tls.mk

Makefile

@@ -17,19 +17,19 @@ endef
 
 define install_module_rule =
 .PHONY: install_$(module)
-install_$(module): install_openrc_$(module) install_dyndns_$(module) $(install_submake_file)
+install_$(module): install_openrc_$(module) install_dyndns_$(module) install_tls_$(module) $(install_submake_file)
 	$(if $(install_submake_file),$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory=$(dir $(install_submake_file)) install)
 endef
 
 define reinstall_module_rule =
 .PHONY: reinstall_$(module)
-reinstall_$(module): reinstall_openrc_$(module) reinstall_dyndns_$(module) $(install_submake_file)
+reinstall_$(module): reinstall_openrc_$(module) reinstall_dyndns_$(module) reinstall_tls_$(module) $(install_submake_file)
 	$(if $(install_submake_file),$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory=$(dir $(install_submake_file)) reinstall)
 endef
 
 define uninstall_module_rule =
 .PHONY: uninstall_$(module)
-uninstall_$(module): uninstall_openrc_$(module) uninstall_dyndns_$(module)
+uninstall_$(module): uninstall_openrc_$(module) uninstall_dyndns_$(module) uninstall_tls_$(module)
 	$(if $(install_submake_file),\
 		$(MAKE) --makefile=$(notdir $(install_submake_file)) --directory $(dir $(install_submake_file)) uninstall
 	)
@@ -45,10 +45,10 @@ $(foreach module,$(ALL_MODULES),$(eval $(call module_env_rule)))
 install: install_nginx $(ENV_RULES) $(INSTALL_RULES) install_crontab
 
 .PHONY: reinstall
-reinstall: reinstall_nginx reinstall_dyndns $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab
+reinstall: reinstall_nginx reinstall_dyndns reinstall_tls $(ENV_RULES) $(REINSTALL_RULES) reinstall_crontab
 
 .PHONY: uninstall
-uninstall: uninstall_nginx uninstall_dyndns uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab
+uninstall: uninstall_nginx uninstall_dyndns uninstall_tls uninstall_joeac.net_service $(UNINSTALL_RULES) uninstall_crontab
 
 $(foreach module,$(ALL_MODULES),$(eval $(install_module_rule)))
 $(foreach module,$(ALL_MODULES),$(eval $(reinstall_module_rule)))
@@ -63,3 +63,4 @@ include make/openrc.mk
 include make/nginx.mk
 include make/crontab.mk
 include make/dyndns.mk
+include make/tls.mk

make/nginx.mk

@@ -6,6 +6,7 @@ nginx_module_config_template = \
 	$(if $(PORT_$(module)),nginx/http.d/reverse_proxy.conf.template) \
 	$(if $(PUBLIC_ROOT_DIR_$(module)),nginx/http.d/static.conf.template)
 nginx_module_config_template_args = \
+	CERTNAME=$(SUBDOMAIN_$(module)).joeac.net \
 	DOMAIN=$(if $(filter-out @,$(SUBDOMAIN_$(module))),$(SUBDOMAIN_$(module)).)joeac.net \
 	$(if $(PORT_$(module)),PORT=$(PORT_$(module)) HOST=$(HOST_$(module))) \
 	$(if $(PUBLIC_ROOT_DIR_$(module)),ROOT="$(PUBLIC_ROOT_DIR_$(module))")

make/tls.mk

@@ -0,0 +1,81 @@
+installed_tls_crontabs = $(wildcard /etc/periodic/daily/tls-*.joeac.net)
+installed_tls_crontab_subdomains = $(installed_tls_crontabs:/etc/periodic/daily/tls-%.joeac.net=%)
+tls_crontab_subdomains_to_remove = $(filter-out $(SUBDOMAINS),$(installed_tls_crontab_subdomains))
+tls_crontabs_to_remove = $(tls_crontab_subdomains_to_remove:%=/etc/periodic/daily/tls-%.joeac.net)
+
+installed_tls_certs = $(wildcard /etc/letsencrypt/live/*.joeac.net)
+installed_tls_cert_subdomains = $(installed_tls_certs:/etc/letsencrypt/live/%.joeac.net=%)
+tls_cert_subdomains_to_delete = $(filter-out $(SUBDOMAINS),$(installed_tls_cert_subdomains))
+
+tls_crontab = /etc/periodic/daily/tls-$(SUBDOMAIN_$(module)).joeac.net
+tls_cert = /etc/letsencrypt/live/$(SUBDOMAIN_$(module)).joeac.net/fullchain.pem
+
+define install_tls_module_rule =
+.PHONY: install_tls_$(module)
+install_tls_module_$(module): $(if $(SUBDOMAIN_$(module)),$(tls_crontab) $(tls_cert))
+endef
+
+define reinstall_tls_module_rule =
+.PHONY: reinstall_tls_$(module)
+reinstall_tls_$(module): $(if $(SUBDOMAIN_$(module)),$(tls_crontab) renew_$(tls_cert))
+endef
+
+define uninstall_tls_module_rule =
+.PHONY: uninstall_tls_$(module)
+uninstall_tls_$(module): delete_cert_$(SUBDOMAIN_$(module)).joeac.net
+	$(if $(SUBDOMAIN_$(module)), \
+		sudo rm -f $(tls_crontab)
+	)
+endef
+
+define obtain_or_renew_cert_cmd =
+sudo certbot certonly
+	--nginx \
+	--cert-name $(SUBDOMAIN_$(module)) \
+	--domain $(subst @.,,$(SUBDOMAIN_$(module)).)joeac.net
+endef
+
+is_cert_expired = $(shell sudo certbot certificates --cert-name $(SUBDOMAIN_$(module)).joeac.net \
+	| grep "Expiry Date" | grep -E "(EXPIRED|REVOKED)")
+define cert_rule =
+$(tls_cert):
+	$(obtain_or_renew_cert_cmd)
+
+.PHONY: renew_$(tls_cert)
+renew_$(tls_cert):
+	$(if $(is_cert_expired),$(obtain_or_renew_cert_cmd))
+endef
+
+$(foreach module,$(ALL_MODULES), $(eval $(install_tls_module_rule)))
+$(foreach module,$(ALL_MODULES), $(eval $(reinstall_tls_module_rule)))
+$(foreach module,$(ALL_MODULES), $(eval $(uninstall_tls_module_rule)))
+$(foreach module,$(ALL_MODULES), $(eval $(cert_rule)))
+
+.PHONY: remove_/etc/periodic/daily/tls-%.joeac.net
+remove_/etc/periodic/daily/tls-%.joeac.net:
+	rm -f $(@:remove_%=%)
+
+.PHONY: delete_cert_%.joeac.net
+delete_cert_%.joeac.net:
+	sudo certbot delete --cert-name $(@:delete_cert_%=%)
+
+/etc/periodic/daily/tls-%joeac.net:
+	echo "#!/bin/sh" > crontab.tmp
+	echo "certbot renew --cert-name $(SUBDOMAIN_$(module)) --non-interactive" >> crontab.tmp
+	sudo mv crontab.tmp $@
+	sudo chmod +x $@
+
+.PHONY: reinstall_tls
+reinstall_tls: $(addprefix remove_,$(tls_crontabs_to_remove)) $(addprefix delete_cert_,$(tls_cert_subdomains_to_delete)) $(foreach subdomain,$(installed_tls_cert_subdomains),renew_$(tls_cert))
+
+.PHONY: uninstall_tls
+uninstall_tls: $(foreach module,$(ALL_MODULES),$(uninstall_tls_$(module)))
+
+.PHONY: install_certbot
+install_certbot: /usr/bin/certbot /usr/bin/python /usr/lib/$(shell ls /usr/bin | grep python[0-9]\\.)/certbot_nginx
+
+/usr/bin/certbot /usr/bin/python:
+	sudo apk add certbot
+
+/usr/lib/python%/certbot_nginx:
+	sudo apk add certbot-nginx

mox/config/mox.conf

@@ -48,17 +48,17 @@ Listeners:
 		TLS:
 			KeyCerts:
 				-
-					CertFile: path/to/mail.joeac.net-chain.crt.pem
+					CertFile: /etc/letsencrypt/live/mail.joeac.net/fullchain.pem
-					KeyFile: path/to/mail.joeac.net.key.pem
+					KeyFile: /etc/letsencrypt/live/mail.joeac.net/privkey.pem
 				-
-					CertFile: path/to/mta-sts.mail.joeac.net-chain.crt.pem
+					CertFile: /etc/letsencrypt/live/mta-sts.mail.joeac.net/fullchain.pem
-					KeyFile: path/to/mta-sts.mail.joeac.net.key.pem
+					KeyFile: /etc/letsencrypt/live/mta-sts.mail.joeac.net/privkey.pem
 				-
-					CertFile: path/to/autoconfig.mail.joeac.net-chain.crt.pem
+					CertFile: /etc/letsencrypt/live/autoconfig.mail.joeac.net/fullchain.pem
-					KeyFile: path/to/autoconfig.mail.joeac.net.key.pem
+					KeyFile: /etc/letsencrypt/live/autoconfig.mail.joeac.net/privkey.pem
 				-
-					CertFile: path/to/clientsettings.mail.joeac.net-chain.crt.pem
+					CertFile: /etc/letsencrypt/live/clientsettings.mail.joeac.net/fullchain.pem
-					KeyFile: path/to/clientsettings.mail.joeac.net.key.pem
+					KeyFile: /etc/letsencrypt/live/clientsettings.mail.joeac.net/privkey.pem
 		SMTP:
 			Enabled: true
 		Submissions:

nginx/http.d/static.conf.template

@@ -6,8 +6,8 @@ server {
         error_page 404 /index.html;
     }
     listen 443 ssl;
-    ssl_certificate /etc/letsencrypt/live/${DOMAIN}/fullchain.pem;
+    ssl_certificate /etc/letsencrypt/live/${CERTNAME}/fullchain.pem;
-    ssl_certificate_key /etc/letsencrypt/live/${DOMAIN}/privkey.pem;
+    ssl_certificate_key /etc/letsencrypt/live/${CERTNAME}/privkey.pem;
     include /etc/letsencrypt/options-ssl-nginx.conf;
     ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 }