Hi Guix, This patch series is a few changes to make certbot default to doing "the right thing" in the common case of wanting certificates for an nginx web server.
The initial change (in v1 of these patches) was to solve the certbot bootstrapping problem. Nginx won't start without valid certificates, but certbot can't produce certificates without a functional nginx. This is solved by generating self-signed certificates to start with, and then replacing them once certbot has run. Doing this requires storing certificates in a different location (because certbot is very particular). I've chosen /etc/certs/. The other two changes (new to v2 of this series) make things a bit easier to use: a one-shot shepherd service to renew certificates when the machine starts up, and a default deploy-hook to reload the nginx configuration (which picks up the new certificates). I think these changes make certbot "do the right thing", at the expense of being slightly more magical. On IRC podiki suggested I should copy guix-devel and Brice (the original bug reporter), so I've done that, too. Carlo Zancanaro (4): services: certbot: Symlink certificates to /etc/certs. services: certbot: Create self-signed certificates before certbot runs. services: certbot: Add a default deploy hook to reload nginx. services: certbot: Add one-shot service to renew certificates. doc/guix.texi | 38 ++++++--- gnu/services/certbot.scm | 178 ++++++++++++++++++++++++++++++++++++--- 2 files changed, 188 insertions(+), 28 deletions(-) base-commit: 144c95032e517bb8ce466b930fe91506bcc92b2b -- 2.41.0