bug#36389: nginx/certbot interaction doesn't work as documented

[Alex Sassmannshausen]

Hi Robert,

Robert Vollmert <address@hidden> writes:

> I’ve tried setting up nginx with certbot on guix. Two immediate issues:
>
> - certbot extends the nginx service to serve challenge files. It appears
>   that this nginx service extension conflicts (silently) with an independently
>   configured nginx service. I.e., I had nginx previously configured, and
>   after adding certbot, my previous nginx kept running with the previous
>   configuration (even after herd restart nginx), while there was an additional
>   nginx config in the gnu store with the certbot-specific fragments. certbot
>   activation called nginx to test that fragment, but apparently never started
>   nginx (successfully?). There were no errors.
>
>   After removing the stand-alone nginx service and restarting nginx, it 
> started
>   with the certbot configuration.

This sounds odd, and I don't recall having this issue on my servers with
nginx SSL server configuration extended with certbot service.

>
> - After this, /var/lib/certbot/renew worked successfully to register a
>   certificate, but then failed when calling the nginx deploy hook that I’d
>   copied from the guix certbot documentation, because /var/run/nginx/pid
>   doesn’t exist. That might be a bug in the nginx package, not sure. I can’t
>   find an nginx pid file anywhere, and no other errors related to it either,
>   even though the config file includes
>  pid /var/run/nginx/pid;

The pid exists on my servers running an SSL nginx server config
configuration extended with certbot.

I've found the certbot & nginx services, overall, work very well
together.  But there are a couple of gotchas in my experience:

- The certbot service includes a redirect from port 80 to 443 for all
  except .well-known location.  By itself this may cause no problems for
  you.

- If deploying on a server that hitherto has no SSL certificate you have
  a chicken and egg problem: you will want your site to be configured to
  use the letsencrypt cert directories, to serve ssl (the redirect means
  any non-ssl deployments won't work anyway), but those directories
  don't yet exist as you haven't generated certs with certbot yet.

Here's a journey that should work:
- run system configuration with just the certbot service
- use certbot to generate your initial certificates
- reconfigure with additional nginx server configuration, pointing to
  the SSL certificates created by certbot

If the above is not helpful, perhaps you could share the nginx
configuration generated when you have both certbot & your custom server
running?

Can't promise anything, but we might be able to spot what's happening.

Best wishes,

Alex