{"action":"created","issue":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/11506","labels_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/11506/labels{/name}","comments_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/11506/comments","events_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/11506/events","html_url":"https://github.com/NixOS/nixpkgs/pull/11506","id":120643200,"number":11506,"title":"acme service: letsencrypt cert auto-renewal with simp_le","user":{"login":"fpletz","id":114159,"avatar_url":"https://avatars.githubusercontent.com/u/114159?v=3","gravatar_id":"","url":"https://api.github.com/users/fpletz","html_url":"https://github.com/fpletz","followers_url":"https://api.github.com/users/fpletz/followers","following_url":"https://api.github.com/users/fpletz/following{/other_user}","gists_url":"https://api.github.com/users/fpletz/gists{/gist_id}","starred_url":"https://api.github.com/users/fpletz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fpletz/subscriptions","organizations_url":"https://api.github.com/users/fpletz/orgs","repos_url":"https://api.github.com/users/fpletz/repos","events_url":"https://api.github.com/users/fpletz/events{/privacy}","received_events_url":"https://api.github.com/users/fpletz/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/2.status:%20work-in-progress","name":"2.status: work-in-progress","color":"e6e6e6"},{"url":"https://api.github.com/repos/NixOS/nixpkgs/labels/8.has:%20module%20(new)","name":"8.has: module (new)","color":"009800"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":16,"created_at":"2015-12-06T16:14:52Z","updated_at":"2015-12-12T15:09:30Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/NixOS/nixpkgs/pulls/11506","html_url":"https://github.com/NixOS/nixpkgs/pull/11506","diff_url":"https://github.com/NixOS/nixpkgs/pull/11506.diff","patch_url":"https://github.com/NixOS/nixpkgs/pull/11506.patch"},"body":"This new service invokes `simp_le` for a defined set of certs on a regular basis with a systemd timer. `simp_le` is smart enough to handle account registration, domain validation and renewal on its own. The only thing required is an existing HTTP server that serves the path `/.well-known/acme-challenge` from the webroot cert parameter.\r\n\r\n### Example\r\n```\r\n  security.acme.certs.\"foo.example.com\" = {\r\n    webroot = \"/var/www/challenges\";\r\n    extraDomains = { \"www.example.com\" = null; };\r\n    email = \"foo@example.com\";\r\n    validMin = 2592000;\r\n    renewInterval = \"weekly\";\r\n  };\r\n```\r\n\r\n### Example Nginx vhost\r\n```\r\n  services.nginx.appendConfig = ''\r\n    http {\r\n      server {\r\n        server_name _;\r\n        listen 80;\r\n        listen [::]:80;\r\n\r\n        location /.well-known/acme-challenge {\r\n          root /var/www/challenges;\r\n        }\r\n\r\n        location / {\r\n          return 301 https://$host$request_uri;\r\n        }\r\n      }\r\n    }\r\n  '';\r\n```\r\n\r\n### Open TODOs\r\n - [x] Notify/reload/restart dependent services\r\n - [x] ~~Provide a basic HTTP Server for verification if host doesn't provide one (e.g. python SimpleHTTPServer)~~\r\n - [x] Don't run `simp_le` as root and use cert-specific owner/group/mode at least for private keys\r\n\r\nFeedback and suggestions for improvements would be much appreciated."},"comment":{"url":"https://api.github.com/repos/NixOS/nixpkgs/issues/comments/164160296","html_url":"https://github.com/NixOS/nixpkgs/pull/11506#issuecomment-164160296","issue_url":"https://api.github.com/repos/NixOS/nixpkgs/issues/11506","id":164160296,"user":{"login":"fpletz","id":114159,"avatar_url":"https://avatars.githubusercontent.com/u/114159?v=3","gravatar_id":"","url":"https://api.github.com/users/fpletz","html_url":"https://github.com/fpletz","followers_url":"https://api.github.com/users/fpletz/followers","following_url":"https://api.github.com/users/fpletz/following{/other_user}","gists_url":"https://api.github.com/users/fpletz/gists{/gist_id}","starred_url":"https://api.github.com/users/fpletz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fpletz/subscriptions","organizations_url":"https://api.github.com/users/fpletz/orgs","repos_url":"https://api.github.com/users/fpletz/repos","events_url":"https://api.github.com/users/fpletz/events{/privacy}","received_events_url":"https://api.github.com/users/fpletz/received_events","type":"User","site_admin":false},"created_at":"2015-12-12T15:09:30Z","updated_at":"2015-12-12T15:09:30Z","body":"@abbradar You're right about `renewInterval` and `validMin`. Fixed.\r\n\r\n@domenkozar Excellent idea. Added. :smile: "}}