Differential D3906

Automate acme.sh install-cert cmd
ClosedPublic
Actions

Authored by DorianWinty on Thu, Feb 5, 22:04.

Details

Reviewers

dereckson

Maniphest Tasks

T2210: fullchain.pem isn't automatically generated by acme.sh

Commits

rOPSc9cb237e5e18: Automate acme.sh install-cert cmd

Summary

This command have several opportunities to botch a certificate deployment,
e.g. if we miss fullchain, the daemon will still serve former certificate.

Automating it allows to apply correct pillar configuration, and maintain it.

Currently, this cmd.run isn't strictly equipollent, it will run this command
everytime, but the result on the server will be equipollent: same config,
same files content.

Fixes T2210.

Test Plan

Deploy to hervil
Check the mail.nasqueron.org config have fullchain defined
Check if the certificates files are correctly regenerated

Diff Detail

Repository

rOPS Nasqueron Operations

Lint

Lint Passed

Unit

No Test Coverage

Branch

acmesh-cert

Build Status

Buildable 6233
Build 6517: arc lint + arc unit

Event Timeline

DorianWinty created this revision.Thu, Feb 5, 22:04

Harbormaster completed remote builds in B6232: Diff 10120.Thu, Feb 5, 22:04

DorianWinty requested review of this revision.Thu, Feb 5, 22:04

Fix spacing issues for jinja templating logic ; run under acme user ; use reloadcmd as parameter, not reload.

Harbormaster completed remote builds in B6233: Diff 10121.Thu, Feb 5, 22:33

Deployed to Hervil, we see we now have fullchain generated everywhere.

We also see the order acme command then permissions fixes is the correct one, as mail.nasqueron.org permissions are correct.

$ cd /var/certificates
$ ls -lah *
admin.mail.nasqueron.org:
total 19 KB
drwx------  2 acme wheel    6B May 20  2025 .
drwx--x--x  6 acme wheel    6B Nov  5  2024 ..
-rw-r--r--  1 acme wheel  1.3K Feb  5 22:29 cert.pem
-rw-r--r--  1 acme wheel  1.5K Feb  5 22:29 chain.pem
-rw-r--r--  1 acme wheel  2.8K Feb  5 22:29 fullchain.pem
-rw-------  1 acme wheel  227B Feb  5 22:29 key.pem

general:
total 1.0 KB
drwx------  2 acme wheel    2B Oct 20  2024 .
drwx--x--x  6 acme wheel    6B Nov  5  2024 ..

hervil.nasqueron.org:
total 19 KB
drwx------  2 acme wheel    6B May 20  2025 .
drwx--x--x  6 acme wheel    6B Nov  5  2024 ..
-rw-r--r--  1 acme wheel  1.3K Feb  5 22:29 cert.pem
-rw-r--r--  1 acme wheel  1.5K Feb  5 22:29 chain.pem
-rw-r--r--  1 acme wheel  2.8K Feb  5 22:29 fullchain.pem
-rw-------  1 acme wheel  227B Feb  5 22:29 key.pem

mail.nasqueron.org:
total 19 KB
drwxr-x---  2 acme mail     6B May 20  2025 .
drwx--x--x  6 acme wheel    6B Nov  5  2024 ..
-rw-r--r--  1 acme mail   1.3K Feb  5 22:29 cert.pem
-rw-r--r--  1 acme mail   1.5K Feb  5 22:29 chain.pem
-rw-r--r--  1 acme mail   2.8K Feb  5 22:29 fullchain.pem
-rw-r-----  1 acme mail   227B Feb  5 22:29 key.pem