Unverified Commit 3390622f authored by Mattia Rizzolo's avatar Mattia Rizzolo
Browse files

handle the ssl cert of reproduce.d.n with letsencrypt like we do everywhere else 



Signed-off-by: Mattia Rizzolo's avatarMattia Rizzolo <mattia@debian.org>
parent cadc58f4

hosts/osuosl5-amd64/etc/dehydrated/conf.d/local_local.sh

0 → 100644
+13 −0
Original line number Diff line number Diff line 
# shellcheck shell=sh disable=SC2034



CA="https://acme-v02.api.letsencrypt.org/directory"

#CA="https://acme-staging-v02.api.letsencrypt.org/directory"



RENEW_DAYS="30"

KEYSIZE="4096"

PRIVATE_KEY_RENEW="no"



CHALLENGETYPE="http-01"

HOOK="/etc/dehydrated/hooks.sh"



CONTACT_EMAIL="contact@reproducible-builds.org"

hosts/osuosl5-amd64/etc/dehydrated/domains.txt

0 → 100644
+1 −0
Original line number Diff line number Diff line 
reproduce.debian.net

hosts/osuosl5-amd64/etc/dehydrated/hooks.sh

0 → 100755
+38 −0
Original line number Diff line number Diff line 
#!/bin/bash



set -eu



OP=$1



_log () {

    echo " + ($OP) $*"

}



reload_apache () {

    _log "Reloading apache..."

    sudo apache2ctl graceful

}



reload_nginx () {

    _log "Reloading nginx..."

    sudo systemctl reload nginx

}



email () {

    # $1: domain name $6: timestamp of cert creation

    printf "%s\n\n    %s\t%s" \

            "The following SSL certifcate has just been renewed:" \

            "$1" "$(date -u -d @"$6")" | \

        mail -s "R-B SSL certifcate renewed" root

}



case "$OP" in

    deploy_cert)

        shift

        reload_nginx

        email "$@"

        ;;

    *)

        ;;

esac

hosts/osuosl5-amd64/etc/nginx/nginx.conf

+40 −23
Original line number Diff line number Diff line
@@ -17,6 +17,25 @@ http { 
        index index.html index.htm index.nginx-debian.html;

        root /var/www/html;



        listen 443 ssl; # managed by Certbot

        ssl_certificate /var/lib/dehydrated/certs/reproduce.debian.net/privkey.pem

        ssl_certificate_key /var/lib/dehydrated/certs/reproduce.debian.net/fullchain.pem



        ssl_session_cache shared:le_nginx_SSL:10m;

        ssl_session_timeout 1440m;

        ssl_session_tickets off;

        ssl_protocols TLSv1.2 TLSv1.3;

        ssl_prefer_server_ciphers off;

        ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-C

        HACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";





        location /.well-known/acme-challenge/ {

            alias /var/lib/letsencrypt.sh/acme-challenges/;

            disable_symlinks off;

            autoindex off;

        }



        location / {

            # First attempt to serve request as file, then

            # as directory, then fall back to displaying a 404.
@@ -28,26 +47,24 @@ http { 
            proxy_pass http://127.0.0.1:8484;

        }



    listen 443 ssl; # managed by Certbot

    ssl_certificate /etc/letsencrypt/live/reproduce.debian.net/fullchain.pem; # managed by Certbot

    ssl_certificate_key /etc/letsencrypt/live/reproduce.debian.net/privkey.pem; # managed by Certbot

    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot

    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot



    }





    server {

    if ($host = reproduce.debian.net) {

        return 301 https://$host$request_uri;

    } # managed by Certbot





        listen          80;

        server_name     reproduce.debian.net;

    return 404; # managed by Certbot



        location /.well-known/acme-challenge/ {

            alias /var/lib/letsencrypt.sh/acme-challenges/;

            disable_symlinks off;

            autoindex off;

        }



        location / {

            return 301 https://$host$request_uri;

        }



        return 404;

    }

hosts/osuosl5-amd64/etc/sudoers.d/letsencrypt

0 → 100644
+1 −0
Original line number Diff line number Diff line 
letsencrypt ALL=(root) NOPASSWD: /usr/bin/systemctl reload nginx