;;; Tyreunom's system administration and configuration tools.

;;;

;;; Copyright © 2019 Julien Lepiller <julien@lepiller.eu>

;;;

;;; This program is free software: you can redistribute it and/or modify

;;; it under the terms of the GNU General Public License as published by

;;; the Free Software Foundation, either version 3 of the License, or

;;; (at your option) any later version.

;;;

;;; This program is distributed in the hope that it will be useful,

;;; but WITHOUT ANY WARRANTY; without even the implied warranty of

;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the

;;; GNU General Public License for more details.

;;;

;;; You should have received a copy of the GNU General Public License

;;; along with this program.  If not, see <http://www.gnu.org/licenses/>.

;;

;; Certbot configuration tools

;;

(define-module (config certbot)

  #:use-module (gnu services)

  #:use-module (gnu services certbot)

  #:use-module (guix gexp)

  #:export (certbot-service))

(define %nginx-deploy-hook

  (program-file

   "nginx-deploy-hook"

   #~(let ((pid (call-with-input-file "/var/run/nginx/pid" read))

           (cert-dir (getenv "RENEWED_LINEAGE")))

       (let ((privkey (string-append cert-dir "/privkey.pem")))

         ;; certbot private keys are world-readable by default, and smptd complains

         ;; about that, refusing to start :/

         (chmod privkey #o6000))

       (kill pid SIGHUP))))

(define AT "@")

(define (certbot-service domains-list)

  (service certbot-service-type

    (certbot-configuration

      (email (string-append "certs" AT "lepiller.eu"))

      (webroot "/srv/http/certbot")

      (rsa-key-size 4096)

      (certificates

        (map

          (lambda (domains)

            (certificate-configuration

              (domains domains)

              (deploy-hook %nginx-deploy-hook)))

          domains-list)))))