- introduce an nginx hook
the hook will resolve the new environment variables
* NGINX_CONFDIR -> default: /etc/nginx/conf.d
* NGINX_CHALLENGE_LOCTION -> default: 001-challenge-letsencrypt.conf
* NGINX_TLS_CERTIFICATE -> default:002-tls-certificates.conf
- group: nginx-config-challenge-location
this will generate -> $NGINX_CONFDIR/$NGINX_CHALLENGE_LOCATION
- group: nginx-config-certificate-location
this will generate -> $NGINX_CONFDIR/$NGINX_TLS_CERTIFICATE
ACMEd amims to minimize the amount of ReadWrite directories. The systemd.unit
(acmed.service), takes advantage of sandbox capabilities.
For nginx support, we need to ReadWrite to $NGINX_CONFDIR. Since
we are running with uid/gid of 'acmed' and probably aren't
authorized, an user with administrative rights need to call once
chmod g+w $NGINX_CONFIR
on systemd managed systems, we are able to correct/rewrite the directory
rights at installation time (tmpfiles.d/acmed.conf).
A website admin needs to include
* $NGINX_CHALLENGE_LOCATION and
* $NGINX_TLS_CERTIFICATE
inside the [virtual-]host configuration block of websites to
activate the templates (non automated task)
- adapt acmed.service
will hint to NGINX environment variables
defaults are handled inside the nginx hook
- adapt tempfiles.d/acmed.conf
preset default directory to store challenges (if acmed isn't started
via systemd)
- adapat Makefile
add nginx_hooks.toml
Signed-off-by: Ralf Zerres <ralf.zerres@networkx.de>
Ralf Zerres
12e033388c