New Server Checklist

Set root password Generate fresh sshd host keys Create admin user Add admin to doas group and test doas SSH key added to admin's authorized_keys Disable root login via ssh Disable password login via ssh Set hostname Run system updates Reboot Install & test postfix

doas.conf

# see doas.conf(5) for configuration details

# Uncomment to allow group "admin" to become root
# permit :admin
permit nopass :admin
permit nopass deploy cmd apk args upgrade -U
permit nopass deploy cmd service args SERVICE restart
permit nopass acme cmd nginx args -s reload

acme setup

TODO: a package could be made to automate many of these steps

doas apk add uacme openssl moreutils doas useradd -md /var/lib/acme -s /sbin/nologin acme doas mkdir -p /etc/ssl/uacme/private /var/www/.well-known/acme-challenge doas chown acme:acme /etc/ssl/uacme /etc/ssl/uacme/private doas chmod g+rX /etc/ssl/uacme /etc/ssl/uacme/private doas chown acme:acme /var/www/.well-known/acme-challenge doas touch /var/log/acme.log doas chown acme:acme /var/log/acme.log doas vim /usr/local/bin/acme-update-certs

#!/bin/sh -eu
exec >>/var/log/acme.log 2>&1
date

stats() {
	cert="/etc/ssl/uacme/$1/cert.pem"
	if ! [ -e "$cert" ]
	then
		return
	fi
	expiration=$(date -d"$(openssl x509 -enddate -noout -in "$cert" \
		| cut -d= -f2)" -D'%b %d %H:%M:%S %Y GMT' +'%s')
	printf '# TYPE certificate_expiration gauge\n'
	printf '# HELP certificate_expiration Timestamp when SSL certificate will expire\n'
	printf 'certificate_expiration{instance="%s"} %s\n' "$1" "$expiration"
}

acme() {
	site=$1
	shift
	/usr/bin/uacme -v -h /usr/share/uacme/uacme.sh issue $site $* || true
	stats $site | curl --data-binary @- https://push.metrics.sr.ht/metrics/job/$site
}

acme DOMAIN SUBDOMAIN...
doas nginx -s reload

doas chmod +x /usr/local/bin/acme-update-certs doas usermod -aG acme nginx doas -u acme uacme new sir@cmpwn.com doas -u acme crontab -e

MAILTO=sir@cmpwn.com
0 0 * * * chronic /usr/local/bin/acme-update-certs

Update nginx configuration (ssl_certificate{,_key} commented) doas -u acme /usr/local/bin/acme-update-certs cat /var/log/acme.log # verify success Update nginx configuration doas chmod -R g+rX /etc/ssl/uacme /etc/ssl/uacme/private doas nginx -s reload Verify website has working SSL

nginx config

server {
	listen 80;
	listen [::]:80;
	server_name DOMAIN;

	location / {
		return 302 https://$server_name$request_uri;
	}

	location ^~ /.well-known {
		root /var/www;
	}
}

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	server_name DOMAIN;
	ssl_certificate /etc/ssl/uacme/DOMAIN/cert.pem;
	ssl_certificate_key /etc/ssl/uacme/private/DOMAIN/key.pem;

	gzip on;
	gzip_types text/css text/html;

	# ...
}