2022-09-16 17:26:21 +02:00
|
|
|
# Note: since I am assuming GNU Make and this host run OpenBSD, remember to run
|
|
|
|
|
# this dag using `gmake` instead of `make`
|
|
|
|
|
|
2022-09-16 16:20:06 +02:00
|
|
|
WD=/var/lib/dags/acme_rsync
|
|
|
|
|
|
2022-09-16 17:26:21 +02:00
|
|
|
SMTPD_RESTART=$(WD)/smtpd_restart
|
|
|
|
|
DOVECOT_RELOAD=$(WD)/dovecot_reload
|
|
|
|
|
SYNC_CERTS=$(WD)/sync_certs
|
|
|
|
|
|
2022-09-16 16:20:06 +02:00
|
|
|
.PHONY: all sync_certs
|
|
|
|
|
|
2022-09-16 17:26:21 +02:00
|
|
|
all: sync_certs $(SMTPD_RESTART) $(DOVECOT_RELOAD)
|
|
|
|
|
|
2022-09-16 16:20:06 +02:00
|
|
|
|
|
|
|
|
###############################################################################
|
|
|
|
|
|
|
|
|
|
CERTS_PATH=/srv/certs/acme
|
|
|
|
|
|
|
|
|
|
MONOTREMATA_DOMAIN=monotremata.xyz
|
|
|
|
|
MONOTREMATA_PATH=$(CERTS_PATH)/$(MONOTREMATA_DOMAIN)
|
|
|
|
|
MONOTREMATA_CERT=$(MONOTREMATA_PATH)/fullchain.cer
|
|
|
|
|
MONOTREMATA_KEY=$(MONOTREMATA_PATH)/$(MONOTREMATA_DOMAIN).key
|
|
|
|
|
|
|
|
|
|
###############################################################################
|
|
|
|
|
# Sync the certificates using rsync. Because `sync` is a phony
|
|
|
|
|
# target, it will be run each time, but the certificate files will only be
|
|
|
|
|
# updated if a renewal happens
|
|
|
|
|
|
2022-09-16 17:26:21 +02:00
|
|
|
$(MONOTREMATA_CERT): $(SYNC_CERTS)
|
|
|
|
|
$(MONOTREMATA_KEY): $(SYNC_CERTS)
|
2022-09-16 16:20:06 +02:00
|
|
|
|
|
|
|
|
REMOTE_ACME_PATH=rsync://user@narwhal/acme
|
|
|
|
|
RSYNCD_PASSWD=/srv/secrets/rsyncd_password
|
2022-09-16 17:26:21 +02:00
|
|
|
RSYNC_OPTS=--archive --delete --compress --verbose --human-readable
|
2022-09-16 16:20:06 +02:00
|
|
|
|
|
|
|
|
sync_certs:
|
|
|
|
|
mkdir -p $(CERTS_PATH)
|
|
|
|
|
rsync \
|
|
|
|
|
$(RSYNC_OPTS) \
|
|
|
|
|
--password-file=$(RSYNCD_PASSWD) \
|
|
|
|
|
$(REMOTE_ACME_PATH) \
|
|
|
|
|
$(CERTS_PATH)
|
2022-09-16 17:26:21 +02:00
|
|
|
|
|
|
|
|
###############################################################################
|
|
|
|
|
|
|
|
|
|
SSL_PATH=/etc/ssl
|
|
|
|
|
CERT_DEST=$(SSL_PATH)/monotremata.xyz.fullchain.pem
|
|
|
|
|
KEY_DEST=$(SSL_PATH)/private/monotremata.xyz.key
|
|
|
|
|
|
|
|
|
|
$(CERT_DEST): $(MONOTREMATA_CERT)
|
|
|
|
|
install -m 444 $< $@
|
|
|
|
|
|
|
|
|
|
$(KEY_DEST): $(MONOTREMATA_KEY)
|
|
|
|
|
install -m 400 $< $@
|
|
|
|
|
|
|
|
|
|
###############################################################################
|
|
|
|
|
|
|
|
|
|
$(SMTPD_RESTART): $(CERT_DEST) $(KEY_DEST)
|
|
|
|
|
mkdir -p $(@D)
|
|
|
|
|
rcctl restart smtpd
|
|
|
|
|
touch $@
|
|
|
|
|
|
|
|
|
|
###############################################################################
|
|
|
|
|
|
|
|
|
|
$(DOVECOT_RELOAD): $(CERT_DEST) $(KEY_DEST)
|
|
|
|
|
mkdir -p $(@D)
|
|
|
|
|
rcctl reload dovecot
|
|
|
|
|
touch $@
|
|
|
|
|
|
|
|
|
|
###############################################################################
|
