982c5a1f0e
- Use an acme user and group, allow group override only
- Use hashes to determine when certs actually need to regenerate
- Avoid running lego more than necessary
- Harden permissions
- Support "systemctl clean" for cert regeneration
- Support reuse of keys between some configuration changes
- Permissions fix services solves for previously root owned certs
- Add a note about multiple account creation and emails
- Migrate extraDomains to a list
- Deprecate user option
- Use minica for self-signed certs
- Rewrite all tests
I thought of a few more cases where things may go wrong,
and added tests to cover them. In particular, the web server
reload services were depending on the target - which stays alive,
meaning that the renewal timer wouldn't be triggering a reload
and old certs would stay on the web servers.
I encountered some problems ensuring that the reload took place
without accidently triggering it as part of the test. The sync
commands I added ended up being essential and I'm not sure why,
it seems like either node.succeed ends too early or there's an
oddity of the vm's filesystem I'm not aware of.
- Fix duplicate systemd rules on reload services
Since useACMEHost is not unique to every vhost, if one cert
was reused many times it would create duplicate entries in
${server}-config-reload.service for wants, before and
ConditionPathExists
41 lines
1 KiB
Nix
41 lines
1 KiB
Nix
import ./make-test-python.nix {
|
|
name = "postfix";
|
|
|
|
machine = { pkgs, ... }: {
|
|
imports = [ common/user-account.nix ];
|
|
services.postfix = {
|
|
enable = true;
|
|
enableSubmissions = true;
|
|
submissionsOptions = {
|
|
smtpd_tls_security_level = "none";
|
|
};
|
|
};
|
|
|
|
environment.systemPackages = let
|
|
checkConfig = pkgs.writeScriptBin "check-config" ''
|
|
#!${pkgs.python3.interpreter}
|
|
import sys
|
|
|
|
state = 1
|
|
success = False
|
|
|
|
with open("/etc/postfix/master.cf") as masterCf:
|
|
for line in masterCf:
|
|
if state == 1 and line.startswith("submissions"):
|
|
state = 2
|
|
elif state == 2 and line.startswith(" ") and "smtpd_tls_security_level=encrypt" in line:
|
|
success = True
|
|
elif state == 2 and not line.startswith(" "):
|
|
state == 3
|
|
if not success:
|
|
sys.exit(1)
|
|
'';
|
|
|
|
in [ checkConfig ];
|
|
};
|
|
|
|
testScript = ''
|
|
machine.wait_for_unit("postfix.service")
|
|
machine.succeed("check-config")
|
|
'';
|
|
}
|