Paths

Table of Contentst

Differential D3248

Deploy Certbot everywhere
Changes PlannedPublic
Actions

Authored by dereckson on Dec 16 2023, 01:01.

Tags

None

Referenced Files

	F2944182: D3248.id8345.diff
	Tue, May 14, 19:30

	F2943933: D3248.id8347.diff
	Tue, May 14, 17:40

	Unknown Object (File)
	Mon, May 13, 13:52

	Unknown Object (File)
	Mon, May 13, 12:16

	Unknown Object (File)
	Mon, May 13, 11:41

	Unknown Object (File)
	Thu, May 9, 07:19

	Unknown Object (File)
	Thu, May 9, 06:45

	Unknown Object (File)
	Thu, May 9, 06:09

Subscribers

None

Details

Reviewers

Maniphest Tasks

T1505: Automate Let's Encrypt TLS certificates management for every server

Summary

Currently, certbot was deployed:

as a system package on webserver-core
as a Docker container and wrapper, with DNS hook on paas-docker
not at all elsewhere

This change merges the different units as a part of the roles/core/certificates
unit to have a consistent installation through all machines, Docker included.

Don't try to issue certificate, as to use DNS registration, we currently
need a manual intervention to add a CNAME DNS records for the _acme_challenge.
verification subdomain.

Certificates are renewed with a daily script running certbot renew, installed
through periodic on FreeBSD or as a systemd timer on Linux with systemd nodes.

Ref T1505.

Test Plan

Deploy on Hervil

Diff Detail

Repository

rOPS Nasqueron Operations

Lint

Lint Errors

Severity	Location	Code	Message
Error	_modules/node.py:446	E501	flake8 E501

Unit

No Test Coverage

Branch

universal-letsencrypt

Build Status

Buildable 5126
Build 5407: arc lint + arc unit

Event Timeline

dereckson requested review of this revision.Dec 16 2023, 01:01

dereckson created this revision.

Harbormaster completed remote builds in B5124: Diff 8345.Dec 16 2023, 01:01

dereckson added a parent revision: D3247: Free certificates unit's init state for includes.Dec 16 2023, 01:02

dereckson edited the summary of this revision. (Show Details)Dec 16 2023, 01:05

Import packages variable

Harbormaster completed remote builds in B5125: Diff 8346.Dec 16 2023, 14:32

dereckson mentioned this in T1475: Provision a mail server.Dec 16 2023, 14:49

Avoid to define authenticator both, one in cli.ini, one in command line

Harbormaster completed remote builds in B5126: Diff 8347.Dec 16 2023, 14:50

Think it's okey except my comment,
But why every day ? is it not too short ? Maybe each one 3 day or maybe one week could be better ?

roles/core/certificates/files/acme-dns-auth.py
24	no map.jinja for the storage path depending of the OS ?

This revision is now accepted and ready to land.Dec 16 2023, 20:18

dereckson added inline comments.Dec 16 2023, 23:02

roles/core/certificates/files/acme-dns-auth.py
24	Not sure I'm comfortable to templatize Python scripts. We lose the linter for example if we do that. What if we look both paths? So we can have the same script first looking /usr/local/etc then /etc. Some scripts already do that like.

dereckson planned changes to this revision.Dec 16 2023, 23:03

TODO: Cleanup certbot_dir from webserver-core

Revision Contents
Changeset List

Path

Size

_modules/

13 lines

_tests/

scripts/

bats/

test_edit_acme_dns_accounts.sh

2 lines

python/

test_edit_acme_dns_accounts.py

2 lines

pillar/

certificates/

certificates.sls

1 line

roles/

core/

certificates/

files/

730.letsencrypt

39 lines

41 lines

letsencrypt.sls

97 lines

	nasqueron.sls
	init.sls

45 lines

rc/

files/

6 lines

	core/	certificates/	files/
	paas-docker/	letsencrypt/	files/

acme-dns-auth.py

6 lines

edit-acme-dns-accounts.py

17 lines

	core/	certificates/	files/
	webserver-core/	letsencrypt/	files/

check-letsencrypt-certificates.py

7 lines

4 lines

letsencrypt-renew.service

7 lines

letsencrypt-renew.timer

7 lines

	letsencrypt-renewal-without-nginx.sh
	letsencrypt-renew.service

12 lines

letsencrypt-renewal.sh

6 lines

paas-docker/

1 line

letsencrypt/

files/

acme-dns-auth.py

edit-acme-dns-accounts.py

wrappers/

files/

2 lines

webserver-core/

3 lines

letsencrypt/

certificates.sls

files/

check-letsencrypt-certificates.py

letsencrypt-renew.service

letsencrypt-renew.timer

letsencrypt-renewal.sh

Diff 8347

_modules/node.py

Loading...

_tests/scripts/bats/test_edit_acme_dns_accounts.sh

Loading...

_tests/scripts/python/test_edit_acme_dns_accounts.py

Loading...

pillar/certificates/certificates.sls

Loading...

pillar/top.sls

Loading...

roles/core/certificates/files/730.letsencrypt

Loading...

roles/core/certificates/files/acme-dns-auth.py

Loading...

roles/core/certificates/files/check-letsencrypt-certificates.py

Loading...

roles/core/certificates/files/cli.ini

Loading...

roles/core/certificates/files/edit-acme-dns-accounts.py

Loading...

roles/core/certificates/files/letsencrypt-renew.service

Loading...

roles/core/certificates/files/letsencrypt-renew.timer

Loading...

roles/core/certificates/files/letsencrypt-renewal-without-nginx.sh

Loading...

roles/core/certificates/files/letsencrypt-renewal.sh

Loading...

roles/core/certificates/init.sls

Loading...

roles/core/certificates/letsencrypt.sls

Loading...

roles/core/certificates/nasqueron.sls

Loading...

roles/core/rc/files/periodic.conf

Loading...

roles/paas-docker/init.sls

Loading...

roles/paas-docker/letsencrypt/files/acme-dns-auth.py

Loading...

roles/paas-docker/letsencrypt/files/edit-acme-dns-accounts.py

Loading...

roles/paas-docker/letsencrypt/init.sls

Loading...

roles/paas-docker/wrappers/files/certbot.sh

Loading...

roles/paas-docker/wrappers/init.sls

Loading...

roles/webserver-core/init.sls

Loading...

roles/webserver-core/letsencrypt/certificates.sls

Loading...

roles/webserver-core/letsencrypt/files/check-letsencrypt-certificates.py

Loading...

roles/webserver-core/letsencrypt/files/cli.ini

Loading...

roles/webserver-core/letsencrypt/files/letsencrypt-renew.service

Loading...

roles/webserver-core/letsencrypt/files/letsencrypt-renew.timer

Loading...

roles/webserver-core/letsencrypt/files/letsencrypt-renewal.sh

Loading...

roles/webserver-core/letsencrypt/init.sls

Loading...

roles/webserver-core/letsencrypt/service.sls

Loading...

roles/webserver-core/letsencrypt/software.sls

Loading...