Caddy certificate directory

Caddy has its caddy group. Allow it to read certificates:

mkdir -p /etc/hukudo/certs

chgrp caddy /etc/hukudo/
chmod 750 /etc/hukudo/

chgrp caddy /etc/hukudo/certs/
chmod 2750 /etc/hukudo/certs/

stat -c "%a %n" /etc/hukudo/ /etc/hukudo/certs/

Use the setgid bit, because when a new file is written, the group should be inherited from the parent directory instead of the writer’s default group. This way, another user can simply write the certificate. Use this for push-based certificate deployment: A central server (e.g. enterprise) can get certificates from Lets Encrypt and push them through a secure channel.

Push Certificates

First, get certs, for example using Lego and the DNS challenge.

export LEGO_PATH="~/.lego"
export HETZNER_API_TOKEN=
lego -d 'example.com' \
    -d '*.example.com' \
    --dns hetzner \
    --dns.resolvers 213.133.100.98:53,88.198.229.192:53,193.47.99.5:53 \
    --email hostmaster@example.com \
    run
# use "renew" instead of "run" to renew certs

Next, push them.

rsync ~/.lego/certificates/example.com.* root@example.com:/etc/hukudo/certs/

Github Token