Details

Reviewers

DorianWinty

Maniphest Tasks

T1505: Automate Let's Encrypt TLS certificates management for every server

Commits

rOPS1e9a54c10365: Deploy Certbot everywhere

Summary

Currently, certbot was deployed:

as a system package on webserver-core
as a Docker container and wrapper, with DNS hook on paas-docker
not at all elsewhere

This change merges the different units as a part of the roles/core/certificates
unit to have a consistent installation through all machines, Docker included.

Don't try to issue certificate, as to use DNS registration, we currently
need a manual intervention to add a CNAME DNS records for the _acme_challenge.
verification subdomain.

Certificates are renewed with a daily script running certbot renew, installed
through periodic on FreeBSD or as a systemd timer on Linux with systemd nodes.

Ref T1505.

Test Plan

Deploy on Hervil

Diff Detail

Repository

rOPS Nasqueron Operations

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

dereckson requested review of this revision.Dec 16 2023, 01:01

dereckson created this revision.

Harbormaster completed remote builds in B5124: Diff 8345.Dec 16 2023, 01:01

dereckson added a parent revision: D3247: Free certificates unit's init state for includes.Dec 16 2023, 01:02

dereckson edited the summary of this revision. (Show Details)Dec 16 2023, 01:05

Import packages variable

Harbormaster completed remote builds in B5125: Diff 8346.Dec 16 2023, 14:32

dereckson mentioned this in T1475: Provision a mail server.Dec 16 2023, 14:49

Avoid to define authenticator both, one in cli.ini, one in command line

Harbormaster completed remote builds in B5126: Diff 8347.Dec 16 2023, 14:50

Think it's okey except my comment,
But why every day ? is it not too short ? Maybe each one 3 day or maybe one week could be better ?

roles/core/certificates/files/acme-dns-auth.py
24	no map.jinja for the storage path depending of the OS ?

This revision is now accepted and ready to land.Dec 16 2023, 20:18

dereckson added inline comments.Dec 16 2023, 23:02

roles/core/certificates/files/acme-dns-auth.py
24	Not sure I'm comfortable to templatize Python scripts. We lose the linter for example if we do that. What if we look both paths? So we can have the same script first looking /usr/local/etc then /etc. Some scripts already do that like.

dereckson planned changes to this revision.Dec 16 2023, 23:03

TODO: Cleanup certbot_dir from webserver-core

Rebased. Use /usr/local/etc/periodic. Clean certbot_dir.

This revision is now accepted and ready to land.Jul 25 2024, 20:41

Harbormaster completed remote builds in B5375: Diff 8711.Jul 25 2024, 20:41

This revision was landed with ongoing or failed builds.Jul 25 2024, 20:41

Closed by commit rOPS1e9a54c10365: Deploy Certbot everywhere (authored by dereckson). · Explain Why

This revision was automatically updated to reflect the committed changes.

dereckson added a commit: rOPS1e9a54c10365: Deploy Certbot everywhere.

dereckson mentioned this in T1505: Automate Let's Encrypt TLS certificates management for every server.Aug 4 2024, 13:52

Deploy Certbot everywhereClosedPublicActions

Details

Diff Detail

Event Timeline

Revision ContentsChangeset List

Diff 8712

_modules/node.py

_tests/scripts/bats/test_edit_acme_dns_accounts.sh

_tests/scripts/python/test_edit_acme_dns_accounts.py

pillar/certificates/certificates.sls

pillar/top.sls

roles/core/certificates/files/730.letsencrypt

roles/core/certificates/files/acme-dns-auth.py

roles/core/certificates/files/check-letsencrypt-certificates.py

roles/core/certificates/files/cli.ini

roles/core/certificates/files/edit-acme-dns-accounts.py

roles/core/certificates/files/letsencrypt-renew.service

roles/core/certificates/files/letsencrypt-renew.timer

roles/core/certificates/files/letsencrypt-renewal-without-nginx.sh

roles/core/certificates/files/letsencrypt-renewal.sh

roles/core/certificates/init.sls

roles/core/certificates/letsencrypt.sls

roles/core/rc/files/periodic.conf

roles/paas-docker/init.sls

roles/paas-docker/letsencrypt/files/acme-dns-auth.py

roles/paas-docker/letsencrypt/files/edit-acme-dns-accounts.py

roles/paas-docker/letsencrypt/init.sls

roles/paas-docker/wrappers/files/certbot.sh

roles/paas-docker/wrappers/init.sls

roles/webserver-core/init.sls

roles/webserver-core/letsencrypt/certificates.sls

roles/webserver-core/letsencrypt/files/check-letsencrypt-certificates.py

roles/webserver-core/letsencrypt/files/cli.ini

roles/webserver-core/letsencrypt/files/letsencrypt-renew.service

roles/webserver-core/letsencrypt/files/letsencrypt-renew.timer

roles/webserver-core/letsencrypt/files/letsencrypt-renewal.sh

roles/webserver-core/letsencrypt/init.sls

roles/webserver-core/letsencrypt/service.sls

roles/webserver-core/letsencrypt/software.sls

roles/webserver-core/map.jinja

roles/webserver-core/nginx/config.sls

Deploy Certbot everywhere
ClosedPublic
Actions

Revision Contents
Changeset List