From b845b1c5efc1362dc78baf87747ba8b90fcd97dd Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Sun, 7 Feb 2016 16:28:48 -0400 Subject: letsencrypt * Added Propellor.Property.LetsEncrypt * Apache.httpsVirtualHost: New property, setting up a https vhost with the certificate automatically obtained using letsencrypt. --- src/Propellor/Property/Apache.hs | 134 +++++++++++++++++++++++++++------------ 1 file changed, 95 insertions(+), 39 deletions(-) (limited to 'src/Propellor/Property/Apache.hs') diff --git a/src/Propellor/Property/Apache.hs b/src/Propellor/Property/Apache.hs index 9e192e84..709c1753 100644 --- a/src/Propellor/Property/Apache.hs +++ b/src/Propellor/Property/Apache.hs @@ -4,6 +4,7 @@ import Propellor.Base import qualified Propellor.Property.File as File import qualified Propellor.Property.Apt as Apt import qualified Propellor.Property.Service as Service +import qualified Propellor.Property.LetsEncrypt as LetsEncrypt installed :: Property NoInfo installed = Apt.installed ["apache2"] @@ -14,48 +15,35 @@ restarted = Service.restarted "apache2" reloaded :: Property NoInfo reloaded = Service.reloaded "apache2" --- | A basic virtual host, publishing a directory, and logging to --- the combined apache log file. -virtualHost :: HostName -> Port -> FilePath -> RevertableProperty NoInfo -virtualHost hn (Port p) docroot = siteEnabled hn - [ "" - , "ServerName "++hn++":"++show p - , "DocumentRoot " ++ docroot - , "ErrorLog /var/log/apache2/error.log" - , "LogLevel warn" - , "CustomLog /var/log/apache2/access.log combined" - , "ServerSignature On" - , "" - ] - type ConfigFile = [String] -siteEnabled :: HostName -> ConfigFile -> RevertableProperty NoInfo -siteEnabled hn cf = enable disable - where - enable = combineProperties ("apache site enabled " ++ hn) - [ siteAvailable hn cf +siteEnabled :: Domain -> ConfigFile -> RevertableProperty NoInfo +siteEnabled domain cf = siteEnabled' domain cf siteDisabled domain + +siteEnabled' :: Domain -> ConfigFile -> Property NoInfo +siteEnabled' domain cf = combineProperties ("apache site enabled " ++ domain) + [ siteAvailable domain cf + `requires` installed + `onChange` reloaded + , check (not <$> isenabled) + (cmdProperty "a2ensite" ["--quiet", domain]) `requires` installed `onChange` reloaded - , check (not <$> isenabled) - (cmdProperty "a2ensite" ["--quiet", hn]) - `requires` installed - `onChange` reloaded - ] - disable = siteDisabled hn - isenabled = boolSystem "a2query" [Param "-q", Param "-s", Param hn] - -siteDisabled :: HostName -> Property NoInfo -siteDisabled hn = combineProperties - ("apache site disabled " ++ hn) - (map File.notPresent (siteCfg hn)) - `onChange` (cmdProperty "a2dissite" ["--quiet", hn] `assume` MadeChange) + ] + where + isenabled = boolSystem "a2query" [Param "-q", Param "-s", Param domain] + +siteDisabled :: Domain -> Property NoInfo +siteDisabled domain = combineProperties + ("apache site disabled " ++ domain) + (map File.notPresent (siteCfg domain)) + `onChange` (cmdProperty "a2dissite" ["--quiet", domain] `assume` MadeChange) `requires` installed `onChange` reloaded -siteAvailable :: HostName -> ConfigFile -> Property NoInfo -siteAvailable hn cf = combineProperties ("apache site available " ++ hn) $ - map (`File.hasContent` (comment:cf)) (siteCfg hn) +siteAvailable :: Domain -> ConfigFile -> Property NoInfo +siteAvailable domain cf = combineProperties ("apache site available " ++ domain) $ + map (`File.hasContent` (comment:cf)) (siteCfg domain) where comment = "# deployed with propellor, do not modify" @@ -86,12 +74,12 @@ listenPorts ps = "/etc/apache2/ports.conf" `File.hasContent` map portline ps -- This is a list of config files because different versions of apache -- use different filenames. Propellor simply writes them all. -siteCfg :: HostName -> [FilePath] -siteCfg hn = +siteCfg :: Domain -> [FilePath] +siteCfg domain = -- Debian pre-2.4 - [ "/etc/apache2/sites-available/" ++ hn + [ "/etc/apache2/sites-available/" ++ domain -- Debian 2.4+ - , "/etc/apache2/sites-available/" ++ hn ++ ".conf" + , "/etc/apache2/sites-available/" ++ domain ++ ".conf" ] -- | Configure apache to use SNI to differentiate between @@ -123,3 +111,71 @@ allowAll = unlines , "Require all granted" , "" ] + +type WebRoot = FilePath + +-- | A basic virtual host, publishing a directory, and logging to +-- the combined apache log file. Not https capable. +virtualHost :: Domain -> Port -> WebRoot -> RevertableProperty NoInfo +virtualHost domain (Port p) docroot = siteEnabled domain + [ "" + , "ServerName "++domain++":"++show p + , "DocumentRoot " ++ docroot + , "ErrorLog /var/log/apache2/error.log" + , "LogLevel warn" + , "CustomLog /var/log/apache2/access.log combined" + , "ServerSignature On" + , "" + ] + +-- | A virtual host using https, with the certificate obtained +-- using `Propellor.Property.LetsEncrypt.letsEncrypt`. +-- +-- http connections are redirected to https. +-- +-- Example: +-- +-- > httpsVirtualHost "example.com" "/var/www" +-- > (LetsEncrypt.AgreeTos (Just "me@my.domain")) +httpsVirtualHost :: Domain -> WebRoot -> LetsEncrypt.AgreeTOS -> Property NoInfo +httpsVirtualHost domain docroot letos = setup + `requires` modEnabled "rewrite" + `requires` modEnabled "ssl" + `before` LetsEncrypt.letsEncrypt letos domain docroot certinstaller + where + setup = siteEnabled' domain $ + -- The sslconffile is only created after letsencrypt gets + -- the cert. The "*" is needed to make apache not error + -- when the file doesn't exist. + ("IncludeOptional " ++ sslconffile "*") + : vhost (Port 80) + [ "RewriteEngine On" + -- Pass through .well-known directory on http for the + -- letsencrypt acme challenge. + , "RewriteRule ^/.well-known/(.*) - [L]" + -- Everything else redirects to https + , "RewriteRule ^/(.*) https://" ++ domain ++ "/$1 [L,R,NE]" + ] + certinstaller _domain certfile privkeyfile chainfile _fullchainfile = + File.hasContent (sslconffile "letsencrypt") + ( vhost (Port 443) + [ "SSLEngine on" + , "SSLCertificateFile " ++ certfile + , "SSLCertificateKeyFile" ++ privkeyfile + , "SSLCertificateChainFile " ++ chainfile + ] + ) + -- always reload; the cert has changed + `before` reloaded + sslconffile s = "/etc/apache2/sites-available/ssl/" ++ domain ++ "/" ++ s ++ ".conf" + vhost (Port p) ls = + [ "" + , "ServerName "++domain++":"++show p + , "DocumentRoot " ++ docroot + , "ErrorLog /var/log/apache2/error.log" + , "LogLevel warn" + , "CustomLog /var/log/apache2/access.log combined" + , "ServerSignature On" + ] ++ ls ++ + [ "" + ] -- cgit v1.3-2-g0d8e From c90282fc7bb77bcba19cdd4adfe96af3fb1162f8 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Sun, 7 Feb 2016 16:54:17 -0400 Subject: propellor spin --- src/Propellor/Property/Apache.hs | 35 ++++++++++++++++++++---- src/Propellor/Property/SiteSpecific/JoeySites.hs | 24 ++++++---------- 2 files changed, 38 insertions(+), 21 deletions(-) (limited to 'src/Propellor/Property/Apache.hs') diff --git a/src/Propellor/Property/Apache.hs b/src/Propellor/Property/Apache.hs index 709c1753..5b8128a4 100644 --- a/src/Propellor/Property/Apache.hs +++ b/src/Propellor/Property/Apache.hs @@ -15,7 +15,9 @@ restarted = Service.restarted "apache2" reloaded :: Property NoInfo reloaded = Service.reloaded "apache2" -type ConfigFile = [String] +type ConfigLine = String + +type ConfigFile = [ConfigLine] siteEnabled :: Domain -> ConfigFile -> RevertableProperty NoInfo siteEnabled domain cf = siteEnabled' domain cf siteDisabled domain @@ -101,7 +103,7 @@ multiSSL = check (doesDirectoryExist "/etc/apache2/conf.d") $ -- -- Works with multiple versions of apache that have different ways to do -- it. -allowAll :: String +allowAll :: ConfigLine allowAll = unlines [ "" , "Order allow,deny" @@ -112,12 +114,27 @@ allowAll = unlines , "" ] +-- | Config file fragment that can be inserted into a +-- stanza to allow apache to display directory index icons. +iconDir :: ConfigLine +iconDir = unlines + [ "" + , "Options Indexes MultiViews" + , "AllowOverride None" + , allowAll + , " " + ] + type WebRoot = FilePath -- | A basic virtual host, publishing a directory, and logging to -- the combined apache log file. Not https capable. virtualHost :: Domain -> Port -> WebRoot -> RevertableProperty NoInfo -virtualHost domain (Port p) docroot = siteEnabled domain +virtualHost domain (Port p) docroot = virtualHost' domain (Port p) docroot [] + +-- | Like `virtualHost` but with additional config lines added. +virtualHost' :: Domain -> Port -> WebRoot -> [ConfigLine] -> RevertableProperty NoInfo +virtualHost' domain (Port p) docroot addedcfg = siteEnabled domain $ [ "" , "ServerName "++domain++":"++show p , "DocumentRoot " ++ docroot @@ -125,7 +142,9 @@ virtualHost domain (Port p) docroot = siteEnabled domain , "LogLevel warn" , "CustomLog /var/log/apache2/access.log combined" , "ServerSignature On" - , "" + ] + ++ addedcfg ++ + [ "" ] -- | A virtual host using https, with the certificate obtained @@ -138,7 +157,11 @@ virtualHost domain (Port p) docroot = siteEnabled domain -- > httpsVirtualHost "example.com" "/var/www" -- > (LetsEncrypt.AgreeTos (Just "me@my.domain")) httpsVirtualHost :: Domain -> WebRoot -> LetsEncrypt.AgreeTOS -> Property NoInfo -httpsVirtualHost domain docroot letos = setup +httpsVirtualHost domain docroot letos = httpsVirtualHost' domain docroot letos [] + +-- | Like `httpsVirtualHost` but with additional config lines added. +httpsVirtualHost' :: Domain -> WebRoot -> LetsEncrypt.AgreeTOS -> [ConfigLine] -> Property NoInfo +httpsVirtualHost' domain docroot letos addedcfg = setup `requires` modEnabled "rewrite" `requires` modEnabled "ssl" `before` LetsEncrypt.letsEncrypt letos domain docroot certinstaller @@ -176,6 +199,6 @@ httpsVirtualHost domain docroot letos = setup , "LogLevel warn" , "CustomLog /var/log/apache2/access.log combined" , "ServerSignature On" - ] ++ ls ++ + ] ++ ls ++ addedcfg ++ [ "" ] diff --git a/src/Propellor/Property/SiteSpecific/JoeySites.hs b/src/Propellor/Property/SiteSpecific/JoeySites.hs index 03f2efcb..0bb98489 100644 --- a/src/Propellor/Property/SiteSpecific/JoeySites.hs +++ b/src/Propellor/Property/SiteSpecific/JoeySites.hs @@ -18,6 +18,7 @@ import qualified Propellor.Property.Apache as Apache import qualified Propellor.Property.Postfix as Postfix import qualified Propellor.Property.Systemd as Systemd import qualified Propellor.Property.Fail2Ban as Fail2Ban +import qualified Propellor.Property.LetsEncrypt as LetsEncrypt import Utility.FileMode import Data.List @@ -290,24 +291,21 @@ annexWebSite origin hn uuid remotes = propertyList (hn ++" website using git-ann , "git update-server-info" ] addremote (name, url) = "git remote add " ++ shellEscape name ++ " " ++ shellEscape url - setupapache = apacheSite hn True + setupapache = Apache.httpsVirtualHost' hn dir letos [ " ServerAlias www."++hn - , "" - , " DocumentRoot /srv/web/"++hn - , " " - , " Options FollowSymLinks" - , " AllowOverride None" - , Apache.allowAll - , " " - , " " + , Apache.iconDir + , " " , " Options Indexes FollowSymLinks ExecCGI" , " AllowOverride None" , " AddHandler cgi-script .cgi" , " DirectoryIndex index.html index.cgi" - , Apache.allowAll + , Apache.allowAll , " " ] +letos :: LetsEncrypt.AgreeTOS +letos = LetsEncrypt.AgreeTOS (Just "id@joeyh.name") + apacheSite :: HostName -> Bool -> Apache.ConfigFile -> RevertableProperty NoInfo apacheSite hn withssl middle = Apache.siteEnabled hn $ apachecfg hn withssl middle @@ -329,11 +327,7 @@ apachecfg hn withssl middle , " CustomLog /var/log/apache2/access.log combined" , " ServerSignature On" , " " - , " " - , " Options Indexes MultiViews" - , " AllowOverride None" - , Apache.allowAll - , " " + , Apache.iconDir , "" ] where -- cgit v1.3-2-g0d8e From 648e1e50a015636d129bd4d7357c779688685cc0 Mon Sep 17 00:00:00 2001 From: Joey Hess Date: Sun, 7 Feb 2016 17:04:34 -0400 Subject: propellor spin --- src/Propellor/Property/Apache.hs | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) (limited to 'src/Propellor/Property/Apache.hs') diff --git a/src/Propellor/Property/Apache.hs b/src/Propellor/Property/Apache.hs index 5b8128a4..e841be9e 100644 --- a/src/Propellor/Property/Apache.hs +++ b/src/Propellor/Property/Apache.hs @@ -180,16 +180,19 @@ httpsVirtualHost' domain docroot letos addedcfg = setup , "RewriteRule ^/(.*) https://" ++ domain ++ "/$1 [L,R,NE]" ] certinstaller _domain certfile privkeyfile chainfile _fullchainfile = - File.hasContent (sslconffile "letsencrypt") - ( vhost (Port 443) + combineProperties (domain ++ " ssl cert installed") + [ File.dirExists (takeDirectory cf) + , File.hasContent cf $ vhost (Port 443) [ "SSLEngine on" , "SSLCertificateFile " ++ certfile , "SSLCertificateKeyFile" ++ privkeyfile , "SSLCertificateChainFile " ++ chainfile ] - ) -- always reload; the cert has changed - `before` reloaded + , reloaded + ] + where + cf = sslconffile "letsencrypt" sslconffile s = "/etc/apache2/sites-available/ssl/" ++ domain ++ "/" ++ s ++ ".conf" vhost (Port p) ls = [ "" -- cgit v1.3-2-g0d8e