diff options
Diffstat (limited to 'configs')
| -rw-r--r-- | configs/nginx/certbot.ctx-server.conf | 5 | ||||
| -rw-r--r-- | configs/nginx/nginx.conf | 11 | ||||
| -rw-r--r-- | configs/os/services/kvmd-certbot.service | 8 | ||||
| -rw-r--r-- | configs/os/services/kvmd-certbot.timer | 10 | ||||
| -rw-r--r-- | configs/os/sysusers.conf | 5 | ||||
| -rw-r--r-- | configs/os/tmpfiles.conf | 8 |
6 files changed, 41 insertions, 6 deletions
diff --git a/configs/nginx/certbot.ctx-server.conf b/configs/nginx/certbot.ctx-server.conf new file mode 100644 index 00000000..6c8ea525 --- /dev/null +++ b/configs/nginx/certbot.ctx-server.conf @@ -0,0 +1,5 @@ +location /.well-known/acme-challenge { + root /run/kvmd-certbot/webroot; + include /etc/kvmd/nginx/loc-nocache.conf; + auth_request off; +} diff --git a/configs/nginx/nginx.conf b/configs/nginx/nginx.conf index 81b8265d..6b08c68e 100644 --- a/configs/nginx/nginx.conf +++ b/configs/nginx/nginx.conf @@ -27,11 +27,11 @@ http { keepalive_timeout 10; client_max_body_size 4k; - client_body_temp_path /tmp/kvmd-nginx.client_body_temp; - fastcgi_temp_path /tmp/kvmd-nginx.fastcgi_temp; - proxy_temp_path /tmp/kvmd-nginx.proxy_temp; - scgi_temp_path /tmp/kvmd-nginx.scgi_temp; - uwsgi_temp_path /tmp/kvmd-nginx.uwsgi_temp; + client_body_temp_path /tmp/kvmd-nginx/client_body_temp; + fastcgi_temp_path /tmp/kvmd-nginx/fastcgi_temp; + proxy_temp_path /tmp/kvmd-nginx/proxy_temp; + scgi_temp_path /tmp/kvmd-nginx/scgi_temp; + uwsgi_temp_path /tmp/kvmd-nginx/uwsgi_temp; include /etc/kvmd/nginx/kvmd.ctx-http.conf; include /usr/share/kvmd/extras/*/nginx.ctx-http.conf; @@ -47,6 +47,7 @@ http { include /etc/kvmd/nginx/listen-https.conf; include /etc/kvmd/nginx/ssl.conf; include /etc/kvmd/nginx/kvmd.ctx-server.conf; + include /etc/kvmd/nginx/certbot.ctx-server.conf; include /usr/share/kvmd/extras/*/nginx.ctx-server.conf; } } diff --git a/configs/os/services/kvmd-certbot.service b/configs/os/services/kvmd-certbot.service new file mode 100644 index 00000000..bf505aea --- /dev/null +++ b/configs/os/services/kvmd-certbot.service @@ -0,0 +1,8 @@ +[Unit] +Description=PiKVM - Certbot-Renew for KVMD-Nginx + +[Service] +Type=oneshot +ExecStart=/usr/bin/kvmd-certbot renew --quiet +# Should we?.. +# PrivateTmp=true diff --git a/configs/os/services/kvmd-certbot.timer b/configs/os/services/kvmd-certbot.timer new file mode 100644 index 00000000..84fc9fcd --- /dev/null +++ b/configs/os/services/kvmd-certbot.timer @@ -0,0 +1,10 @@ +[Unit] +Description=Run KVMD-Certbot twice daily + +[Timer] +OnCalendar=*-*-* 00/12:00:00 +RandomizedDelaySec=12h +Persistent=true + +[Install] +WantedBy=timers.target diff --git a/configs/os/sysusers.conf b/configs/os/sysusers.conf index a24fbef9..b25179b8 100644 --- a/configs/os/sysusers.conf +++ b/configs/os/sysusers.conf @@ -4,6 +4,7 @@ g kvmd-ipmi - - g kvmd-vnc - - g kvmd-nginx - - g kvmd-janus - - +g kvmd-certbot - - u kvmd - "PiKVM - The main daemon" - u kvmd-pst - "PiKVM - Persistent storage" - @@ -11,6 +12,7 @@ u kvmd-ipmi - "PiKVM - IPMI to KVMD proxy" - u kvmd-vnc - "PiKVM - VNC to KVMD/Streamer proxy" - u kvmd-nginx - "PiKVM - HTTP entrypoint" - u kvmd-janus - "PiKVM - Janus WebRTC Gateway" - +u kvmd-certbot - "PiKVM - Certbot-Renew for KVMD-Nginx" m kvmd video m kvmd gpio @@ -26,3 +28,6 @@ m kvmd-janus audio m kvmd-nginx kvmd m kvmd-nginx kvmd-janus +m kvmd-nginx kvmd-certbot + +m kvmd-certbot kvmd-pst diff --git a/configs/os/tmpfiles.conf b/configs/os/tmpfiles.conf index 8e1734d2..973c5d43 100644 --- a/configs/os/tmpfiles.conf +++ b/configs/os/tmpfiles.conf @@ -1 +1,7 @@ -D /run/kvmd 0775 kvmd kvmd - +D /run/kvmd 0775 kvmd kvmd - +D /run/kvmd-certbot 0755 root root - +D /run/kvmd-certbot/webroot 0755 kvmd-certbot kvmd-certbot - + +D /tmp/kvmd 0775 kvmd kvmd - +D /tmp/kvmd-nginx 0700 kvmd-nginx root - +D /tmp/kvmd-certbot 0755 kvmd-certbot kvmd-certbot - |