[bug#29467] [PATCH] web: Don't error about missing ssl related files.

[julien lepiller]

Le 2017-11-27 09:26, Christopher Baines a écrit :
> Erroring here prevents doing things like building a system using nginx 
> on a
> different machine from where it's intended to be deployed, or creating
> containers and VMs that use the ssl-certificate parts of the nginx
> configuration, without also getting these files to exist.
>
> * gnu/services/web.scm (emit-nginx-server-config): Don't error on 
> missing ssl
>   related files.
> ---
>  gnu/services/web.scm | 10 ----------
>  1 file changed, 10 deletions(-)
>
> diff --git a/gnu/services/web.scm b/gnu/services/web.scm
> index 9d713003c..1af32278c 100644
> --- a/gnu/services/web.scm
> +++ b/gnu/services/web.scm
> @@ -191,16 +191,6 @@ of index files."
>              (syntax-parameterize ((<> (identifier-syntax x*)))
>                (list tail ...))
>              '())))
> -    (for-each
> -     (match-lambda
> -      ((record-key . file)
> -       (if (and file (not (file-exists? file)))
> -           (error
> -            (simple-format
> -             #f
> -             "~A in the nginx configuration for the server with name
> \"~A\" does not exist" record-key server-name)))))
> -     `(("ssl-certificate"     . ,ssl-certificate)
> -       ("ssl-certificate-key" . ,ssl-certificate-key)))
>      (list
>       "    server {\n"
>       (and/l http-port  "      listen " (number->string <>) ";\n")

Hi, when configuring nginx for the first time, users will probably 
forget to
configure ssl properly. The default is to enable ssl and find 
certificates in
/etc/nginx. When these files don't exist, nginx will fail to start and 
at least
one user complained it was hard to debug. This code was introduced to 
prevent
such a mistake.

Maybe we should set the default to #f (but then users would have to 
configure
more fields to enable https). Maybe we should add a configuration option 
like
warn-only? (default to #f) to only warn about missing files. Or maybe 
there's
a way to show nginx that another service is providing that file?

I agree there is an issue, but your patch feels like a regression to me 
for the
documented use-cases. WDYT?