[enh] Generate custom Diffie-Hellman primes

data/hooks/conf_regen/15-nginx

@@ -49,7 +49,14 @@ do_pre_regen() {
                             | jq ".certificates.\"$domain\".CA_type" \
                             | tr -d '"')
 
+    if [[ -e "/etc/ssl/private/dh2048.pem" ]]; then
+      export dh_params=true
+    else
+      export dh_params=false
+    fi
+
     ynh_render_template "server.tpl.conf" "${nginx_conf_dir}/${domain}.conf"
+    ynh_render_template "yunohost_admin.conf" "${nginx_conf_dir}/yunohost-admin.conf"
     ynh_render_template "autoconfig.tpl.xml" "${mail_autoconfig_dir}/config-v1.1.xml"
 
     [[ $main_domain != $domain ]] \

data/templates/nginx/server.tpl.conf

@@ -44,10 +44,12 @@ server {
     #ssl_protocols TLSv1.2;
     #ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
 
+    {% if dh_params %}
     # Uncomment the following directive after DH generation
     # > openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048
-    #ssl_dhparam /etc/ssl/private/dh2048.pem;
-
+    ssl_dhparam /etc/ssl/private/dh2048.pem;
+    {% endif %}
+
     # Follows the Web Security Directives from the Mozilla Dev Lab and the Mozilla Obervatory + Partners
     # https://wiki.mozilla.org/Security/Guidelines/Web_Security
     # https://observatory.mozilla.org/ 

data/templates/nginx/plain/yunohost_admin.conf → data/templates/nginx/yunohost_admin.conf

@@ -43,9 +43,11 @@ server {
     #ssl_protocols TLSv1.2;
     #ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
 
+    {% if dh_params %}
     # Uncomment the following directive after DH generation
     # > openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048
-    #ssl_dhparam /etc/ssl/private/dh2048.pem;
+    ssl_dhparam /etc/ssl/private/dh2048.pem;
+    {% endif %}
 
     # Follows the Web Security Directives from the Mozilla Dev Lab and the Mozilla Obervatory + Partners
     # https://wiki.mozilla.org/Security/Guidelines/Web_Security

src/yunohost/data_migrations/0009_dh_params.py

@@ -0,0 +1,30 @@
+import re
+import os
+
+from moulinette.utils.log import getActionLogger
+from moulinette.utils.filesystem import chown
+
+from yunohost.tools import Migration
+from yunohost.service import service_regen_conf
+
+command = "nice -n 19 openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048 -dsaparam 2> /var/log/yunohost/dhparam_generation.log && chown root:ssl-cert /etc/ssl/private/dh2048.pem && yunohost service regen-conf >> /var/log/yunohost/dhparam_generation.log && rm /etc/cron.hourly/yunohost-generate-dh-params\n"
+dhparams_file = "/etc/ssl/private/dh2048.pem"
+
+class MyMigration(Migration):
+    "This migration will add dh_params line and generate it in installed instance"
+
+    def migrate(self):
+
+        if os.path.exists(dhparams_file):
+            service_regen_conf(['nginx'])
+        else:
+            with open(cron_job_file, "w") as f:
+                        f.write("#!/bin/bash\n")
+                        f.write(command)
+
+            _set_permissions(cron_job_file, "root", "root", 0o755)
+
+
+    def backward(self):
+        if os.path.exists(dhparams_file):
+            os.remove(dhparams_file)

src/yunohost/tools.py

@@ -322,6 +322,17 @@ def tools_postinstall(operation_logger, domain, password, ignore_dyndns=False,
     else:
         dyndns = False
 
+    cron_job_file = "/etc/cron.hourly/yunohost-generate-dh-params"
+
+    command = "nice -n 19 openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048 -dsaparam 2> /var/log/yunohost/dhparam_generation.log && chown root:ssl-cert /etc/ssl/private/dh2048.pem && yunohost service regen-conf >> /var/log/yunohost/dhparam_generation.log && rm /etc/cron.hourly/yunohost-generate-dh-params\n"
+
+
+    with open(cron_job_file, "w") as f:
+        f.write("#!/bin/bash\n")
+        f.write(command)
+
+    _set_permissions(cron_job_file, "root", "root", 0o755)
+
     operation_logger.start()
     logger.info(m18n.n('yunohost_installing'))