- run as root:dehydrated by default to allow special group read

[packages/dehydrated.git] / dehydrated.spec

diff --git a/dehydrated.spec b/dehydrated.spec
index d5e6a1066c6f9368bcdd1082a99e7b879f91db0f..3a25b89a1105629ecc9e3399234b7a9e441b024a 100644 (file)
--- a/dehydrated.spec
+++ b/dehydrated.spec
@@ -1,7 +1,7 @@
 Summary:       letsencrypt/acme client implemented as a shell-script
 Name:          dehydrated
 Version:       0.6.2
-Release:       3
+Release:       4
 License:       MIT
 Group:         Applications/Networking
 Source0:       https://github.com/lukas2511/dehydrated/archive/v%{version}/%{name}-%{version}.tar.gz
@@ -23,6 +23,7 @@ Source14:     hook.sh
 Source15:      hook.functions
 Source16:      hook.custom_functions
 Source17:      hook.global
+Source18:      sudoers
 Patch0:                tld.patch
 URL:           https://github.com/lukas2511/dehydrated
 BuildRequires: rpmbuild(macros) >= 1.713
@@ -34,7 +35,11 @@ Requires:    grep
 Requires:      mktemp
 Requires:      openssl-tools
 Requires:      sed
+Requires:      sudo
 Requires:      webapps
+Requires(postun):      /usr/sbin/groupdel
+Requires(pre): /usr/bin/getgid
+Requires(pre): /usr/sbin/groupadd
 Suggests:      webserver(access)
 Suggests:      webserver(alias)
 BuildArch:     noarch
@@ -60,7 +65,7 @@ Current features:
 
 %install
 rm -rf $RPM_BUILD_ROOT
-install -d $RPM_BUILD_ROOT{%{_sbindir},{/etc/%{name},%{_webapps}/%{name}}/{conf.d,hooks,hooks.d},/etc/cron.d} \
+install -d $RPM_BUILD_ROOT{%{_sbindir},{/etc/%{name},%{_webapps}/%{name}}/{conf.d,hooks,hooks.d},/etc/{cron,sudoers}.d} \
        $RPM_BUILD_ROOT/var/lib/%{name}/{accounts,acme-challenges,certs}
 
 install -p %{name} $RPM_BUILD_ROOT%{_sbindir}
@@ -77,6 +82,15 @@ install -p %{SOURCE14} $RPM_BUILD_ROOT/etc/%{name}/hooks/hook.sh
 cp -p %{SOURCE15} $RPM_BUILD_ROOT/etc/%{name}/hooks/functions
 cp -p %{SOURCE16} $RPM_BUILD_ROOT/etc/%{name}/hooks/custom_functions
 cp -p %{SOURCE17} $RPM_BUILD_ROOT/etc/%{name}/hooks.d/global
+cp -p %{SOURCE18} $RPM_BUILD_ROOT/etc/sudoers.d/%{name}
+
+%pre
+%groupadd -g 184 dehydrated
+
+%postun
+if [ "$1" = "0" ]; then
+       %groupremove dehydrated
+fi
 
 %clean
 rm -rf $RPM_BUILD_ROOT
@@ -103,6 +117,7 @@ rm -rf $RPM_BUILD_ROOT
 %defattr(644,root,root,755)
 %doc README.md CHANGELOG LICENSE
 %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/cron.d/%{name}
+%attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) /etc/sudoers.d/%{name}
 %dir %attr(750,root,http) %{_webapps}/%{name}
 %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_webapps}/%{name}/httpd.conf
 %attr(640,root,root) %config(noreplace) %verify(not md5 mtime size) %{_webapps}/%{name}/lighttpd.conf
@@ -121,6 +136,6 @@ rm -rf $RPM_BUILD_ROOT
 %attr(755,root,root) %{_sbindir}/%{name}
 %dir %attr(751,root,root) /var/lib/%{name}
 %dir %attr(700,root,root) /var/lib/%{name}/accounts
-%dir %attr(700,root,root) /var/lib/%{name}/certs
+%dir %attr(750,root,dehydrated) /var/lib/%{name}/certs
 # challenges written here, need to be readable by webserver
-%dir %attr(751,root,root) /var/lib/%{name}/acme-challenges
+%dir %attr(751,root,dehydrated) /var/lib/%{name}/acme-challenges