Subject: bug#46961: [PATCH 0/2] Allow nginx to start before certbot has run

From: Carlo Zancanaro <[email-masked]>
Date: Wed, 24 Jan 2024 23:18:36 +1100

>From time to time people have issues with setting up a new system with
certbot generating certificates for an nginx server. The issue is that
nginx won't start without being able to load certificates, but certbot
can't generate certificates (through the default HTTP challenge)
without a running nginx server.

Breaking this has generally required two reconfigures: one with nginx
configured without loading certificates, and then a second reconfigure
after running certbot to add the certificate configuration. This is a
bit of a pain, so I've made Guix generate a self-signed certificate to
allow nginx to start before certbot has run.

Unfortunately, I couldn't put the certificates in the same location as
certbot, because certbot is very particular about its directories not
existing when it requests a certificate for the first time. Rather
than try to convince it to do what I wanted, I opted to add another
level of indirection and move certificates to /etc/certs/. This is
backwards compatible, because the old /etc/letsenctypt/live/ is
maintained by certbot. The only real difference is for the initial
bootstrapping of a certificate.

Carlo Zancanaro (2):
  services: certbot: Symlink certificates to /etc/certs
  services: certbot: Create self-signed certificates before certbot runs

 doc/guix.texi            | 32 +++++++++------
 gnu/services/certbot.scm | 86 ++++++++++++++++++++++++++++++++++++++--
 2 files changed, 102 insertions(+), 16 deletions(-)

base-commit: ffc5fefce370f5fc01091869e13fdf525be1e0c0
-- 
2.41.0