diff --git a/README.rst b/README.rst index 0a5577e..33fa18d 100644 --- a/README.rst +++ b/README.rst @@ -1,5 +1,5 @@ -modoboa-installer -================= +**modoboa-installer** +===================== |workflow| |codecov| @@ -76,7 +76,7 @@ If you want more information about the installation process, add the ``--debug`` option to your command line. Upgrade mode ------------- +============ An experimental upgrade mode is available. @@ -92,7 +92,7 @@ You can activate it as follows:: It will automatically install latest versions of modoboa and its plugins. Backup mode ------------ +=========== An experimental backup mode is available. @@ -129,7 +129,7 @@ configuration file (set enabled to False). This can be useful for larger instance. Restore mode ------------- +============ An experimental restore mode is available. @@ -140,7 +140,7 @@ You can start the process as follows:: Then wait for the process to finish. Change the generated hostname ------------------------------ +============================= By default, the installer will setup your email server using the following hostname: ``mail.``. If you want a different @@ -159,22 +159,37 @@ modifications. Finally, run the installer without the ``--stop-after-configfile-check`` option. -Let's Encrypt certificate -------------------------- +Certificate +=========== + +Self-signed +----------- + +It is the default way of the installer, it is however +not recommended for production use. We recommend using +letsencrypt for production. Using Letsencrypt imply that +you accept their Tos (see bellow) + +Letsencrypt +----------- .. warning:: - Please note this option requires the hostname you're using to be - valid (ie. it can be resolved with a DNS query) and to match the - server you're installing Modoboa on. + Please note that by using this option, you aggree to the `ToS + `_ of + letsencrypt and that your IP will be logged (see ToS) + Please also note this option requires the hostname you're using to be + valid (ie. it can be resolved with a DNS query) and to match the + server you're installing Modoboa on. If you want to generate a valid certificate using `Let's Encrypt `_, edit the ``installer.cfg`` file and modify the following settings:: [certificate] - generate = true type = letsencrypt + tls_cert_file_path = + tls_key_file_path = [letsencrypt] email = admin@example.com @@ -182,6 +197,24 @@ modify the following settings:: Change the ``email`` setting to a valid value since it will be used for account recovery. +Manual +------ + +.. warning:: + It is not possible to configure manual certs interactively. + To do so, please run ``run.py`` with `--stop-after-configfile-check`, + configure your file as desired and apply the configuration as + written bellow. Then run ``run.py`` without + `--stop-after-configfile-check` or `--interactive`. + +If you want to use already generated certs, simply edit the +``installer.cfg`` file and modify the following settings:: + + [certificate] + type = manual + tls_cert_file_path = *path to tls key file* + tls_key_file_path = * path to tls fullchain file* + .. |workflow| image:: https://github.com/modoboa/modoboa-installer/workflows/Modoboa%20installer/badge.svg .. |codecov| image:: http://codecov.io/github/modoboa/modoboa-installer/coverage.svg?branch=master :target: http://codecov.io/github/modoboa/modoboa-installer?branch=master diff --git a/modoboa_installer/config_dict_template.py b/modoboa_installer/config_dict_template.py index bfd8f72..55d4580 100644 --- a/modoboa_installer/config_dict_template.py +++ b/modoboa_installer/config_dict_template.py @@ -30,16 +30,25 @@ ConfigDictTemplate = [ { "name": "certificate", "values": [ - { - "option": "generate", - "default": "true", - }, { "option": "type", "default": "self-signed", "customizable": True, "question": "Please choose your certificate type", - "values": ["self-signed", "letsencrypt"], + "value_return": ["manual"], + "values": ["self-signed", "letsencrypt", "manual"], + }, + { + "option": "tls_cert_file_path", + "customizable": True, + "question": "Please enter your certificate fullchain path", + "default": "" + }, + { + "option": "tls_key_file_path", + "customizable": True, + "question": "Please enter your certificate key path", + "default": "" } ], }, diff --git a/modoboa_installer/ssl.py b/modoboa_installer/ssl.py index a76ef67..a4c61a7 100644 --- a/modoboa_installer/ssl.py +++ b/modoboa_installer/ssl.py @@ -25,6 +25,34 @@ class CertificateBackend(object): return True +class ManualCertification(CertificateBackend): + """Use certificate provided.""" + + def __init__(self, *args, **kwargs): + super().__init__(*args, **kwargs) + path_correct = True + self.tls_cert_file_path = self.config.get("certificate", + "tls_key_file_path") + self.tls_key_file_path = self.config.get("certificate", + "tls_cert_file_path") + + if not os.path.exists(self.tls_key_file_path): + utils.error("'tls_key_file_path' path is not accessible") + path_correct = False + if not os.path.exists(self.tls_cert_file_path): + utils.error("'tls_cert_file_path' path is not accessible") + path_correct = False + + if not path_correct: + sys.exit(1) + + def generate_cert(self): + self.config.set("general", "tls_key_file", + self.tls_key_file_path) + self.config.set("general", "tls_cert_file", + self.tls_cert_file_path) + + class SelfSignedCertificate(CertificateBackend): """Create a self signed certificate.""" @@ -119,8 +147,9 @@ class LetsEncryptCertificate(CertificateBackend): def get_backend(config): """Return the appropriate backend.""" - if not config.getboolean("certificate", "generate"): - return None - if config.get("certificate", "type") == "letsencrypt": + cert_type = config.get("certificate", "type") + if cert_type == "letsencrypt": return LetsEncryptCertificate(config) + if cert_type == "manual": + return ManualCertification(config) return SelfSignedCertificate(config) diff --git a/modoboa_installer/utils.py b/modoboa_installer/utils.py index 2332273..edab3bb 100644 --- a/modoboa_installer/utils.py +++ b/modoboa_installer/utils.py @@ -316,6 +316,19 @@ def get_entry_value(entry, interactive): if entry.get("values") and user_value != "": user_value = values[int(user_value)] + + condition = ( + entry.get("value_return") and + user_value in entry.get("value_return") + ) + if condition: + error(f"{user_value} cannot be set interactively, " + "Please configure installer.cfg manually by running " + "'python3 run.py ----stop-after-configfile-check domain'. " + "Check modoboa-installer Readme for more information." + ) + sys.exit(1) + return user_value if user_value else default_value