Trellis: Let’s Encrypt integration

[swalkinshaw]

Placeholder issue to investigate easier SSL certificate integration/creation once Let's Encrypt launches: https://letsencrypt.org/

[louim]

:+1: :heart_eyes:

[retlehs]

if anyone hears or sees anything about beta signups, please let us know!

According to https://letsencrypt.org/2015/08/07/updated-lets-encrypt-launch-schedule.html72, the Let's Encrypt CA is planning for general availability of its services in the week of November 16, 2015. If you use the client before then (except as part of a beta test program), you would receive a test certificate that is not signed by a publicly-trusted CA, and that is not accepted by browsers.

related discussion: https://community.letsencrypt.org/t/is-there-a-beta-test-program-i-can-sign-up-for/119

[retlehs]

https://github.com/thefinn93/ansible-letsencrypt

[mxxcon]

According to https://letsencrypt.org/2015/11/12/public-beta-timing.html

Let’s Encrypt will enter Public Beta on December 3, 2015. Once we’ve entered Public Beta our systems will be open to anyone who would like to request a certificate. There will no longer be a requirement to sign up and wait for an invitation.

[mAAdhaTTah]

Looks like someone is developing a wp-cli command: https://github.com/tollmanz/lets-encrypt-wp

Maybe we should use that, and add the related cronjob so it auto-renews every 90 days?

[kalenjohnson]

Applicable: https://deliciousbrains.com/http2-https-lets-encrypt-wordpress/

[swalkinshaw]

I highly doubt we'll want to use the WP plugin. I'm assuming that's more for people without the benefit of tools like Ansible :)

[mAAdhaTTah]

@kalenjohnson that was my source for the plugin :D

[evanfuture]

On a live server, I've had no trouble setting up my certs (well, with Apache anyway). The trouble comes in development, when I'm using a non-existent url, site_slug.dev, and it won't complete. Other than that, it seems easy enough to ansible-ize the whole process... (he says confidently, then, weeks later, shakes his head in shame)

[joshrickert]

Seems more practical to use LetsEncrypt for the live server and a self-signed cert for the development VM.

[mxxcon]

@swalkinshaw however, that got me thinking...if letsencrypt renewal process will happen only with Ansible, it won't renew if I don't have any deploys during the lifetime of a cert. Don't forget that these certs are only 30-90 days in age.

[swalkinshaw]

@mxxcon we can implement a monthly cronjob

[louim]

I think the point is to allow Ansible to setup the ACME client, which will take care of the auto-renewal by itself.

FWIW, I don't think the WordPress plugin will ever work, because it would need to have elevated access (aka Root) to be able to edit Nginx configuration.

[erikbelusic]

hey all,

i was just thinking about this a bit. i am a laravel forge user, and the way taylor seemed to attack this is that he has a monthly cron that updates the cert. maybe we can add a flag to one of the configuration files for "usesLetsEncrypt" and when set to true it provisions with an additional cronjob that can go out and renew + install the new SSL cert

[mattmcgiv]

Was looking into this issue this morning and came across a Digital Ocean article for using Let's Encrypt w/ nginx.

For anyone interested, this section in particular seems relevant to creating the cron job to renew the cert

[landerss0n]

I would love to see this!

[vdrnn]

I wonder if anyone is already working on this?
Otherwise I could try to implement it. However, I'd need some guidance since I'm lacking of Ansible knowledge but eager to dig into it.
I guess the way to go is to work with ansible-letsencrypt?

[swalkinshaw]

No one has actively started work on this yet. There's a few ansible modules that already exist for it but all of them are very lacking (from what I've seen). That one doesn't handle renewals yet which is a requirement since they expire every 90 days.

[joshrickert]

It's probably better for the ecosystem to submit a PR addressing the related issue in ansible-letsencrypt and then integrate that project as a dependency here.

[retlehs]

we haven't made a decision to use that project yet, and probably won't use it. from the project owner on the issue you linked:

I initially made this for personal use

what's best for the ecosystem isn't necessarily just to start hacking away at something just because there's some groundwork put in...

[QWp6t]

We should keep an eye on dis, esp if we still gon switch 2 debops.

https://github.com/debops/ansible-pki/pull/33

[swalkinshaw]

See https://github.com/roots/trellis/pull/518