nixpkgs/nixos/doc/manual
Arian van Putten 604b7c139f Fix letsencrypt (#60219)
* nixos/acme: Fix ordering of cert requests

When subsequent certificates would be added, they would
not wake up nginx correctly due to target units only being triggered
once. We now added more fine-grained systemd dependencies to make sure
nginx always is aware of new certificates and doesn't restart too early
resulting in a crash.

Furthermore, the acme module has been refactored. Mostly to get
rid of the deprecated PermissionStartOnly systemd options which were
deprecated. Below is a summary of changes made.

* Use SERVICE_RESULT to determine status
This was added in systemd v232. we don't have to keep track
of the EXITCODE ourselves anymore.

* Add regression test for requesting mutliple domains

* Deprecate 'directory' option
We now use systemd's StateDirectory option to manage
create and permissions of the acme state directory.

* The webroot is created using a systemd.tmpfiles.rules rule
instead of the preStart script.

* Depend on certs directly

By getting rid of the target units, we make sure ordering
is correct in the case that you add new certs after already
having deployed some.

Reason it broke before:  acme-certificates.target would
be in active state, and if you then add a new cert, it
would still be active and hence nginx would restart
without even requesting a new cert. Not good!  We
make the dependencies more fine-grained now. this should fix that

* Remove activationDelay option

It complicated the code a lot, and is rather arbitrary. What if
your activation script takes more than activationDelay seconds?

Instead, one should use systemd dependencies to make sure some
action happens before setting the certificate live.

e.g. If you want to wait until your cert is published in DNS DANE /
TLSA, you could create a unit that blocks until it appears in DNS:

```
RequiredBy=acme-${cert}.service
After=acme-${cert}.service
ExecStart=publish-wait-for-dns-script
```
2019-08-29 16:32:59 +02:00
..
administration doc: Use prompt more often 2019-06-17 13:25:50 +02:00
configuration nixos/xserver: add option to install custom xkb layouts (#47764) 2019-07-26 20:43:37 +02:00
development nixos docs: add release manager section 2019-08-23 10:10:12 -04:00
installation remove all instances of nix-env -i without -A in the NixOS manual 2019-08-17 18:04:43 +02:00
release-notes Fix letsencrypt (#60219) 2019-08-29 16:32:59 +02:00
.gitignore nixos docs: ignore generated files 2018-05-01 19:50:02 -04:00
default.nix Extract NixOS options documentation generation to a function 2019-08-08 16:18:09 +02:00
Makefile nixos manual Makefile: improve purity 2019-03-22 14:48:08 +01:00
man-configuration.xml nixos docs: format =) 2018-05-01 19:57:09 -04:00
man-nixos-build-vms.xml nixos-build-vms: pass --option to nix-build 2019-02-04 10:46:12 +01:00
man-nixos-enter.xml nixos-enter: silent activation script option 2019-08-13 23:48:58 +02:00
man-nixos-generate-config.xml doc: Use prompt more often 2019-06-17 13:25:50 +02:00
man-nixos-install.xml doc: Use prompt more often 2019-06-17 13:25:50 +02:00
man-nixos-option.xml doc: Use prompt more often 2019-06-17 13:25:50 +02:00
man-nixos-rebuild.xml Merge pull request #66561 from Ma27/document-user-services-on-rebuild 2019-08-13 16:43:40 +02:00
man-nixos-version.xml nixos/doc: ran make format 2018-05-31 21:03:51 -04:00
man-pages.xml nixos/doc+manual: change copyright year 2018->2019 2019-08-02 10:45:04 -05:00
manual.xml docs: format 2018-09-29 20:51:11 -04:00
README
shell.nix doc: Adds xml fixing script. (see previous and next commits) 2018-05-31 21:02:15 -04:00

To build the manual, you need Nix installed on your system (no need
for NixOS). To install Nix, follow the instructions at

    https://nixos.org/nix/download.html

When you have Nix on your system, in the root directory of the project
(i.e., `nixpkgs`), run:

    nix-build nixos/release.nix -A manual.x86_64-linux

When this command successfully finishes, it will tell you where the
manual got generated.