it would be great if, as part of the SSL integration, ikiwiki-hosting would call up on the letsencrypt.org gods to install proper certs.
so far I have done this by hand:
install the letsencrypt client software:
if you are on Debian sid, stretch (or when letsencrypt enters backports):
apt install letsencrypt
otherwise, run the magic commands:
git clone https://github.com/letsencrypt/letsencrypt cd letsencrypt ./letsencrypt-auto --server https://acme-v01.api.letsencrypt.org/directory --help
request a certificate:
sudo -s source venv/bin/activate letsencrypt certonly --webroot \ --server https://acme-v01.api.letsencrypt.org/directory \ --agree-dev-preview --agree-tos \ --webroot-path=/home/w-example/public_html/ \ --domains example.com --email nobody@example.com
... notice how you need to change the two last lines for your environment.
this will create a certificate in
/etc/letsencrypt/live/example.com
. install it where ikiwiki expects it:ln -s /etc/letsencrypt/live/example.com/cert.pem /etc/ikiwiki-hosting/config/w-example/ssl.crt ln -s /etc/letsencrypt/live/example.com/fullchain.pem /etc/ikiwiki-hosting/config/w-example/ssl.chain ln -s /etc/letsencrypt/live/example.com/privkey.pem /etc/ikiwiki-hosting/config/w-example/ssl.key
regenerate the apache configs and restart apache:
ikisite enable example.com service apache2 reload # or restart?
Ikiwiki hosting would need to perform steps 3 to 5, and probably have
a Recommends
on letsencrypt. -- anarcat
Oh, and this could be a plugin, not sure if that would make sense, but it's the way it works on that side of the world.
Finally, note that there is now a fairly large set of Let's Encrypt clients. For example, there is a bash-only client that could work in Wheezy and a much simpler implementation in Python. Those have not been reviewed or tested for compatiblity with ikiwiki-hosting however.
Also, renewals need to be processed in some way.
I would much rather use something small enough to be reviewable, particularly if we're going to have to run it unattended as root; the official Let's Encrypt client is huge. We don't have to worry about portability to non-Debian environments or non-Apache web servers, which takes away a lot of the reason to use something so big. --smcv