- introduce an nginx hook
the hook will resolve the new environment variables
* NGINX_CONFDIR -> default: /etc/nginx/conf.d
* NGINX_CHALLENGE_LOCTION -> default: 001-challenge-letsencrypt.conf
* NGINX_TLS_CERTIFICATE -> default:002-tls-certificates.conf
- group: nginx-config-challenge-location
this will generate -> $NGINX_CONFDIR/$NGINX_CHALLENGE_LOCATION
- group: nginx-config-certificate-location
this will generate -> $NGINX_CONFDIR/$NGINX_TLS_CERTIFICATE
ACMEd amims to minimize the amount of ReadWrite directories. The systemd.unit
(acmed.service), takes advantage of sandbox capabilities.
For nginx support, we need to ReadWrite to $NGINX_CONFDIR. Since
we are running with uid/gid of 'acmed' and probably aren't
authorized, an user with administrative rights need to call once
chmod g+w $NGINX_CONFIR
on systemd managed systems, we are able to correct/rewrite the directory
rights at installation time (tmpfiles.d/acmed.conf).
A website admin needs to include
* $NGINX_CHALLENGE_LOCATION and
* $NGINX_TLS_CERTIFICATE
inside the [virtual-]host configuration block of websites to
activate the templates (non automated task)
- adapt acmed.service
will hint to NGINX environment variables
defaults are handled inside the nginx hook
- adapt tempfiles.d/acmed.conf
preset default directory to store challenges (if acmed isn't started
via systemd)
- adapat Makefile
add nginx_hooks.toml
Signed-off-by: Ralf Zerres <ralf.zerres@networkx.de>
Makefile: /var/run is depreciated -> using /run
Makefile: add missing include for "letsencrypt.toml"
acmed.service: sandbox hardened systemd unit
* RuntimeDirectory (systemd handled access to pid-file)
acmed.conf: systemd handled tempfile configuration
* preset runtime environment, needed
if daemon is started without systemd unit
* asure writable LFS compliant directories,
* assining an `acmed` system user
create the user with your OS tools (e.g useradd)
letsencrypt.toml: update strings
Signed-off-by: Ralf Zerres <ralf.zerres@networkx.de>
Ralf Zerres