Git-Mirrors/graphene-os-server-infrastructure
1
0
Fork 0
mirror of https://github.com/GrapheneOS/infrastructure.git synced 2025-12-12 07:06:02 -05:00
Code Issues Projects Releases Packages Wiki Activity

integrate dnsdist in session ticket keys management

Browse source
This commit is contained in:
Daniel Micay 2025-05-27 14:46:25 -04:00
parent 6555042a88
commit 57a5209d8b
3 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

2
etc/systemd/system/create-session-ticket-keys.service
View file

@ -1,6 +1,6 @@
[Unit] [Unit]
Description=Create TLS session ticket keys Description=Create TLS session ticket keys
Before=nginx.service Before=dnsdist.service nginx.service
[Service] [Service]
ExecStart=/usr/local/bin/create-session-ticket-keys ExecStart=/usr/local/bin/create-session-ticket-keys

4
etc/systemd/system/rotate-session-ticket-keys.service
View file

@ -1,7 +1,7 @@
[Unit] [Unit]
Description=Rotate TLS session ticket keys Description=Rotate TLS session ticket keys
After=nginx.service create-session-ticket-keys.service After=dnsdist.service nginx.service create-session-ticket-keys.service
Requires=nginx.service create-session-ticket-keys.service Requires=create-session-ticket-keys.service
[Service] [Service]
ExecStart=/usr/local/bin/rotate-session-ticket-keys ExecStart=/usr/local/bin/rotate-session-ticket-keys

5
rotate-session-ticket-keys
View file

@ -13,4 +13,9 @@ rm new.key
cat {1..4}.key > keys.new cat {1..4}.key > keys.new
rsync -I keys.new keys rsync -I keys.new keys
rm keys.new rm keys.new
if systemctl is-enabled nginx.service >/dev/null; then
nginx -s reload nginx -s reload
fi
if systemctl is-enabled dnsdist.service >/dev/null; then
dnsdist -c -e 'reloadAllCertificates()'
fi