mirror of
https://git.kore.io/kore.git
synced 2024-11-11 20:59:07 +01:00
c78535aa5d
A new acme process is created that communicates with the acme servers. This process does not hold any of your private keys (no account keys, no domain keys etc). Whenever the acme process requires a signed payload it will ask the keymgr process to do the signing with the relevant keys. This process is also sandboxed with pledge+unveil on OpenBSD and seccomp syscall filtering on Linux. The implementation only supports the tls-alpn-01 challenge. This means that you do not need to open additional ports on your machine. http-01 and dns-01 are currently not supported (no wildcard support). A new configuration option "acme_provider" is available and can be set to the acme server its directory. By default this will point to the live letsencrypt environment: https://acme-v02.api.letsencrypt.org/directory The acme process can be controlled via the following config options: - acme_root (where the acme process will chroot/chdir into). - acme_runas (the user the acme process will run as). If none are set, the values from 'root' and 'runas' are taken. If you want to turn on acme for domains you do it as follows: domain kore.io { acme yes } You do not need to specify certkey/certfile anymore, if they are present still they will be overwritten by the acme system. The keymgr will store all certificates and keys under its root (keymgr_root), the account key is stored as "/account-key.pem" and all obtained certificates go under "certificates/<domain>/fullchain.pem" while keys go under "certificates/<domain>/key.pem". Kore will automatically renew certificates if they will expire in 7 days or less.
215 lines
5.1 KiB
Makefile
215 lines
5.1 KiB
Makefile
# Kore Makefile
|
|
|
|
CC?=cc
|
|
PREFIX?=/usr/local
|
|
OBJDIR?=obj
|
|
KORE=kore
|
|
KODEV=kodev/kodev
|
|
KORE_CRYPTO?=crypto
|
|
INSTALL_DIR=$(PREFIX)/bin
|
|
MAN_DIR?=$(PREFIX)/share/man
|
|
SHARE_DIR=$(PREFIX)/share/kore
|
|
INCLUDE_DIR=$(PREFIX)/include/kore
|
|
|
|
PLATFORM=platform.h
|
|
VERSION=src/version.c
|
|
|
|
S_SRC= src/kore.c src/buf.c src/config.c src/connection.c \
|
|
src/domain.c src/filemap.c src/fileref.c src/json.c src/mem.c \
|
|
src/msg.c src/module.c src/net.c src/pool.c src/runtime.c src/timer.c \
|
|
src/utils.c src/worker.c src/keymgr.c $(VERSION)
|
|
|
|
FEATURES=
|
|
FEATURES_INC=
|
|
|
|
CFLAGS+=-Wall -Werror -Wstrict-prototypes -Wmissing-prototypes
|
|
CFLAGS+=-Wmissing-declarations -Wshadow -Wpointer-arith -Wcast-qual
|
|
CFLAGS+=-Wsign-compare -Iinclude/kore -I$(OBJDIR) -std=c99 -pedantic
|
|
CFLAGS+=-DPREFIX='"$(PREFIX)"' -fstack-protector-all
|
|
|
|
ifneq ("$(OPENSSL_PATH)", "")
|
|
CFLAGS+=-I$(OPENSSL_PATH)/include
|
|
LDFLAGS=-rdynamic -L$(OPENSSL_PATH)/lib -lssl -l$(KORE_CRYPTO)
|
|
else
|
|
LDFLAGS=-rdynamic -lssl -l$(KORE_CRYPTO)
|
|
endif
|
|
|
|
ifneq ("$(KORE_SINGLE_BINARY)", "")
|
|
CFLAGS+=-DKORE_SINGLE_BINARY
|
|
FEATURES+=-DKORE_SINGLE_BINARY
|
|
endif
|
|
|
|
ifneq ("$(DEBUG)", "")
|
|
CFLAGS+=-DKORE_DEBUG -g
|
|
FEATURES+=-DKORE_DEBUG
|
|
NOOPT=1
|
|
endif
|
|
|
|
ifneq ("$(NOOPT)", "")
|
|
CFLAGS+=-O0
|
|
else
|
|
CFLAGS+=-O2
|
|
endif
|
|
|
|
ifneq ("$(NOSENDFILE)", "")
|
|
CFLAGS+=-DKORE_NO_SENDFILE
|
|
endif
|
|
|
|
ifneq ("$(NOHTTP)", "")
|
|
CFLAGS+=-DKORE_NO_HTTP
|
|
FEATURES+=-DKORE_NO_HTTP
|
|
else
|
|
S_SRC+= src/auth.c src/accesslog.c src/http.c \
|
|
src/validator.c src/websocket.c
|
|
endif
|
|
|
|
ifneq ("$(PGSQL)", "")
|
|
S_SRC+=src/pgsql.c
|
|
LDFLAGS+=-L$(shell pg_config --libdir) -lpq
|
|
CFLAGS+=-I$(shell pg_config --includedir) -DKORE_USE_PGSQL \
|
|
-DPGSQL_INCLUDE_PATH="\"$(shell pg_config --includedir)\""
|
|
FEATURES+=-DKORE_USE_PGSQL
|
|
FEATURES_INC+=-I$(shell pg_config --includedir)
|
|
endif
|
|
|
|
ifneq ("$(TASKS)", "")
|
|
S_SRC+=src/tasks.c
|
|
LDFLAGS+=-lpthread
|
|
CFLAGS+=-DKORE_USE_TASKS
|
|
FEATURES+=-DKORE_USE_TASKS
|
|
endif
|
|
|
|
ifneq ("$(JSONRPC)", "")
|
|
S_SRC+=src/jsonrpc.c
|
|
LDFLAGS+=-lyajl
|
|
CFLAGS+=-DKORE_USE_JSONRPC
|
|
FEATURES+=-DKORE_USE_JSONRPC
|
|
endif
|
|
|
|
ifneq ("$(PYTHON)", "")
|
|
S_SRC+=src/python.c
|
|
KORE_PYTHON_LIB?=$(shell ./misc/python3-config.sh --ldflags)
|
|
KORE_PYTHON_INC?=$(shell ./misc/python3-config.sh --includes)
|
|
LDFLAGS+=$(KORE_PYTHON_LIB)
|
|
CFLAGS+=$(KORE_PYTHON_INC) -DKORE_USE_PYTHON
|
|
FEATURES+=-DKORE_USE_PYTHON
|
|
FEATURES_INC+=$(KORE_PYTHON_INC)
|
|
endif
|
|
|
|
OSNAME=$(shell uname -s | sed -e 's/[-_].*//g' | tr A-Z a-z)
|
|
ifeq ("$(OSNAME)", "freebsd")
|
|
KORE_CURL_LIB=-L/usr/local/lib -lcurl
|
|
KORE_CURL_INC=-I/usr/local/include
|
|
endif
|
|
|
|
ifneq ("$(ACME)", "")
|
|
S_SRC+=src/acme.c
|
|
CURL=1
|
|
CFLAGS+=-DKORE_USE_ACME
|
|
FEATURES+=-DKORE_USE_ACME
|
|
endif
|
|
|
|
ifneq ("$(CURL)", "")
|
|
S_SRC+=src/curl.c
|
|
KORE_CURL_LIB?=$(shell curl-config --libs)
|
|
KORE_CURL_INC?=$(shell curl-config --cflags)
|
|
LDFLAGS+=$(KORE_CURL_LIB)
|
|
CFLAGS+=$(KORE_CURL_INC) -DKORE_USE_CURL
|
|
FEATURES+=-DKORE_USE_CURL
|
|
FEATURES_INC+=$(KORE_CURL_INC)
|
|
endif
|
|
|
|
ifneq ("$(SANITIZE)", "")
|
|
CFLAGS+=-fsanitize=$(SANITIZE)
|
|
LDFLAGS+=-fsanitize=$(SANITIZE)
|
|
endif
|
|
|
|
ifeq ("$(OSNAME)", "darwin")
|
|
CFLAGS+=-I/opt/local/include/ -I/usr/local/opt/openssl/include
|
|
LDFLAGS+=-L/opt/local/lib -L/usr/local/opt/openssl/lib
|
|
S_SRC+=src/bsd.c
|
|
else ifeq ("$(OSNAME)", "linux")
|
|
CFLAGS+=-D_GNU_SOURCE=1 -U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2
|
|
LDFLAGS+=-ldl
|
|
S_SRC+=src/linux.c src/seccomp.c
|
|
else
|
|
S_SRC+=src/bsd.c
|
|
ifneq ("$(JSONRPC)", "")
|
|
CFLAGS+=-I/usr/local/include
|
|
LDFLAGS+=-L/usr/local/lib
|
|
endif
|
|
endif
|
|
|
|
S_OBJS= $(S_SRC:src/%.c=$(OBJDIR)/%.o)
|
|
|
|
all: $(PLATFORM) $(VERSION) $(KORE) $(KODEV)
|
|
|
|
$(PLATFORM): $(OBJDIR) force
|
|
@if [ -f misc/$(OSNAME)-platform.sh ]; then \
|
|
misc/$(OSNAME)-platform.sh > $(OBJDIR)/$(PLATFORM) ; \
|
|
fi
|
|
|
|
$(VERSION): force
|
|
@if [ -d .git ]; then \
|
|
GIT_REVISION=`git rev-parse --short=8 HEAD`; \
|
|
GIT_BRANCH=`git rev-parse --abbrev-ref HEAD`; \
|
|
rm -f $(VERSION); \
|
|
printf "const char *kore_version = \"%s-%s\";\n" \
|
|
$$GIT_BRANCH $$GIT_REVISION > $(VERSION); \
|
|
elif [ -f RELEASE ]; then \
|
|
printf "const char *kore_version = \"%s\";\n" \
|
|
`cat RELEASE` > $(VERSION); \
|
|
else \
|
|
echo "No version information found (no .git or RELEASE)"; \
|
|
exit 1; \
|
|
fi
|
|
|
|
$(KODEV):
|
|
$(MAKE) -C kodev
|
|
|
|
$(KORE): $(OBJDIR) $(S_OBJS)
|
|
$(CC) $(S_OBJS) $(LDFLAGS) -o $(KORE)
|
|
@echo $(FEATURES) $(FEATURES_INC) > kore.features
|
|
|
|
objects: $(OBJDIR) $(PLATFORM) $(S_OBJS)
|
|
@echo $(LDFLAGS) > $(OBJDIR)/ldflags
|
|
@echo "$(FEATURES) $(FEATURES_INC)" > $(OBJDIR)/features
|
|
|
|
$(OBJDIR):
|
|
@mkdir -p $(OBJDIR)
|
|
|
|
install:
|
|
mkdir -p $(SHARE_DIR)
|
|
mkdir -p $(INCLUDE_DIR)
|
|
mkdir -p $(INSTALL_DIR)
|
|
mkdir -p $(MAN_DIR)/man1
|
|
install -m 644 share/man/kodev.1 $(MAN_DIR)/man1/kodev.1
|
|
install -m 555 $(KORE) $(INSTALL_DIR)/$(KORE)
|
|
install -m 644 kore.features $(SHARE_DIR)/features
|
|
install -m 644 include/kore/*.h $(INCLUDE_DIR)
|
|
$(MAKE) -C kodev install
|
|
|
|
uninstall:
|
|
rm -f $(INSTALL_DIR)/$(KORE)
|
|
rm -rf $(INCLUDE_DIR)
|
|
rm -rf $(SHARE_DIR)
|
|
$(MAKE) -C kodev uninstall
|
|
|
|
$(OBJDIR)/%.o: src/%.c
|
|
$(CC) $(CFLAGS) -c $< -o $@
|
|
|
|
clean:
|
|
rm -f $(VERSION)
|
|
find . -type f -name \*.o -exec rm {} \;
|
|
rm -rf $(KORE) $(OBJDIR) kore.features
|
|
$(MAKE) -C kodev clean
|
|
|
|
releng-build-examples:
|
|
rm -rf /tmp/kore_releng
|
|
$(MAKE) clean
|
|
$(MAKE) PYTHON=1 PGSQL=1 TASKS=1 PREFIX=/tmp/kore_releng
|
|
$(MAKE) install PREFIX=/tmp/kore_releng
|
|
$(MAKE) -C examples
|
|
|
|
.PHONY: all clean force
|