Module tls 

choir node tls — the one step that needs root, and nothing else does.

Obtaining a certificate is privileged: certbot writes /etc/letsencrypt, and the renewal hook that keeps it working lives under the same tree. Running a node is not privileged, and must not become so. scripts/flip/setup_tls.sh states that split for the operator’s own dogfood host; this is the same split for somebody who installed a binary and has no checkout to run a script out of.

Why this is a separate command rather than something host sudoes

choir host --domain <name> prints one sudo line and stops. It does not shell out to sudo itself, for two reasons that are the same reason twice: a tool that escalates on your behalf has to be trusted about what it escalated, and the only honest way to show that is to make the privileged thing a command with a name, so it appears in --help, in the shell history, and in sudo’s log as itself rather than as an argument to something else.

What renewal does

The daemon reads its certificate once, when it binds. There is no reload; a rotated pair reaches the running node only through a restart. So the deploy hook certbot runs after every successful renewal is what closes the loop: it re-projects the pair into the node user’s state directory and restarts the user unit. Nothing here runs on a timer of ours — certbot’s own timer is the schedule.

Examples

use choir_cli::tls::Plan;

let plan = Plan::new("node.example", 8417, "choir", std::path::Path::new("/home/choir"));
// The marker the node reads is two lines under the node's own state
// directory, never a path into /etc/letsencrypt: the live directory
// is root-owned by design, and an unprivileged node that reads it
// works exactly until the first renewal rotates the files.
assert!(plan.marker.ends_with("tls.enabled"));
assert!(plan.cert.starts_with("/home/choir/.choir/tls"));

Structs

Plan

Everything the certificate step will touch, built before anything is done so a refusal can name all of it.

Step

One step of the certificate run, for printing as it happens.

Enums

Challenge

How the ACME challenge is answered.

Issuance

How far to go.

Constants

HOOK_DIR

Where certbot’s deploy hooks live. Fixed by certbot, not by us.

HOOK_NAME

The name of the hook this installs, and the one node uninstall names when it says what it left behind.

Functions

apply

Performs the privileged half, in the order that survives a failure at any point.

certbot_argv

The certbot invocation, built but not run.

expiry

The expiry date openssl reads out of a certificate.

hook_script

The deploy hook certbot runs after every successful renewal.

preflight

Everything that must be true before the first privileged byte.

uid

This process’s user id, as a string, for the root check and the hook.