diff options
| -rw-r--r-- | Makefile | 11 | ||||
| -rw-r--r-- | make/nginx.mk | 1 | ||||
| -rw-r--r-- | make/tls.mk | 81 | ||||
| -rw-r--r-- | mox/config/mox.conf | 16 | ||||
| -rw-r--r-- | nginx/http.d/static.conf.template | 4 |
5 files changed, 98 insertions, 15 deletions
@@ -17,19 +17,19 @@ endef define install_module_rule = .PHONY: install_$(module) -install_$(module): install_openrc_$(module) install_dyndns_$(module) $(install_submake_file) +install_$(module): install_openrc_$(module) install_dyndns_$(module) install_tls_$(module) $(install_submake_file) $(if $(install_submake_file),$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory=$(dir $(install_submake_file)) install) endef define reinstall_module_rule = .PHONY: reinstall_$(module) -reinstall_$(module): reinstall_openrc_$(module) reinstall_dyndns_$(module) $(install_submake_file) +reinstall_$(module): reinstall_openrc_$(module) reinstall_dyndns_$(module) reinstall_tls_$(module) $(install_submake_file) $(if $(install_submake_file),$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory=$(dir $(install_submake_file)) reinstall) endef define uninstall_module_rule = .PHONY: uninstall_$(module) -uninstall_$(module): uninstall_openrc_$(module) uninstall_dyndns_$(module) +uninstall_$(module): uninstall_openrc_$(module) uninstall_dyndns_$(module) uninstall_tls_$(module) $(if $(install_submake_file),\ $(MAKE) --makefile=$(notdir $(install_submake_file)) --directory $(dir $(install_submake_file)) uninstall ) @@ -45,10 +45,10 @@ $(foreach module,$(ALL_MODULES),$(eval $(call module_env_rule))) install: install_nginx $(ENV_RULES) $(INSTALL_RULES) install_crontab .PHONY: reinstall -reinstall: reinstall_nginx reinstall_dyndns $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab +reinstall: reinstall_nginx reinstall_dyndns reinstall_tls $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab .PHONY: uninstall -uninstall: uninstall_nginx uninstall_dyndns uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab +uninstall: uninstall_nginx uninstall_dyndns uninstall_tls uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab $(foreach module,$(ALL_MODULES),$(eval $(install_module_rule))) $(foreach module,$(ALL_MODULES),$(eval $(reinstall_module_rule))) @@ -63,3 +63,4 @@ include make/openrc.mk include make/nginx.mk include make/crontab.mk include make/dyndns.mk +include make/tls.mk diff --git a/make/nginx.mk b/make/nginx.mk index 5d8cef8..ebfbfd1 100644 --- a/make/nginx.mk +++ b/make/nginx.mk @@ -6,6 +6,7 @@ nginx_module_config_template = \ $(if $(PORT_$(module)),nginx/http.d/reverse_proxy.conf.template) \ $(if $(PUBLIC_ROOT_DIR_$(module)),nginx/http.d/static.conf.template) nginx_module_config_template_args = \ + CERTNAME=$(SUBDOMAIN_$(module)).joeac.net \ DOMAIN=$(if $(filter-out @,$(SUBDOMAIN_$(module))),$(SUBDOMAIN_$(module)).)joeac.net \ $(if $(PORT_$(module)),PORT=$(PORT_$(module)) HOST=$(HOST_$(module))) \ $(if $(PUBLIC_ROOT_DIR_$(module)),ROOT="$(PUBLIC_ROOT_DIR_$(module))") diff --git a/make/tls.mk b/make/tls.mk new file mode 100644 index 0000000..ff24604 --- /dev/null +++ b/make/tls.mk @@ -0,0 +1,81 @@ +installed_tls_crontabs = $(wildcard /etc/periodic/daily/tls-*.joeac.net) +installed_tls_crontab_subdomains = $(installed_tls_crontabs:/etc/periodic/daily/tls-%.joeac.net=%) +tls_crontab_subdomains_to_remove = $(filter-out $(SUBDOMAINS),$(installed_tls_crontab_subdomains)) +tls_crontabs_to_remove = $(tls_crontab_subdomains_to_remove:%=/etc/periodic/daily/tls-%.joeac.net) + +installed_tls_certs = $(wildcard /etc/letsencrypt/live/*.joeac.net) +installed_tls_cert_subdomains = $(installed_tls_certs:/etc/letsencrypt/live/%.joeac.net=%) +tls_cert_subdomains_to_delete = $(filter-out $(SUBDOMAINS),$(installed_tls_cert_subdomains)) + +tls_crontab = /etc/periodic/daily/tls-$(SUBDOMAIN_$(module)).joeac.net +tls_cert = /etc/letsencrypt/live/$(SUBDOMAIN_$(module)).joeac.net/fullchain.pem + +define install_tls_module_rule = +.PHONY: install_tls_$(module) +install_tls_module_$(module): $(if $(SUBDOMAIN_$(module)),$(tls_crontab) $(tls_cert)) +endef + +define reinstall_tls_module_rule = +.PHONY: reinstall_tls_$(module) +reinstall_tls_$(module): $(if $(SUBDOMAIN_$(module)),$(tls_crontab) renew_$(tls_cert)) +endef + +define uninstall_tls_module_rule = +.PHONY: uninstall_tls_$(module) +uninstall_tls_$(module): delete_cert_$(SUBDOMAIN_$(module)).joeac.net + $(if $(SUBDOMAIN_$(module)), \ + sudo rm -f $(tls_crontab) + ) +endef + +define obtain_or_renew_cert_cmd = +sudo certbot certonly + --nginx \ + --cert-name $(SUBDOMAIN_$(module)) \ + --domain $(subst @.,,$(SUBDOMAIN_$(module)).)joeac.net +endef + +is_cert_expired = $(shell sudo certbot certificates --cert-name $(SUBDOMAIN_$(module)).joeac.net \ + | grep "Expiry Date" | grep -E "(EXPIRED|REVOKED)") +define cert_rule = +$(tls_cert): + $(obtain_or_renew_cert_cmd) + +.PHONY: renew_$(tls_cert) +renew_$(tls_cert): + $(if $(is_cert_expired),$(obtain_or_renew_cert_cmd)) +endef + +$(foreach module,$(ALL_MODULES), $(eval $(install_tls_module_rule))) +$(foreach module,$(ALL_MODULES), $(eval $(reinstall_tls_module_rule))) +$(foreach module,$(ALL_MODULES), $(eval $(uninstall_tls_module_rule))) +$(foreach module,$(ALL_MODULES), $(eval $(cert_rule))) + +.PHONY: remove_/etc/periodic/daily/tls-%.joeac.net +remove_/etc/periodic/daily/tls-%.joeac.net: + rm -f $(@:remove_%=%) + +.PHONY: delete_cert_%.joeac.net +delete_cert_%.joeac.net: + sudo certbot delete --cert-name $(@:delete_cert_%=%) + +/etc/periodic/daily/tls-%joeac.net: + echo "#!/bin/sh" > crontab.tmp + echo "certbot renew --cert-name $(SUBDOMAIN_$(module)) --non-interactive" >> crontab.tmp + sudo mv crontab.tmp $@ + sudo chmod +x $@ + +.PHONY: reinstall_tls +reinstall_tls: $(addprefix remove_,$(tls_crontabs_to_remove)) $(addprefix delete_cert_,$(tls_cert_subdomains_to_delete)) $(foreach subdomain,$(installed_tls_cert_subdomains),renew_$(tls_cert)) + +.PHONY: uninstall_tls +uninstall_tls: $(foreach module,$(ALL_MODULES),$(uninstall_tls_$(module))) + +.PHONY: install_certbot +install_certbot: /usr/bin/certbot /usr/bin/python /usr/lib/$(shell ls /usr/bin | grep python[0-9]\\.)/certbot_nginx + +/usr/bin/certbot /usr/bin/python: + sudo apk add certbot + +/usr/lib/python%/certbot_nginx: + sudo apk add certbot-nginx diff --git a/mox/config/mox.conf b/mox/config/mox.conf index 1ca60ff..76c3ce7 100644 --- a/mox/config/mox.conf +++ b/mox/config/mox.conf @@ -48,17 +48,17 @@ Listeners: TLS: KeyCerts: - - CertFile: path/to/mail.joeac.net-chain.crt.pem - KeyFile: path/to/mail.joeac.net.key.pem + CertFile: /etc/letsencrypt/live/mail.joeac.net/fullchain.pem + KeyFile: /etc/letsencrypt/live/mail.joeac.net/privkey.pem - - CertFile: path/to/mta-sts.mail.joeac.net-chain.crt.pem - KeyFile: path/to/mta-sts.mail.joeac.net.key.pem + CertFile: /etc/letsencrypt/live/mta-sts.mail.joeac.net/fullchain.pem + KeyFile: /etc/letsencrypt/live/mta-sts.mail.joeac.net/privkey.pem - - CertFile: path/to/autoconfig.mail.joeac.net-chain.crt.pem - KeyFile: path/to/autoconfig.mail.joeac.net.key.pem + CertFile: /etc/letsencrypt/live/autoconfig.mail.joeac.net/fullchain.pem + KeyFile: /etc/letsencrypt/live/autoconfig.mail.joeac.net/privkey.pem - - CertFile: path/to/clientsettings.mail.joeac.net-chain.crt.pem - KeyFile: path/to/clientsettings.mail.joeac.net.key.pem + CertFile: /etc/letsencrypt/live/clientsettings.mail.joeac.net/fullchain.pem + KeyFile: /etc/letsencrypt/live/clientsettings.mail.joeac.net/privkey.pem SMTP: Enabled: true Submissions: diff --git a/nginx/http.d/static.conf.template b/nginx/http.d/static.conf.template index a25d94f..4f80be2 100644 --- a/nginx/http.d/static.conf.template +++ b/nginx/http.d/static.conf.template @@ -6,8 +6,8 @@ server { error_page 404 /index.html; } listen 443 ssl; - ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem; - ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem; + ssl_certificate /etc/letsencrypt/live/${CERTNAME}/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/${CERTNAME}/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; } |