joeac/joeac.net
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

tls.mk

Browse Source
This commit is contained in:
Joe Carstairs
2026-07-07 09:10:34 +01:00
parent 4a2b27f54a
commit 07fa302d43
5 changed files with 98 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile
+6 -5
View File
@@ -17,19 +17,19 @@ endef
define install_module_rule =
.PHONY: install_$(module)
install_$(module): install_openrc_$(module) install_dyndns_$(module) $(install_submake_file)
install_$(module): install_openrc_$(module) install_dyndns_$(module) install_tls_$(module) $(install_submake_file)
$(if $(install_submake_file),$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory=$(dir $(install_submake_file)) install)
endef
define reinstall_module_rule =
.PHONY: reinstall_$(module)
reinstall_$(module): reinstall_openrc_$(module) reinstall_dyndns_$(module) $(install_submake_file)
reinstall_$(module): reinstall_openrc_$(module) reinstall_dyndns_$(module) reinstall_tls_$(module) $(install_submake_file)
$(if $(install_submake_file),$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory=$(dir $(install_submake_file)) reinstall)
endef
define uninstall_module_rule =
.PHONY: uninstall_$(module)
uninstall_$(module): uninstall_openrc_$(module) uninstall_dyndns_$(module)
uninstall_$(module): uninstall_openrc_$(module) uninstall_dyndns_$(module) uninstall_tls_$(module)
$(if $(install_submake_file),\
$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory $(dir $(install_submake_file)) uninstall
)
@@ -45,10 +45,10 @@ $(foreach module,$(ALL_MODULES),$(eval $(call module_env_rule)))
install: install_nginx $(ENV_RULES) $(INSTALL_RULES) install_crontab
.PHONY: reinstall
reinstall: reinstall_nginx reinstall_dyndns $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab
reinstall: reinstall_nginx reinstall_dyndns reinstall_tls $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab
.PHONY: uninstall
uninstall: uninstall_nginx uninstall_dyndns uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab
uninstall: uninstall_nginx uninstall_dyndns uninstall_tls uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab
$(foreach module,$(ALL_MODULES),$(eval $(install_module_rule)))
$(foreach module,$(ALL_MODULES),$(eval $(reinstall_module_rule)))
@@ -63,3 +63,4 @@ include make/openrc.mk
include make/nginx.mk
include make/crontab.mk
include make/dyndns.mk
include make/tls.mk
make/nginx.mk
+1
View File
@@ -6,6 +6,7 @@ nginx_module_config_template = \
$(if $(PORT_$(module)),nginx/http.d/reverse_proxy.conf.template) \
$(if $(PUBLIC_ROOT_DIR_$(module)),nginx/http.d/static.conf.template)
nginx_module_config_template_args = \
CERTNAME=$(SUBDOMAIN_$(module)).joeac.net \
DOMAIN=$(if $(filter-out @,$(SUBDOMAIN_$(module))),$(SUBDOMAIN_$(module)).)joeac.net \
$(if $(PORT_$(module)),PORT=$(PORT_$(module)) HOST=$(HOST_$(module))) \
$(if $(PUBLIC_ROOT_DIR_$(module)),ROOT="$(PUBLIC_ROOT_DIR_$(module))")
make/tls.mk
+81
View File
@@ -0,0 +1,81 @@
installed_tls_crontabs = $(wildcard /etc/periodic/daily/tls-*.joeac.net)
installed_tls_crontab_subdomains = $(installed_tls_crontabs:/etc/periodic/daily/tls-%.joeac.net=%)
tls_crontab_subdomains_to_remove = $(filter-out $(SUBDOMAINS),$(installed_tls_crontab_subdomains))
tls_crontabs_to_remove = $(tls_crontab_subdomains_to_remove:%=/etc/periodic/daily/tls-%.joeac.net)
installed_tls_certs = $(wildcard /etc/letsencrypt/live/*.joeac.net)
installed_tls_cert_subdomains = $(installed_tls_certs:/etc/letsencrypt/live/%.joeac.net=%)
tls_cert_subdomains_to_delete = $(filter-out $(SUBDOMAINS),$(installed_tls_cert_subdomains))
tls_crontab = /etc/periodic/daily/tls-$(SUBDOMAIN_$(module)).joeac.net
tls_cert = /etc/letsencrypt/live/$(SUBDOMAIN_$(module)).joeac.net/fullchain.pem
define install_tls_module_rule =
.PHONY: install_tls_$(module)
install_tls_module_$(module): $(if $(SUBDOMAIN_$(module)),$(tls_crontab) $(tls_cert))
endef
define reinstall_tls_module_rule =
.PHONY: reinstall_tls_$(module)
reinstall_tls_$(module): $(if $(SUBDOMAIN_$(module)),$(tls_crontab) renew_$(tls_cert))
endef
define uninstall_tls_module_rule =
.PHONY: uninstall_tls_$(module)
uninstall_tls_$(module): delete_cert_$(SUBDOMAIN_$(module)).joeac.net
$(if $(SUBDOMAIN_$(module)), \
sudo rm -f $(tls_crontab)
)
endef
define obtain_or_renew_cert_cmd =
sudo certbot certonly
--nginx \
--cert-name $(SUBDOMAIN_$(module)) \
--domain $(subst @.,,$(SUBDOMAIN_$(module)).)joeac.net
endef
is_cert_expired = $(shell sudo certbot certificates --cert-name $(SUBDOMAIN_$(module)).joeac.net \
| grep "Expiry Date" | grep -E "(EXPIRED|REVOKED)")
define cert_rule =
$(tls_cert):
$(obtain_or_renew_cert_cmd)
.PHONY: renew_$(tls_cert)
renew_$(tls_cert):
$(if $(is_cert_expired),$(obtain_or_renew_cert_cmd))
endef
$(foreach module,$(ALL_MODULES), $(eval $(install_tls_module_rule)))
$(foreach module,$(ALL_MODULES), $(eval $(reinstall_tls_module_rule)))
$(foreach module,$(ALL_MODULES), $(eval $(uninstall_tls_module_rule)))
$(foreach module,$(ALL_MODULES), $(eval $(cert_rule)))
.PHONY: remove_/etc/periodic/daily/tls-%.joeac.net
remove_/etc/periodic/daily/tls-%.joeac.net:
rm -f $(@:remove_%=%)
.PHONY: delete_cert_%.joeac.net
delete_cert_%.joeac.net:
sudo certbot delete --cert-name $(@:delete_cert_%=%)
/etc/periodic/daily/tls-%joeac.net:
echo "#!/bin/sh" > crontab.tmp
echo "certbot renew --cert-name $(SUBDOMAIN_$(module)) --non-interactive" >> crontab.tmp
sudo mv crontab.tmp $@
sudo chmod +x $@
.PHONY: reinstall_tls
reinstall_tls: $(addprefix remove_,$(tls_crontabs_to_remove)) $(addprefix delete_cert_,$(tls_cert_subdomains_to_delete)) $(foreach subdomain,$(installed_tls_cert_subdomains),renew_$(tls_cert))
.PHONY: uninstall_tls
uninstall_tls: $(foreach module,$(ALL_MODULES),$(uninstall_tls_$(module)))
.PHONY: install_certbot
install_certbot: /usr/bin/certbot /usr/bin/python /usr/lib/$(shell ls /usr/bin | grep python[0-9]\\.)/certbot_nginx
/usr/bin/certbot /usr/bin/python:
sudo apk add certbot
/usr/lib/python%/certbot_nginx:
sudo apk add certbot-nginx
mox/config/mox.conf
+8 -8
View File
@@ -48,17 +48,17 @@ Listeners:
TLS:
KeyCerts:
-
CertFile: path/to/mail.joeac.net-chain.crt.pem
KeyFile: path/to/mail.joeac.net.key.pem
CertFile: /etc/letsencrypt/live/mail.joeac.net/fullchain.pem
KeyFile: /etc/letsencrypt/live/mail.joeac.net/privkey.pem
-
CertFile: path/to/mta-sts.mail.joeac.net-chain.crt.pem
KeyFile: path/to/mta-sts.mail.joeac.net.key.pem
CertFile: /etc/letsencrypt/live/mta-sts.mail.joeac.net/fullchain.pem
KeyFile: /etc/letsencrypt/live/mta-sts.mail.joeac.net/privkey.pem
-
CertFile: path/to/autoconfig.mail.joeac.net-chain.crt.pem
KeyFile: path/to/autoconfig.mail.joeac.net.key.pem
CertFile: /etc/letsencrypt/live/autoconfig.mail.joeac.net/fullchain.pem
KeyFile: /etc/letsencrypt/live/autoconfig.mail.joeac.net/privkey.pem
-
CertFile: path/to/clientsettings.mail.joeac.net-chain.crt.pem
KeyFile: path/to/clientsettings.mail.joeac.net.key.pem
CertFile: /etc/letsencrypt/live/clientsettings.mail.joeac.net/fullchain.pem
KeyFile: /etc/letsencrypt/live/clientsettings.mail.joeac.net/privkey.pem
SMTP:
Enabled: true
Submissions:
nginx/http.d/static.conf.template
+2 -2
View File
@@ -6,8 +6,8 @@ server {
error_page 404 /index.html;
}
listen 443 ssl;
ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
ssl_certificate /etc/letsencrypt/live/${CERTNAME}/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/${CERTNAME}/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}