* gnu/services/certbot.scm (%default-deploy-hook): New variable.
(<certificate-configuration>)[deploy-hook]: Use it as default deploy hook.
* doc/guix.texi (Certificate services): Document new default deploy hook.
Change-Id: Ibb10481170a6fda7df72492072b939dd6a6ad176
---
doc/guix.texi | 6 +++++-
gnu/services/certbot.scm | 13 +++++++++++--
2 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/doc/guix.texi b/doc/guix.texi
index 58a65fe0b7..0f372a460f 100644
--- a/doc/guix.texi
+++ b/doc/guix.texi
@@ -32681,7 +32681,7 @@ Certificate Services
additionally @code{$CERTBOT_AUTH_OUTPUT} will contain the standard output
of the @code{auth-hook} script.
-@item @code{deploy-hook} (default: @code{#f})
+@item @code{deploy-hook} (default: @code{%default-deploy-hook})
Command to be run in a shell once for each successfully issued
certificate. For this command, the shell variable
@code{$RENEWED_LINEAGE} will point to the config live subdirectory (for
@@ -32690,6 +32690,10 @@ Certificate Services
contain a space-delimited list of renewed certificate domains (for
example, @samp{"example.com www.example.com"}.
+The default deploy hook calls the @code{reload} action of the
+@code{nginx} Shepherd service, to reload the newly generated
+certificates.
+
@item @code{start-self-signed?} (default: @code{#t})
Whether to generate an initial self-signed certificate during system
activation. This option is particularly useful to allow @code{nginx} to
diff --git a/gnu/services/certbot.scm b/gnu/services/certbot.scm
index 10b99f5630..490b9e8d6d 100644
--- a/gnu/services/certbot.scm
+++ b/gnu/services/certbot.scm
@@ -37,7 +37,8 @@ (define-module (gnu services certbot)
#:use-module (srfi srfi-1)
#:use-module (ice-9 format)
#:use-module (ice-9 match)
- #:export (certbot-service-type
+ #:export (%default-deploy-hook
+ certbot-service-type
certbot-configuration
certbot-configuration?
certificate-configuration))
@@ -49,6 +50,14 @@ (define-module (gnu services certbot)
;;; Code:
+(define %default-deploy-hook
+ (program-file
+ "reload-nginx.scm"
+ (with-imported-modules '((gnu services herd))
+ #~(begin
+ (use-modules (gnu services herd))
+ (with-shepherd-action 'nginx ('reload) result result)))))
+
(define-record-type* <certificate-configuration>
certificate-configuration make-certificate-configuration
certificate-configuration?
@@ -65,7 +74,7 @@ (define-record-type* <certificate-configuration>
(cleanup-hook certificate-cleanup-hook
(default #f))
(deploy-hook certificate-configuration-deploy-hook
- (default #f))
+ (default %default-deploy-hook))
(start-self-signed? certificate-configuration-start-self-signed?
(default #t)))
--
2.41.0
