Subject: bug#50872: closed (Re: bug#50872: Prosody service + letsencrypt certs improvements)

From: [email-masked] (GNU bug Tracking System)
Date: Wed, 29 Sep 2021 23:45:02 +0000

Your bug report

#50872: Prosody service + letsencrypt certs improvements

which was filed against the guix package, has been closed.

The explanation is attached below, along with your original report.
If you require more details, please reply to [email-masked].

-- 
50872: http://debbugs.gnu.org/cgi/bugreport.cgi?bug=50872
GNU Bug Tracking System
Contact [email-masked] with problems

Subject: Re: bug#50872: Prosody service + letsencrypt certs improvements
From: Christine Lemmer-Webber <[email-masked]>
To: Carlo Zancanaro <[email-masked]>
Cc: [email-masked]
Date: Wed, 29 Sep 2021 19:43:29 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

Carlo Zancanaro <[email-masked]> writes:

> Hi Christine,
>
> On Tue, Sep 28 2021, Christine Lemmer-Webber wrote:
>> Hm, in other words we really ought to run this attached to some hook
>> related to the letsencrypt services... when they renew successfully,
>> it should trigger this command, I'd think.  We do similar things for
>> nginx, etc...
>
> I'm pretty sure Guix doesn't do anything automatic when certificates
> are renewed. For nginx there's an example in the manual for how to set
> up a deploy hook to reload the certificates[1], so I expect that
> you'll have to set up something similar.

You're right... not sure why I thought it did.

> My prosody setup has this deploy hook:
>
>    (program-file
>     "reload-certificates"
>     #~(let ((prosodyctl (string-append #$(specification->package
>      "prosody")
>                                        "/bin/prosodyctl")))
>         (system* prosodyctl "--root" "cert" "import"
>         "/etc/letsencrypt/live")
>         (system* prosodyctl "reload")))
>
> but I have recently had some trouble with it (prosody hasn't been
> reloading the certificate properly). I don't think my issue is 
> related to this deploy hook, though.

That seems great.  I'll give it a try.

Since this isn't significantly different from other services then (well,
excepting that prosody needs to not just reload but have the import
command run again... but you've provided what looks like a good solution
above) I'm going to close this.

> I hope that helps!

It does, thanks!

> Carlo
>
> [1]:
> https://guix.gnu.org/en/manual/en/html_node/Certificate-Services.html

Subject: Prosody service + letsencrypt certs improvements
From: Christine Lemmer-Webber <[email-masked]>
To: [email-masked]
Date: Tue, 28 Sep 2021 13:01:31 -0400
List-Id: <debbugs-submit.debbugs.gnu.org>

I finally got prosody working on my server using Guix.  However, the
manual says:

   Prosodyctl will also help you to import certificates from the
   ‘letsencrypt’ directory so that the ‘prosody’ user can access them.  See
   <https://prosody.im/doc/letsencrypt>.

     prosodyctl --root cert import /etc/letsencrypt/live

However, what prosody actually does with this command is that it copies
the files from letsencrypt *over to* its own directory (but then also
restarts prosody... in theory).  According to the docs:

  This command can be put in cron or passed as a callback to automated
  certificate renewal programs such as certbot or other Let's Encrypt
  clients. For more information on using Prosody with these, see our
  Let's Encrypt page.

Hm, in other words we really ought to run this attached to some hook
related to the letsencrypt services... when they renew successfully, it
should trigger this command, I'd think.  We do similar things for nginx,
etc...

Thoughts?  Does this seem right?
 - Christine