New Server Checklist

Set root password Generate fresh sshd host keys Create admin user Add admin to doas group and test doas SSH key added to admin's authorized_keys Disable root login via ssh Disable password login via ssh Set hostname Run system updates Reboot Install & test postfix

doas.conf

	# see doas.conf(5) for configuration details

	# Uncomment to allow group "admin" to become root
	# permit :admin
	permit nopass :admin
	permit nopass deploy cmd apk args upgrade -U
	permit nopass deploy cmd service args SERVICE restart
	permit nopass acme cmd nginx args -s reload

acme setup

TODO: a package could be made to automate many of these steps

doas apk add uacme openssl moreutils doas useradd -md /var/lib/acme -s /sbin/nologin acme doas mkdir -p /etc/ssl/uacme/private /var/www/.well-known/acme-challenge doas chown acme:acme /etc/ssl/uacme /etc/ssl/uacme/private doas chmod g+rX /etc/ssl/uacme /etc/ssl/uacme/private doas chown acme:acme /var/www/.well-known/acme-challenge doas touch /var/log/acme.log doas chown acme:acme /var/log/acme.log doas vim /usr/local/bin/acme-update-certs

#!/bin/sh -eu
	exec >>/var/log/acme.log 2>&1
	date

	stats() {
		cert="/etc/ssl/uacme/$1/cert.pem"
		if ! [ -e "$cert" ]
		then
			return
		fi
		expiration=$(date -d"$(openssl x509 -enddate -noout -in "$cert" \
			| cut -d= -f2)" -D'%b %d %H:%M:%S %Y GMT' +'%s')
		printf '# TYPE certificate_expiration gauge\n'
		printf '# HELP certificate_expiration Timestamp when SSL certificate will expire\n'
		printf 'certificate_expiration{instance="%s"} %s\n' "$1" "$expiration"
	}

	acme() {
		site=$1
		shift
		/usr/bin/uacme -v -h /usr/share/uacme/uacme.sh issue $site $* || true
		stats $site | curl --data-binary @- https://push.metrics.sr.ht/metrics/job/$site
	}

	acme DOMAIN SUBDOMAIN...
	doas nginx -s reload

doas chmod +x /usr/local/bin/acme-update-certs doas usermod -aG acme nginx doas -u acme uacme new sir@cmpwn.com doas -u acme crontab -e

MAILTO=sir@cmpwn.com
	0 0 * * * chronic /usr/local/bin/acme-update-certs

Update nginx configuration (ssl_certificate{,_key} commented) doas -u acme /usr/local/bin/acme-update-certs cat /var/log/acme.log # verify success Update nginx configuration doas chmod -R g+rX /etc/ssl/uacme /etc/ssl/uacme/private doas nginx -s reload Verify website has working SSL

nginx config

	server {
		listen 80;
		listen [::]:80;
		server_name DOMAIN;

		location / {
			return 302 https://$server_name$request_uri;
		}

		location ^~ /.well-known {
			root /var/www;
		}
	}

	server {
		listen 443 ssl http2;
		listen [::]:443 ssl http2;
		server_name DOMAIN;
		ssl_certificate /etc/ssl/uacme/DOMAIN/cert.pem;
		ssl_certificate_key /etc/ssl/uacme/private/DOMAIN/key.pem;

		gzip on;
		gzip_types text/css text/html;

		# ...
	}