[bug#26685] certbot service experience

[Ludovic Courtès]

Hello Chris!

Christopher Allan Webber <address@hidden> skribis:

> Yay!  But oh nooooo!  I really should have replied to this!  I had
> stopped working on it because I got overloaded with final-push situation
> in ActivityPub.

Understood, no problem!  We’ve had seven months and I thought we’d
rather make progress on this than let everyone re-implement more-or-less
the same service.

> Maybe this is worth moving to the mailing list instead, but one reason I
> didn't push it was I had discovered a significant and serious
> issue... building a system based off of its config is no longer
> determistic based off of the system config alone... because this
> checks for the rpesence of nginx-server-configuration-ssl-certificate
> at *build* time of the system config.  The following code is the
> culprit:

OK, I agree it’s a problem.

That said, the ‘file-exists?’ check comes from an earlier and IIUC
unrelated commit, f2d7a492df759ab7416ff4b244e37896835f04fa.

> Relatedly, the current setup has these defaults:
> 
>   (ssl-certificate     nginx-server-configuration-ssl-certificate
>                        (default "/etc/nginx/cert.pem"))
>   (ssl-certificate-key nginx-server-configuration-ssl-certificate-key
>                        (default "/etc/nginx/key.pem"))
> 
> IMO they should probably default to #f so that looking for the files
> doesn't fail to boot nginx.

I agree (apparently it comes from a Sept. 2016 commit,
8c00b83818acbbc3dfd406465e50439c3418afc5.)

Could you send a patch?  :-)

Thanks,
Ludo’.