[Git][qa/jenkins.debian.net][master] handle the ssl cert of reproduce.d.n with letsencrypt like we do everywhere else
Mattia Rizzolo (@mattia)
gitlab at salsa.debian.org
Tue Nov 12 12:47:38 GMT 2024
Mattia Rizzolo pushed to branch master at Debian QA / jenkins.debian.net
Commits:
3390622f by Mattia Rizzolo at 2024-11-12T13:47:06+01:00
handle the ssl cert of reproduce.d.n with letsencrypt like we do everywhere else
Signed-off-by: Mattia Rizzolo <mattia at debian.org>
- - - - -
6 changed files:
- + hosts/osuosl5-amd64/etc/dehydrated/conf.d/local_local.sh
- + hosts/osuosl5-amd64/etc/dehydrated/domains.txt
- + hosts/osuosl5-amd64/etc/dehydrated/hooks.sh
- hosts/osuosl5-amd64/etc/nginx/nginx.conf
- + hosts/osuosl5-amd64/etc/sudoers.d/letsencrypt
- update_jdn.sh
Changes:
=====================================
hosts/osuosl5-amd64/etc/dehydrated/conf.d/local_local.sh
=====================================
@@ -0,0 +1,13 @@
+# shellcheck shell=sh disable=SC2034
+
+CA="https://acme-v02.api.letsencrypt.org/directory"
+#CA="https://acme-staging-v02.api.letsencrypt.org/directory"
+
+RENEW_DAYS="30"
+KEYSIZE="4096"
+PRIVATE_KEY_RENEW="no"
+
+CHALLENGETYPE="http-01"
+HOOK="/etc/dehydrated/hooks.sh"
+
+CONTACT_EMAIL="contact at reproducible-builds.org"
=====================================
hosts/osuosl5-amd64/etc/dehydrated/domains.txt
=====================================
@@ -0,0 +1 @@
+reproduce.debian.net
=====================================
hosts/osuosl5-amd64/etc/dehydrated/hooks.sh
=====================================
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+set -eu
+
+OP=$1
+
+_log () {
+ echo " + ($OP) $*"
+}
+
+reload_apache () {
+ _log "Reloading apache..."
+ sudo apache2ctl graceful
+}
+
+reload_nginx () {
+ _log "Reloading nginx..."
+ sudo systemctl reload nginx
+}
+
+email () {
+ # $1: domain name $6: timestamp of cert creation
+ printf "%s\n\n %s\t%s" \
+ "The following SSL certifcate has just been renewed:" \
+ "$1" "$(date -u -d @"$6")" | \
+ mail -s "R-B SSL certifcate renewed" root
+}
+
+case "$OP" in
+ deploy_cert)
+ shift
+ reload_nginx
+ email "$@"
+ ;;
+ *)
+ ;;
+esac
+
=====================================
hosts/osuosl5-amd64/etc/nginx/nginx.conf
=====================================
@@ -14,41 +14,58 @@ http {
server {
server_name reproduce.debian.net;
- index index.html index.htm index.nginx-debian.html;
- root /var/www/html;
+ index index.html index.htm index.nginx-debian.html;
+ root /var/www/html;
- location / {
- # First attempt to serve request as file, then
- # as directory, then fall back to displaying a 404.
- try_files $uri $uri/ =404;
- }
+ listen 443 ssl; # managed by Certbot
+ ssl_certificate /var/lib/dehydrated/certs/reproduce.debian.net/privkey.pem
+ ssl_certificate_key /var/lib/dehydrated/certs/reproduce.debian.net/fullchain.pem
+ ssl_session_cache shared:le_nginx_SSL:10m;
+ ssl_session_timeout 1440m;
+ ssl_session_tickets off;
+ ssl_protocols TLSv1.2 TLSv1.3;
+ ssl_prefer_server_ciphers off;
+ ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-C
+ HACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";
- location /api/ {
- proxy_pass http://127.0.0.1:8484;
- }
- listen 443 ssl; # managed by Certbot
- ssl_certificate /etc/letsencrypt/live/reproduce.debian.net/fullchain.pem; # managed by Certbot
- ssl_certificate_key /etc/letsencrypt/live/reproduce.debian.net/privkey.pem; # managed by Certbot
- include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
- ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+ location /.well-known/acme-challenge/ {
+ alias /var/lib/letsencrypt.sh/acme-challenges/;
+ disable_symlinks off;
+ autoindex off;
+ }
-}
+ location / {
+ # First attempt to serve request as file, then
+ # as directory, then fall back to displaying a 404.
+ try_files $uri $uri/ =404;
+ }
- server {
- if ($host = reproduce.debian.net) {
- return 301 https://$host$request_uri;
- } # managed by Certbot
+ location /api/ {
+ proxy_pass http://127.0.0.1:8484;
+ }
+ }
+
+ server {
listen 80;
server_name reproduce.debian.net;
- return 404; # managed by Certbot
-
-}
+ location /.well-known/acme-challenge/ {
+ alias /var/lib/letsencrypt.sh/acme-challenges/;
+ disable_symlinks off;
+ autoindex off;
+ }
+
+ location / {
+ return 301 https://$host$request_uri;
+ }
+
+ return 404;
+ }
}
=====================================
hosts/osuosl5-amd64/etc/sudoers.d/letsencrypt
=====================================
@@ -0,0 +1 @@
+letsencrypt ALL=(root) NOPASSWD: /usr/bin/systemctl reload nginx
=====================================
update_jdn.sh
=====================================
@@ -137,7 +137,7 @@ users=$(for i in ${!user_host_groups[@]}; do echo ${i%,*} ; done | sort -u)
# create the letsencrypt group and user in jenkins if needed
# doing it here instead of using the array above as we have to use --system
- if [ "$HOSTNAME" = jenkins ] || [ "$HOSTNAME" = "ionos7-amd64" ]; then
+ if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "ionos7-amd64" ] || [ "$HOSTNAME" = "osuosl5-amd64" ]; then
if ! getent group letsencrypt > /dev/null ; then
sudo addgroup --system letsencrypt
fi
@@ -539,7 +539,11 @@ if [ -f /etc/debian_version ] ; then
esac
# packages needed for reproduce.debian.net running rebuilderd
case $HOSTNAME in
- osuosl4*|osuosl5*) DEBS="$DEBS
+ osuosl5*) DEBS="$DEBS
+ nginx-full
+ dehydrated
+ " ;;
+ osuosl4*) DEBS="$DEBS
nginx-full
python3-certbot-nginx
" ;;
@@ -706,7 +710,7 @@ sudo chown root:root /etc/sudoers.d/jenkins ; sudo chmod 700 /etc/sudoers.d/jenk
sudo chown root:root /etc/sudoers.d/jenkins-adm ; sudo chmod 700 /etc/sudoers.d/jenkins-adm
[ -f /etc/mailname ] || ( echo $HOSTNAME.debian.net | sudo tee /etc/mailname )
-if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "ionos7-amd64" ]; then
+if [ "$HOSTNAME" = "jenkins" ] || [ "$HOSTNAME" = "ionos7-amd64" ] || [ "$HOSTNAME" = "osuosl5-amd64" ]; then
for path in /var/lib/dehydrated /var/lib/dehydrated/acme-challenges; do
if ! dpkg-statoverride --list "$path" > /dev/null; then
sudo dpkg-statoverride --update --add letsencrypt letsencrypt 755 "$path"
View it on GitLab: https://salsa.debian.org/qa/jenkins.debian.net/-/commit/3390622f076735f56e8844c5d86f933984b177e0
--
View it on GitLab: https://salsa.debian.org/qa/jenkins.debian.net/-/commit/3390622f076735f56e8844c5d86f933984b177e0
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/qa-jenkins-scm/attachments/20241112/cd546607/attachment-0001.htm>
More information about the Qa-jenkins-scm
mailing list