search

albertito / chasquid

SMTP (email) server with a focus on simplicity, security, and ease of operation [mirror]
https://blitiri.com.ar/p/chasquid/
Other
868 stars 56 forks source link

TLS Certificate reloading #12

Closed ThinkChaos closed 3 years ago

ThinkChaos commented 3 years ago

Hello, I hope 2020 hasn't treated you too horribly.

I've been using chasquid for a while with a custom docker setup, and my only nit left is when my certificate expires, chasquid doesn't reload it on its own. The solution recommended in the how-to is to use a certbot hook. Unfortunately I can't use that as is because certbot and chasquid run in different containers and only "communicate" via the shared certs directory.

I think adding a FS watcher is overkill (and I'm not even sure it would work across overlayfs/docker volumes), but maybe an HTTP endpoint would be fine. Because of my setup, the HTTP endpoint wouldn't need to be authenticated as I can not expose it to the internet, just to the docker network. So adding an insecure /api endpoint disabled by default could be a simple solution.

Would you be willing to merge something like that? Or have a better idea?

albertito commented 3 years ago

chasquid currently does not support reloading certificates while running, it needs to be restarted to pick up the new ones. This was a conscious decision since implementing cert reloading would introduce significant complexity, for very little gain given how tolerant SMTP is, and how fast chasquid restarts.

chasquid launching a new instance of itself also gets complicated (due to privileged descriptor passing, etc.), that's why nowadays many daemons delegate these things to the launcher (like systemd), instead of trying to handle all this logic themselves (as was more common in the past).

I would, then, focus on ways to restart chasquid in your particular environment. If it had a /quit endpoint in the monitoring server, for example, would that help you? Do you run chasquid with something that would start it again if it dies, like systemd?

Thanks!

ThinkChaos commented 3 years ago

You're right, even restarting would be complex. /quit would be great as I do use an init in Docker that will restart it automatically.

albertito commented 3 years ago

ThinkChaos implemented the /exit handler in #13, commit 99ec58bfcd in next, so I think that should fix this issue.

ThunkChaos, can you confirm the change in next works for you? It's not too late to adjust and amend, so please let me know how it goes.

Thanks!

ThinkChaos commented 3 years ago

I'm now using next and it works great! Looking forward to the next release with this minor change. Thanks!

I'll let you close this issue when you want.

albertito commented 3 years ago

Thanks a lot for the patch and the confirmation!

I think we can now close this, the change will be moved to master in a few days (just to give it more exposure in next in case something comes up), and will be included in the 1.6 release.

Thanks again!