diff options
Diffstat (limited to 'frontends')
| -rw-r--r-- | frontends/Rexfile | 12 | ||||
| -rw-r--r-- | frontends/etc/acme-client.conf.tpl | 10 | ||||
| -rw-r--r-- | frontends/scripts/acme.sh.tpl | 24 |
3 files changed, 16 insertions, 30 deletions
diff --git a/frontends/Rexfile b/frontends/Rexfile index 3dd3c43..21c2f58 100644 --- a/frontends/Rexfile +++ b/frontends/Rexfile @@ -296,21 +296,13 @@ task 'acme', group => 'frontends', sub { file '/etc/acme-client.conf', - content => template( - './etc/acme-client.conf.tpl', - acme_hosts => \@acme_hosts, - f3s_hosts => \@f3s_hosts - ), + content => template( './etc/acme-client.conf.tpl', acme_hosts => \@acme_hosts ), owner => 'root', group => 'wheel', mode => '644'; file '/usr/local/bin/acme.sh', - content => template( - './scripts/acme.sh.tpl', - acme_hosts => \@acme_hosts, - f3s_hosts => \@f3s_hosts - ), + content => template( './scripts/acme.sh.tpl', acme_hosts => \@acme_hosts ), owner => 'root', group => 'wheel', mode => '744'; diff --git a/frontends/etc/acme-client.conf.tpl b/frontends/etc/acme-client.conf.tpl index 727e7fe..144f800 100644 --- a/frontends/etc/acme-client.conf.tpl +++ b/frontends/etc/acme-client.conf.tpl @@ -28,13 +28,9 @@ authority buypass-test { # Skip ipv4/ipv6 subdomains - they're included as SANs in parent cert next if $host =~ /^(ipv4|ipv6)\./; -%> -<% # Public DNS publishes www for every service. f3s hosts use the primary - # certificate for standby too (unlike other hosts, they do not get a - # separate standby certificate/keypair). +<% # Public DNS publishes www for every service. Standby names resolve to + # the other frontend, so they need their own certificate/keypair. my @alt_names = ("www.$host"); - if (grep { $_ eq $host } @$f3s_hosts) { - push @alt_names, "standby.$host"; - } for my $sub_host (@$acme_hosts) { if ($sub_host =~ /^(ipv4|ipv6)\.\Q$host\E$/) { push @alt_names, $sub_host; @@ -48,14 +44,12 @@ domain <%= $host %> { domain full chain certificate "/etc/ssl/<%= $host %>.fullchain.pem" sign with letsencrypt } -<% unless (grep { $_ eq $host } @$f3s_hosts) { -%> domain standby.<%= $host %> { domain key "/etc/ssl/private/standby.<%= $host %>.key" domain full chain certificate "/etc/ssl/standby.<%= $host %>.fullchain.pem" sign with letsencrypt } <% } -%> -<% } -%> # Current server's FQDN (blowfish.buetow.org or fishfinger.buetow.org) # Each server only has its own cert, no www/standby variants for server hostnames diff --git a/frontends/scripts/acme.sh.tpl b/frontends/scripts/acme.sh.tpl index dd613fc..c7b4d9e 100644 --- a/frontends/scripts/acme.sh.tpl +++ b/frontends/scripts/acme.sh.tpl @@ -16,13 +16,17 @@ ensure_placeholder_cert () { fi } -alias_cert () { - source=$1 - alias=$2 +prepare_standby_cert () { + host=$1 - ln -sf "/etc/ssl/$source.fullchain.pem" "/etc/ssl/$alias.crt" - ln -sf "/etc/ssl/$source.fullchain.pem" "/etc/ssl/$alias.fullchain.pem" - ln -sf "/etc/ssl/private/$source.key" "/etc/ssl/private/$alias.key" + # Migrate aliases created by the short-lived shared-SAN configuration. + # acme-client must never write a standalone certificate through a symlink + # to the primary keypair. + if [ -L "/etc/ssl/$host.fullchain.pem" ] \ + || [ -L "/etc/ssl/private/$host.key" ]; then + rm -f "/etc/ssl/$host.crt" "/etc/ssl/$host.fullchain.pem" \ + "/etc/ssl/private/$host.key" + fi } handle_cert () { @@ -57,13 +61,9 @@ handle_cert <%= $host %> if [ $? -eq 0 ]; then has_update=yes fi -<% if (grep { $_ eq $host } @$f3s_hosts) { -%> -# f3s standby names are SANs on the primary certificate. relayd selects a -# keypair by SNI name, so provide filename aliases for that shared certificate. -alias_cert <%= $host %> standby.<%= $host %> -<% } -%> <% unless ($host eq 'blowfish.buetow.org' or $host eq 'fishfinger.buetow.org' - or grep { $_ eq $host } @$f3s_hosts) { -%> + or $host =~ /^(ipv4|ipv6)\./) { -%> +prepare_standby_cert standby.<%= $host %> handle_cert standby.<%= $host %> if [ $? -eq 0 ]; then has_update=yes |