dags/fugu/acme_rsync/Makefile

76 lines
2.0 KiB
Makefile
Raw Normal View History

2022-09-23 10:38:10 +02:00
# Note: since I am assuming GNU Make and this host runs OpenBSD, remember to
# run this dag using `gmake` instead of `make`
2022-09-16 17:26:21 +02:00
2022-09-16 16:20:06 +02:00
WD=/var/lib/dags/acme_rsync
2022-09-16 17:26:21 +02:00
SMTPD_RESTART=$(WD)/smtpd_restart
DOVECOT_RELOAD=$(WD)/dovecot_reload
SYNC_CERTS=$(WD)/sync_certs
2022-09-16 16:20:06 +02:00
.PHONY: all sync_certs
2022-09-16 17:26:21 +02:00
all: sync_certs $(SMTPD_RESTART) $(DOVECOT_RELOAD)
2022-09-16 16:20:06 +02:00
###############################################################################
2022-09-16 18:27:15 +02:00
ACME_DIR=/srv/certs/acme
DOMAIN=monotremata.xyz
CERT_PATH=$(ACME_DIR)/$(DOMAIN)
CERT=$(CERT_PATH)/fullchain.cer
KEY=$(CERT_PATH)/$(DOMAIN).key
2022-09-16 16:20:06 +02:00
###############################################################################
# Sync the certificates using rsync. Because `sync` is a phony
# target, it will be run each time, but the certificate files will only be
# updated if a renewal happens
2022-09-16 18:27:15 +02:00
$(CERT): $(SYNC_CERTS)
$(KEY): $(SYNC_CERTS)
2022-09-16 16:20:06 +02:00
2022-09-23 10:38:10 +02:00
RSYNCD_HOST=narwhal
RSYNCD_USER=user
GOPASS=doas -u gopass gopass
RSYNC_PASSWORD = $(shell $(GOPASS) $(RSYNCD_HOST)/rsyncd/$(RSYNCD_USER))
REMOTE_ACME_PATH=rsync://$(RSYNCD_USER)@$(RSYNCD_HOST)/acme
2022-09-16 17:26:21 +02:00
RSYNC_OPTS=--archive --delete --compress --verbose --human-readable
2022-09-16 16:20:06 +02:00
sync_certs:
2022-09-16 18:27:15 +02:00
mkdir -p $(ACME_DIR)
2022-09-23 10:38:10 +02:00
@echo "running rsync"
@export RSYNC_PASSWORD=$(RSYNC_PASSWORD); \
2022-09-16 16:20:06 +02:00
rsync \
$(RSYNC_OPTS) \
$(REMOTE_ACME_PATH) \
2022-09-16 18:27:15 +02:00
$(ACME_DIR)
2022-09-16 17:26:21 +02:00
###############################################################################
SSL_PATH=/etc/ssl
CERT_DEST=$(SSL_PATH)/monotremata.xyz.fullchain.pem
KEY_DEST=$(SSL_PATH)/private/monotremata.xyz.key
2022-09-16 18:27:15 +02:00
$(CERT_DEST): $(CERT)
2022-09-16 17:26:21 +02:00
install -m 444 $< $@
2022-09-16 18:27:15 +02:00
$(KEY_DEST): $(KEY)
2022-09-16 17:26:21 +02:00
install -m 400 $< $@
###############################################################################
$(SMTPD_RESTART): $(CERT_DEST) $(KEY_DEST)
mkdir -p $(@D)
rcctl restart smtpd
touch $@
###############################################################################
$(DOVECOT_RELOAD): $(CERT_DEST) $(KEY_DEST)
mkdir -p $(@D)
rcctl reload dovecot
touch $@
###############################################################################