[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[bug#26685] certbot service experience
From: |
Christopher Allan Webber |
Subject: |
[bug#26685] certbot service experience |
Date: |
Tue, 28 Nov 2017 23:45:31 -0600 |
User-agent: |
mu4e 0.9.18; emacs 25.3.1 |
Ludovic Courtès writes:
> Hello!
>
> Since everyone was so hesitant I was so blissful ;-), I went ahead and
> pushed this patch as commit c2e5d74997bdb57dc35e0189188c6917cd5f0f19!
> \o/
>
> I think it’s better than the status quo, because even if it’s not
> perfect, it *is* useful as it is. We can start from here if there are
> ideas on how to improve it.
>
> Ludo’.
Yay! But oh nooooo! I really should have replied to this! I had
stopped working on it because I got overloaded with final-push situation
in ActivityPub.
Maybe this is worth moving to the mailing list instead, but one reason I
didn't push it was I had discovered a significant and serious
issue... building a system based off of its config is no longer
determistic based off of the system config alone... because this
checks for the rpesence of nginx-server-configuration-ssl-certificate
at *build* time of the system config. The following code is the
culprit:
(define (emit-nginx-server-config server)
;; [...]
(for-each
(match-lambda
((record-key . file)
(if (and file (not (file-exists? file)))
(error
(simple-format
#f
"~A in the nginx configuration for the server with name \"~A\"
does not exist" record-key server-name)))))
`(("ssl-certificate" . ,ssl-certificate)
("ssl-certificate-key" . ,ssl-certificate-key)))
Relatedly, the current setup has these defaults:
(ssl-certificate nginx-server-configuration-ssl-certificate
(default "/etc/nginx/cert.pem"))
(ssl-certificate-key nginx-server-configuration-ssl-certificate-key
(default "/etc/nginx/key.pem"))
IMO they should probably default to #f so that looking for the files
doesn't fail to boot nginx.