mirror of
https://github.com/chatmail/relay.git
synced 2026-05-13 01:24:36 +00:00
4ebde2825d
* dovecot: enable login names with square brackets * config: make IPv4-only relays use self-signed TLS certs * postfix: make delivery for IP-only relays work * cmdeploy: skip DNS checks for IPv4 only relays * www: generate dclogin codes for IPv4-only relays * opendkim: disable DKIM signing on ipv4-only relays * get delivery working * get tests working on IPv4 only machine * doc: document IPv4-only relays * dns: warn if mail_domain is an IP, instead of checking DNS * config: validate domains when formatting them * ci: add cmlxc testing for no-DNS relays * ci: run no-dns and normal CI in parallel * retain "config.mail_domain" as the domain part of @ email addresses, so for ipv4 relays "[1.2.3.4]" and introduce config.ipv4_relay and config.mail_domain_bare helpers. * ci: migrate from --no-dns to --type ipv4 for cmlxc compatibility * cleanup dead code, fix docs, fixate cmlxc version --------- Co-authored-by: missytake <missytake@systemli.org>
42 lines
1.3 KiB
Python
42 lines
1.3 KiB
Python
from pyinfra import host
|
|
from pyinfra.facts.files import File
|
|
|
|
from ..basedeploy import Deployer
|
|
|
|
|
|
class ExternalTlsDeployer(Deployer):
|
|
"""Expects TLS certificates to be managed on the server.
|
|
|
|
Validates that the configured certificate and key files
|
|
exist on the remote host. Installs a systemd path unit
|
|
that watches the certificate file and automatically
|
|
restarts/reloads affected services when it changes.
|
|
"""
|
|
|
|
def __init__(self, cert_path, key_path):
|
|
self.cert_path = cert_path
|
|
self.key_path = key_path
|
|
|
|
def configure(self):
|
|
# Verify cert and key exist on the remote host using pyinfra facts.
|
|
for path in (self.cert_path, self.key_path):
|
|
if host.get_fact(File, path=path) is None:
|
|
raise Exception(f"External TLS file not found on server: {path}")
|
|
|
|
self.ensure_systemd_unit(
|
|
"external/tls-cert-reload.path.j2",
|
|
cert_path=self.cert_path,
|
|
)
|
|
self.ensure_systemd_unit(
|
|
"external/tls-cert-reload.service",
|
|
)
|
|
|
|
def activate(self):
|
|
# No explicit reload needed here: dovecot/nginx read the cert
|
|
# on startup, and the .path watcher handles live changes.
|
|
self.ensure_service(
|
|
"tls-cert-reload.path",
|
|
running=True,
|
|
enabled=True,
|
|
)
|