" "acme" "production" ] ''
|
|
|
|
Use security.acme.server to define your staging ACME server URL instead.
|
|
|
|
|
|
|
|
To use the let's encrypt staging server, use security.acme.server =
|
|
|
|
"https://acme-staging-v02.api.letsencrypt.org/directory".
|
|
|
|
''
|
|
|
|
)
|
2019-12-10 02:51:19 +01:00
|
|
|
(mkRemovedOptionModule [ "security" "acme" "directory"] "ACME Directory is now hardcoded to /var/lib/acme and its permisisons are managed by systemd. See https://github.com/NixOS/nixpkgs/issues/53852 for more info.")
|
|
|
|
(mkRemovedOptionModule [ "security" "acme" "preDelay"] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")
|
|
|
|
(mkRemovedOptionModule [ "security" "acme" "activationDelay"] "This option has been removed. If you want to make sure that something executes before certificates are provisioned, add a RequiredBy=acme-\${cert}.service to the service you want to execute before the cert renewal")
|
2020-01-12 22:05:57 +01:00
|
|
|
(mkChangedOptionModule [ "security" "acme" "validMin"] [ "security" "acme" "validMinDays"] (config: config.security.acme.validMin / (24 * 3600)))
|
2019-10-26 00:40:51 +02:00
|
|
|
];
|
2015-12-06 16:55:09 +01:00
|
|
|
options = {
|
2015-12-11 17:42:17 +01:00
|
|
|
security.acme = {
|
2015-12-06 16:55:09 +01:00
|
|
|
|
2020-01-12 22:05:57 +01:00
|
|
|
validMinDays = mkOption {
|
2015-12-12 14:21:44 +01:00
|
|
|
type = types.int;
|
2020-01-12 22:05:57 +01:00
|
|
|
default = 30;
|
|
|
|
description = "Minimum remaining validity before renewal in days.";
|
|
|
|
};
|
|
|
|
|
|
|
|
email = mkOption {
|
|
|
|
type = types.nullOr types.str;
|
|
|
|
default = null;
|
|
|
|
description = "Contact email address for the CA to be able to reach you.";
|
2015-12-12 14:21:44 +01:00
|
|
|
};
|
|
|
|
|
|
|
|
renewInterval = mkOption {
|
|
|
|
type = types.str;
|
2020-02-23 02:46:46 +01:00
|
|
|
default = "daily";
|
2015-12-12 14:21:44 +01:00
|
|
|
description = ''
|
|
|
|
Systemd calendar expression when to check for renewal. See
|
|
|
|
<citerefentry><refentrytitle>systemd.time</refentrytitle>
|
2017-03-21 08:27:56 +01:00
|
|
|
<manvolnum>7</manvolnum></citerefentry>.
|
2015-12-12 14:21:44 +01:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2019-10-26 00:40:51 +02:00
|
|
|
server = mkOption {
|
|
|
|
type = types.nullOr types.str;
|
|
|
|
default = null;
|
|
|
|
description = ''
|
|
|
|
ACME Directory Resource URI. Defaults to let's encrypt
|
|
|
|
production endpoint,
|
|
|
|
<literal>https://acme-v02.api.letsencrypt.org/directory</literal>, if unset.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2016-06-01 12:39:46 +02:00
|
|
|
preliminarySelfsigned = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = true;
|
|
|
|
description = ''
|
|
|
|
Whether a preliminary self-signed certificate should be generated before
|
|
|
|
doing ACME requests. This can be useful when certificates are required in
|
|
|
|
a webserver, but ACME needs the webserver to make its requests.
|
|
|
|
|
|
|
|
With preliminary self-signed certificate the webserver can be started and
|
|
|
|
can later reload the correct ACME certificates.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2020-01-12 22:05:57 +01:00
|
|
|
acceptTerms = mkOption {
|
|
|
|
type = types.bool;
|
2020-01-19 19:24:04 +01:00
|
|
|
default = false;
|
2020-01-12 22:05:57 +01:00
|
|
|
description = ''
|
2020-01-19 19:24:04 +01:00
|
|
|
Accept the CA's terms of service. The default provier is Let's Encrypt,
|
|
|
|
you can find their ToS at https://letsencrypt.org/repository/
|
2020-01-12 22:05:57 +01:00
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2015-12-06 16:55:09 +01:00
|
|
|
certs = mkOption {
|
|
|
|
default = { };
|
2016-11-16 08:28:27 +01:00
|
|
|
type = with types; attrsOf (submodule certOpts);
|
2015-12-06 16:55:09 +01:00
|
|
|
description = ''
|
2019-08-29 16:32:59 +02:00
|
|
|
Attribute set of certificates to get signed and renewed. Creates
|
|
|
|
<literal>acme-''${cert}.{service,timer}</literal> systemd units for
|
|
|
|
each certificate defined here. Other services can add dependencies
|
|
|
|
to those units if they rely on the certificates being present,
|
|
|
|
or trigger restarts of the service if certificates get renewed.
|
2015-12-06 16:55:09 +01:00
|
|
|
'';
|
2017-06-08 08:46:40 +02:00
|
|
|
example = literalExample ''
|
|
|
|
{
|
|
|
|
"example.com" = {
|
|
|
|
webroot = "/var/www/challenges/";
|
|
|
|
email = "foo@example.com";
|
2020-05-02 01:07:50 +02:00
|
|
|
extraDomains = { "www.example.com" = null; "foo.example.com" = null; };
|
2017-06-08 08:46:40 +02:00
|
|
|
};
|
|
|
|
"bar.example.com" = {
|
|
|
|
webroot = "/var/www/challenges/";
|
|
|
|
email = "bar@example.com";
|
|
|
|
};
|
|
|
|
}
|
|
|
|
'';
|
2015-12-06 16:55:09 +01:00
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
###### implementation
|
2015-12-12 16:06:24 +01:00
|
|
|
config = mkMerge [
|
|
|
|
(mkIf (cfg.certs != { }) {
|
|
|
|
|
2020-01-12 22:05:57 +01:00
|
|
|
assertions = let
|
|
|
|
certs = (mapAttrsToList (k: v: v) cfg.certs);
|
|
|
|
in [
|
|
|
|
{
|
|
|
|
assertion = all (certOpts: certOpts.dnsProvider == null || certOpts.webroot == null) certs;
|
|
|
|
message = ''
|
|
|
|
Options `security.acme.certs.<name>.dnsProvider` and
|
|
|
|
`security.acme.certs.<name>.webroot` are mutually exclusive.
|
|
|
|
'';
|
|
|
|
}
|
|
|
|
{
|
|
|
|
assertion = cfg.email != null || all (certOpts: certOpts.email != null) certs;
|
|
|
|
message = ''
|
|
|
|
You must define `security.acme.certs.<name>.email` or
|
|
|
|
`security.acme.email` to register with the CA.
|
|
|
|
'';
|
|
|
|
}
|
2020-01-19 19:24:04 +01:00
|
|
|
{
|
|
|
|
assertion = cfg.acceptTerms;
|
|
|
|
message = ''
|
|
|
|
You must accept the CA's terms of service before using
|
|
|
|
the ACME module by setting `security.acme.acceptTerms`
|
|
|
|
to `true`. For Let's Encrypt's ToS see https://letsencrypt.org/repository/
|
|
|
|
'';
|
|
|
|
}
|
2020-01-12 22:05:57 +01:00
|
|
|
];
|
|
|
|
|
2016-06-01 12:39:46 +02:00
|
|
|
systemd.services = let
|
|
|
|
services = concatLists servicesLists;
|
|
|
|
servicesLists = mapAttrsToList certToServices cfg.certs;
|
|
|
|
certToServices = cert: data:
|
|
|
|
let
|
2020-01-12 22:05:57 +01:00
|
|
|
# StateDirectory must be relative, and will be created under /var/lib by systemd
|
2019-08-29 16:32:59 +02:00
|
|
|
lpath = "acme/${cert}";
|
2020-01-12 22:05:57 +01:00
|
|
|
apath = "/var/lib/${lpath}";
|
2020-02-14 03:14:42 +01:00
|
|
|
spath = "/var/lib/acme/.lego/${cert}";
|
2020-02-29 14:17:25 +01:00
|
|
|
fileMode = if data.allowKeysForGroup then "640" else "600";
|
2020-02-03 22:37:22 +01:00
|
|
|
globalOpts = [ "-d" data.domain "--email" data.email "--path" "." "--key-type" data.keyType ]
|
2020-01-12 22:05:57 +01:00
|
|
|
++ optionals (cfg.acceptTerms) [ "--accept-tos" ]
|
2020-01-15 10:17:11 +01:00
|
|
|
++ optionals (data.dnsProvider != null && !data.dnsPropagationCheck) [ "--dns.disable-cp" ]
|
2020-01-12 22:05:57 +01:00
|
|
|
++ concatLists (mapAttrsToList (name: root: [ "-d" name ]) data.extraDomains)
|
|
|
|
++ (if data.dnsProvider != null then [ "--dns" data.dnsProvider ] else [ "--http" "--http.webroot" data.webroot ])
|
2020-06-08 02:17:55 +02:00
|
|
|
++ optionals (cfg.server != null || data.server != null) ["--server" (if data.server == null then cfg.server else data.server)]
|
|
|
|
++ data.extraLegoFlags;
|
2020-02-23 02:51:19 +01:00
|
|
|
certOpts = optionals data.ocspMustStaple [ "--must-staple" ];
|
|
|
|
runOpts = escapeShellArgs (globalOpts ++ [ "run" ] ++ certOpts);
|
|
|
|
renewOpts = escapeShellArgs (globalOpts ++
|
|
|
|
[ "renew" "--days" (toString cfg.validMinDays) ] ++
|
2020-02-23 03:02:44 +01:00
|
|
|
certOpts ++ data.extraLegoRenewFlags);
|
2016-06-01 12:39:46 +02:00
|
|
|
acmeService = {
|
|
|
|
description = "Renew ACME Certificate for ${cert}";
|
2016-09-06 17:39:46 +02:00
|
|
|
after = [ "network.target" "network-online.target" ];
|
|
|
|
wants = [ "network-online.target" ];
|
2020-03-29 19:59:52 +02:00
|
|
|
wantedBy = mkIf (!config.boot.isContainer) [ "multi-user.target" ];
|
2016-06-01 12:39:46 +02:00
|
|
|
serviceConfig = {
|
|
|
|
Type = "oneshot";
|
|
|
|
User = data.user;
|
|
|
|
Group = data.group;
|
|
|
|
PrivateTmp = true;
|
2020-04-14 00:54:44 +02:00
|
|
|
StateDirectory = "acme/.lego/${cert} acme/.lego/accounts ${lpath}";
|
2020-02-29 14:17:25 +01:00
|
|
|
StateDirectoryMode = if data.allowKeysForGroup then "750" else "700";
|
2020-01-12 22:05:57 +01:00
|
|
|
WorkingDirectory = spath;
|
|
|
|
# Only try loading the credentialsFile if the dns challenge is enabled
|
|
|
|
EnvironmentFile = if data.dnsProvider != null then data.credentialsFile else null;
|
|
|
|
ExecStart = pkgs.writeScript "acme-start" ''
|
|
|
|
#!${pkgs.runtimeShell} -e
|
2020-04-14 00:54:44 +02:00
|
|
|
test -L ${spath}/accounts -o -d ${spath}/accounts || ln -s ../accounts ${spath}/accounts
|
2020-01-12 22:05:57 +01:00
|
|
|
${pkgs.lego}/bin/lego ${renewOpts} || ${pkgs.lego}/bin/lego ${runOpts}
|
|
|
|
'';
|
2019-12-19 18:34:22 +01:00
|
|
|
ExecStartPost =
|
2019-08-29 16:32:59 +02:00
|
|
|
let
|
2020-02-09 03:09:34 +01:00
|
|
|
keyName = builtins.replaceStrings ["*"] ["_"] data.domain;
|
2019-12-19 18:34:22 +01:00
|
|
|
script = pkgs.writeScript "acme-post-start" ''
|
2019-08-29 16:32:59 +02:00
|
|
|
#!${pkgs.runtimeShell} -e
|
2020-01-12 22:05:57 +01:00
|
|
|
cd ${apath}
|
|
|
|
|
|
|
|
# Test that existing cert is older than new cert
|
2020-02-09 03:09:34 +01:00
|
|
|
KEY=${spath}/certificates/${keyName}.key
|
2020-04-16 12:32:47 +02:00
|
|
|
KEY_CHANGED=no
|
2020-01-12 22:05:57 +01:00
|
|
|
if [ -e $KEY -a $KEY -nt key.pem ]; then
|
2020-04-16 12:32:47 +02:00
|
|
|
KEY_CHANGED=yes
|
2020-02-09 03:09:34 +01:00
|
|
|
cp -p ${spath}/certificates/${keyName}.key key.pem
|
2020-02-23 04:46:35 +01:00
|
|
|
cp -p ${spath}/certificates/${keyName}.crt fullchain.pem
|
2020-02-09 03:09:34 +01:00
|
|
|
cp -p ${spath}/certificates/${keyName}.issuer.crt chain.pem
|
2020-03-04 10:48:50 +01:00
|
|
|
ln -sf fullchain.pem cert.pem
|
2020-02-23 04:46:35 +01:00
|
|
|
cat key.pem fullchain.pem > full.pem
|
2020-01-12 22:05:57 +01:00
|
|
|
fi
|
|
|
|
|
2020-02-29 14:17:25 +01:00
|
|
|
chmod ${fileMode} *.pem
|
|
|
|
chown '${data.user}:${data.group}' *.pem
|
|
|
|
|
2020-04-16 12:32:47 +02:00
|
|
|
if [ "$KEY_CHANGED" = "yes" ]; then
|
|
|
|
: # noop in case postRun is empty
|
|
|
|
${data.postRun}
|
|
|
|
fi
|
2019-08-29 16:32:59 +02:00
|
|
|
'';
|
|
|
|
in
|
|
|
|
"+${script}";
|
2016-06-01 12:39:46 +02:00
|
|
|
};
|
2019-08-29 16:32:59 +02:00
|
|
|
|
2017-11-19 16:41:28 +01:00
|
|
|
};
|
2016-06-01 12:39:46 +02:00
|
|
|
selfsignedService = {
|
|
|
|
description = "Create preliminary self-signed certificate for ${cert}";
|
2018-04-03 11:09:45 +02:00
|
|
|
path = [ pkgs.openssl ];
|
2018-04-29 19:30:09 +02:00
|
|
|
script =
|
2016-06-01 12:39:46 +02:00
|
|
|
''
|
2018-04-03 11:09:45 +02:00
|
|
|
workdir="$(mktemp -d)"
|
|
|
|
|
|
|
|
# Create CA
|
2018-05-24 00:52:05 +02:00
|
|
|
openssl genrsa -des3 -passout pass:xxxx -out $workdir/ca.pass.key 2048
|
|
|
|
openssl rsa -passin pass:xxxx -in $workdir/ca.pass.key -out $workdir/ca.key
|
2018-04-03 11:09:45 +02:00
|
|
|
openssl req -new -key $workdir/ca.key -out $workdir/ca.csr \
|
|
|
|
-subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=Security Department/CN=example.com"
|
|
|
|
openssl x509 -req -days 1 -in $workdir/ca.csr -signkey $workdir/ca.key -out $workdir/ca.crt
|
|
|
|
|
|
|
|
# Create key
|
2018-05-24 00:52:05 +02:00
|
|
|
openssl genrsa -des3 -passout pass:xxxx -out $workdir/server.pass.key 2048
|
|
|
|
openssl rsa -passin pass:xxxx -in $workdir/server.pass.key -out $workdir/server.key
|
2018-04-03 11:09:45 +02:00
|
|
|
openssl req -new -key $workdir/server.key -out $workdir/server.csr \
|
2016-06-01 12:39:46 +02:00
|
|
|
-subj "/C=UK/ST=Warwickshire/L=Leamington/O=OrgName/OU=IT Department/CN=example.com"
|
2018-04-03 11:09:45 +02:00
|
|
|
openssl x509 -req -days 1 -in $workdir/server.csr -CA $workdir/ca.crt \
|
|
|
|
-CAkey $workdir/ca.key -CAserial $workdir/ca.srl -CAcreateserial \
|
|
|
|
-out $workdir/server.crt
|
2016-06-01 12:39:46 +02:00
|
|
|
|
2018-04-03 11:09:45 +02:00
|
|
|
# Copy key to destination
|
2020-01-12 22:05:57 +01:00
|
|
|
cp $workdir/server.key ${apath}/key.pem
|
2016-06-01 12:39:46 +02:00
|
|
|
|
2018-04-03 11:09:45 +02:00
|
|
|
# Create fullchain.pem (same format as "simp_le ... -f fullchain.pem" creates)
|
2020-01-12 22:05:57 +01:00
|
|
|
cat $workdir/{server.crt,ca.crt} > "${apath}/fullchain.pem"
|
2017-06-07 21:38:01 +02:00
|
|
|
|
2018-04-03 11:09:45 +02:00
|
|
|
# Create full.pem for e.g. lighttpd
|
2020-01-12 22:05:57 +01:00
|
|
|
cat $workdir/{server.key,server.crt,ca.crt} > "${apath}/full.pem"
|
2016-06-01 12:39:46 +02:00
|
|
|
|
|
|
|
# Give key acme permissions
|
2020-01-12 22:05:57 +01:00
|
|
|
chown '${data.user}:${data.group}' "${apath}/"{key,fullchain,full}.pem
|
2020-02-29 14:17:25 +01:00
|
|
|
chmod ${fileMode} "${apath}/"{key,fullchain,full}.pem
|
2016-06-01 12:39:46 +02:00
|
|
|
'';
|
|
|
|
serviceConfig = {
|
|
|
|
Type = "oneshot";
|
2018-04-03 11:09:45 +02:00
|
|
|
PrivateTmp = true;
|
2019-08-29 16:32:59 +02:00
|
|
|
StateDirectory = lpath;
|
2016-06-01 12:39:46 +02:00
|
|
|
User = data.user;
|
|
|
|
Group = data.group;
|
|
|
|
};
|
|
|
|
unitConfig = {
|
|
|
|
# Do not create self-signed key when key already exists
|
2020-01-12 22:05:57 +01:00
|
|
|
ConditionPathExists = "!${apath}/key.pem";
|
2016-06-01 12:39:46 +02:00
|
|
|
};
|
|
|
|
};
|
|
|
|
in (
|
|
|
|
[ { name = "acme-${cert}"; value = acmeService; } ]
|
2017-11-19 16:41:28 +01:00
|
|
|
++ optional cfg.preliminarySelfsigned { name = "acme-selfsigned-${cert}"; value = selfsignedService; }
|
2016-06-01 12:39:46 +02:00
|
|
|
);
|
|
|
|
servicesAttr = listToAttrs services;
|
|
|
|
in
|
2019-08-29 16:32:59 +02:00
|
|
|
servicesAttr;
|
|
|
|
|
|
|
|
systemd.tmpfiles.rules =
|
2020-01-15 10:17:11 +01:00
|
|
|
map (data: "d ${data.webroot}/.well-known/acme-challenge - ${data.user} ${data.group}") (filter (data: data.webroot != null) (attrValues cfg.certs));
|
2015-12-12 16:06:24 +01:00
|
|
|
|
2020-02-23 02:46:46 +01:00
|
|
|
systemd.timers = let
|
|
|
|
# Allow systemd to pick a convenient time within the day
|
|
|
|
# to run the check.
|
|
|
|
# This allows the coalescing of multiple timer jobs.
|
|
|
|
# We divide by the number of certificates so that if you
|
|
|
|
# have many certificates, the renewals are distributed over
|
|
|
|
# the course of the day to avoid rate limits.
|
|
|
|
numCerts = length (attrNames cfg.certs);
|
|
|
|
_24hSecs = 60 * 60 * 24;
|
|
|
|
AccuracySec = "${toString (_24hSecs / numCerts)}s";
|
|
|
|
in flip mapAttrs' cfg.certs (cert: data: nameValuePair
|
2015-12-12 16:06:24 +01:00
|
|
|
("acme-${cert}")
|
|
|
|
({
|
2016-04-18 11:52:31 +02:00
|
|
|
description = "Renew ACME Certificate for ${cert}";
|
2015-12-12 16:06:24 +01:00
|
|
|
wantedBy = [ "timers.target" ];
|
|
|
|
timerConfig = {
|
|
|
|
OnCalendar = cfg.renewInterval;
|
2015-12-13 14:53:59 +01:00
|
|
|
Unit = "acme-${cert}.service";
|
2016-08-10 19:37:11 +02:00
|
|
|
Persistent = "yes";
|
2020-02-23 02:46:46 +01:00
|
|
|
inherit AccuracySec;
|
|
|
|
# Skew randomly within the day, per https://letsencrypt.org/docs/integration-guide/.
|
|
|
|
RandomizedDelaySec = "24h";
|
2015-12-12 16:06:24 +01:00
|
|
|
};
|
|
|
|
})
|
|
|
|
);
|
2016-06-01 12:39:46 +02:00
|
|
|
|
2019-08-13 23:52:01 +02:00
|
|
|
systemd.targets.acme-selfsigned-certificates = mkIf cfg.preliminarySelfsigned {};
|
|
|
|
systemd.targets.acme-certificates = {};
|
2015-12-12 16:06:24 +01:00
|
|
|
})
|
|
|
|
|
|
|
|
];
|
2015-12-06 16:55:09 +01:00
|
|
|
|
2016-05-09 07:53:27 +02:00
|
|
|
meta = {
|
2020-04-20 02:36:13 +02:00
|
|
|
maintainers = lib.teams.acme.members;
|
2016-05-09 07:53:27 +02:00
|
|
|
doc = ./acme.xml;
|
|
|
|
};
|
2015-12-06 16:55:09 +01:00
|
|
|
}
|