Certificate access by group about acme-redirect HOT 2 OPEN

I've tried to implement this and ran into issues because the systemd unit is too locked down to modify anything that isn't a child of /var/lib/acme-redirect (this means we can't modify or create the directory itself). I'd rather keep this restriction in place instead of opening it up to modify everything in /var/lib, which means we need to rely on system-tempfiles again, which means the directory is going to have a hardcoded group.

It's still possible to implement this with a different approach:

• make /var/lib/acme-redirect o+x
• make /var/lib/acme-redirect/* o-rwx
• set the group from the config for /var/lib/acme-redirect/*

from acme-redirect.

I havn't dug into the PR or how setting a group would help, but here's one I used today: Setting up Apache was easy because it only needs to read the public key. Exim wants to read the private key. Rather than muching with the actual ownership, adding an ACL for the exim group to have read access:

[cert]
name = "example.com"
dns_names = [
	"example.com",
]
exec = [
	"setfacl -m g:exim:r /var/lib/acme-redirect/live/example.com/privkey",
	"systemctl reload exim",
]

I wasn't even sure whether the file node would get destroyed on updates or the ACL get blown away, but there you have it. Assuming the order of exec is deterministic...

from acme-redirect.