diff options
author | Lucas Savva <lucas@m1cr0man.com> | 2020-06-19 20:27:46 +0100 |
---|---|---|
committer | Lucas Savva <lucas@m1cr0man.com> | 2020-09-02 19:22:43 +0100 |
commit | 982c5a1f0e7f282f856391304aa4da7bb36c45b8 (patch) | |
tree | 4cf0e93b6cd4e1ae2371c0d9184fca87ae8e43ca /nixos/tests/postfix-raise-smtpd-tls-security-level.nix | |
parent | 6ab387699a9f23201cf76091d0f7d4ff09fa510e (diff) |
nixos/acme: Restructure module
- Use an acme user and group, allow group override only - Use hashes to determine when certs actually need to regenerate - Avoid running lego more than necessary - Harden permissions - Support "systemctl clean" for cert regeneration - Support reuse of keys between some configuration changes - Permissions fix services solves for previously root owned certs - Add a note about multiple account creation and emails - Migrate extraDomains to a list - Deprecate user option - Use minica for self-signed certs - Rewrite all tests I thought of a few more cases where things may go wrong, and added tests to cover them. In particular, the web server reload services were depending on the target - which stays alive, meaning that the renewal timer wouldn't be triggering a reload and old certs would stay on the web servers. I encountered some problems ensuring that the reload took place without accidently triggering it as part of the test. The sync commands I added ended up being essential and I'm not sure why, it seems like either node.succeed ends too early or there's an oddity of the vm's filesystem I'm not aware of. - Fix duplicate systemd rules on reload services Since useACMEHost is not unique to every vhost, if one cert was reused many times it would create duplicate entries in ${server}-config-reload.service for wants, before and ConditionPathExists
Diffstat (limited to 'nixos/tests/postfix-raise-smtpd-tls-security-level.nix')
-rw-r--r-- | nixos/tests/postfix-raise-smtpd-tls-security-level.nix | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/nixos/tests/postfix-raise-smtpd-tls-security-level.nix b/nixos/tests/postfix-raise-smtpd-tls-security-level.nix index b3c2156122d20..5fad1fed75b20 100644 --- a/nixos/tests/postfix-raise-smtpd-tls-security-level.nix +++ b/nixos/tests/postfix-raise-smtpd-tls-security-level.nix @@ -1,6 +1,3 @@ -let - certs = import ./common/acme/server/snakeoil-certs.nix; -in import ./make-test-python.nix { name = "postfix"; |