[ADD] letsencrypt

[hbrunn]

Request SSL certificates from letsencrypt.org

This module was written to have your Odoo installation request SSL certificates
from https://letsencrypt.org automatically.

Installation

After installation, this module generates a private key for your account at
letsencrypt.org automatically in $data_dir/letsencrypt/account.key. If you
want or need to use your own account key, replace the file.

For certificate requests to work, your site needs to be accessible via plain
HTTP, see below for configuration examples in case you force your clients to
the SSL version.

After installation, trigger the cronjob Update letsencrypt certificates and
watch your log for messages.

Configuration

This addons requests a certificate for the domain named in the configuration
parameter web.base.url - if this comes back as localhost or the like,
the module doesn't request anything.

If you want your certificate to contain multiple alternative names, just add
them as configuration parameters letsencrypt.altname.N with N starting
from 0. The amount of domains that can be added are subject to rate limiting <https://community.letsencrypt.org/t/rate-limits-for-lets-encrypt/6769>_.

Note that all those domains must be publicly reachable on port 80 via HTTP, and
they must have an entry for .well-known/acme-challenge pointing to your odoo
instance.

Usage

The module sets up a cronjob that requests and renews certificates automatically.

After the first run, you'll find a file called domain.crt in
$datadir/letsencrypt, configure your SSL proxy to use this file as certificate.

In depth configuration

This module uses openssl to generate CSRs suitable to be submitted to
letsencrypt.org. In order to do this, it copies /etc/ssl/openssl.cnf to a
temporary and adapts it according to its needs (currently, that's just adding a
[SAN] section if necessary). If you want the module to use another configuration
template, set config parameter letsencrypt.openssl.cnf.

After refreshing the certificate, the module attempts to run the content of
letsencrypt.reload_command, which is by default sudo service nginx reload.
Change this to match your server's configuration.

You'll also need a matching sudo configuration, like::

your_odoo_user ALL = NOPASSWD: /usr/sbin/service nginx reload

Further, if you force users to https, you'll need something like::

if ($scheme = "http") {
    set $redirect_https 1;
}
if ($request_uri ~ ^/.well-known/acme-challenge/) {
    set $redirect_https 0;
}
if ($redirect_https) {
    rewrite ^   https://$server_name$request_uri? permanent;
}

[rafaelbn]

@antespi @yajo take a look here. We talked about it. Thanks

[hbrunn]

BTW: https://therp.nl and all our other SSL sites use this in production

[sebalix]

This whitelist is just to prevent common mistakes? From where are these addresses taken from? Internally we often use 172.24.* for instance.
Maybe add a whitelist as a constant, , or use something like https://pypi.python.org/pypi/ipgetter (if it can help here).

[hbrunn]

This comes from https://en.wikipedia.org/wiki/Private_network without looking closely at the actual ip range. Will have to enumerate 16-31 then if we want to keep string comparisons.

And yes, that's meant to save people from themselves, or better, to avoid issues being posted about private addresses not working.

[lasley]

I agree with @sebalix - We're going to get in trouble by excluding ~50% of the private class B networks. That said, I can't think of a better solution here other than converting the IP to INT, then determining between (eg 10/8 is 167772160 - 184549375)

[coveralls]

Coverage increased (+2.6%) to 56.804% when pulling c97b040 on hbrunn:8.0-letsencrypt into 22c1c7e on OCA:8.0.

[yajo]

This should be main instead.

[hbrunn]

@yajo thanks for you review, fixed your points not related to the library

[coveralls]

Coverage increased (+2.6%) to 56.834% when pulling b47775d on hbrunn:8.0-letsencrypt into 22c1c7e on OCA:8.0.

[coveralls]

Coverage increased (+2.6%) to 56.834% when pulling 8ad0b2b on hbrunn:8.0-letsencrypt into 22c1c7e on OCA:8.0.

[coveralls]

Coverage increased (+2.6%) to 56.812% when pulling 8ad0b2b on hbrunn:8.0-letsencrypt into 22c1c7e on OCA:8.0.