From 4ec24ec34439e85a79379eedd5ccaf487391be9d Mon Sep 17 00:00:00 2001
From: Alejo Diaz <49624607+xlejo@users.noreply.github.com>
Date: Thu, 3 Mar 2022 13:15:39 -0300
Subject: [PATCH] Add support for obtain ECDSA keys (#1667)

* Add support for obtain ECDSA keys

* Replace matrix_ssl_lets_encrypt_use_ecdsa_keys for matrix_ssl_lets_encrypt_key_type
---
 docs/configuring-playbook-ssl-certificates.md            | 9 +++++++++
 roles/matrix-nginx-proxy/defaults/main.yml               | 4 ++++
 roles/matrix-nginx-proxy/tasks/ssl/main.yml              | 5 +++++
 .../ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml     | 2 ++
 .../matrix-ssl-lets-encrypt-certificates-renew.j2        | 3 ++-
 5 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/docs/configuring-playbook-ssl-certificates.md b/docs/configuring-playbook-ssl-certificates.md
index 07e49c5a..eae584e7 100644
--- a/docs/configuring-playbook-ssl-certificates.md
+++ b/docs/configuring-playbook-ssl-certificates.md
@@ -100,3 +100,12 @@ For automated certificate renewal to work, each port `80` vhost for each domain
 
 See how this is configured for the `matrix.` subdomain in `/matrix/nginx-proxy/conf.d/matrix-synapse.conf`
 Don't be alarmed if the above configuration file says port `8080`, instead of port `80`. It's due to port mapping due to our use of containers.
+
+
+## Specify the SSL private key algorithm
+
+If you'd like to [specify the private key type](https://eff-certbot.readthedocs.io/en/stable/using.html#using-ecdsa-keys) used with Let's Encrypt, define your own custom configuration like this:
+
+```yaml
+matrix_ssl_lets_encrypt_key_type: ecdsa
+```
diff --git a/roles/matrix-nginx-proxy/defaults/main.yml b/roles/matrix-nginx-proxy/defaults/main.yml
index 32702ec9..4b1810ea 100644
--- a/roles/matrix-nginx-proxy/defaults/main.yml
+++ b/roles/matrix-nginx-proxy/defaults/main.yml
@@ -489,6 +489,10 @@ matrix_ssl_lets_encrypt_support_email: ~
 # If you'd like to not bind on all IP addresses, specify one explicitly (e.g. `a.b.c.d:80`)
 matrix_ssl_lets_encrypt_container_standalone_http_host_bind_port: '80'
 
+# Specify key type of the private key algorithm.
+# Learn more here: https://eff-certbot.readthedocs.io/en/stable/using.html#using-ecdsa-keys
+matrix_ssl_lets_encrypt_key_type: rsa
+
 matrix_ssl_base_path: "{{ matrix_base_data_path }}/ssl"
 matrix_ssl_config_dir_path: "{{ matrix_ssl_base_path }}/config"
 matrix_ssl_log_dir_path: "{{ matrix_ssl_base_path }}/log"
diff --git a/roles/matrix-nginx-proxy/tasks/ssl/main.yml b/roles/matrix-nginx-proxy/tasks/ssl/main.yml
index 6c060818..6b843c7b 100644
--- a/roles/matrix-nginx-proxy/tasks/ssl/main.yml
+++ b/roles/matrix-nginx-proxy/tasks/ssl/main.yml
@@ -5,6 +5,11 @@
     msg: "The `matrix_ssl_retrieval_method` variable contains an unsupported value"
   when: "matrix_ssl_retrieval_method not in ['lets-encrypt', 'self-signed', 'manually-managed', 'none']"
 
+- name: Fail if using unsupported private key type
+  fail:
+    msg: "The `matrix_ssl_lets_encrypt_key_type` variable contains an unsupported value"
+  when: "matrix_ssl_lets_encrypt_key_type not in ['rsa', 'ecdsa']"
+
 
 # Common tasks, required by almost any method below.
 
diff --git a/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml b/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml
index e4dd53c2..12a21257 100644
--- a/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml
+++ b/roles/matrix-nginx-proxy/tasks/ssl/setup_ssl_lets_encrypt_obtain_for_domain.yml
@@ -45,6 +45,7 @@
     --http-01-port 8080
     {% if matrix_ssl_lets_encrypt_server %}--server={{ matrix_ssl_lets_encrypt_server|quote }}{% endif %}
     {% if matrix_ssl_lets_encrypt_staging %}--staging{% endif %}
+    --key-type {{ matrix_ssl_lets_encrypt_key_type }}
     --standalone
     --preferred-challenges http
     --agree-tos
@@ -74,6 +75,7 @@
     --http-01-port 8080
     {% if matrix_ssl_lets_encrypt_server %}--server={{ matrix_ssl_lets_encrypt_server|quote }}{% endif %}
     {% if matrix_ssl_lets_encrypt_staging %}--staging{% endif %}
+    --key-type {{ matrix_ssl_lets_encrypt_key_type }}
     --standalone
     --preferred-challenges http
     --agree-tos
diff --git a/roles/matrix-nginx-proxy/templates/usr-local-bin/matrix-ssl-lets-encrypt-certificates-renew.j2 b/roles/matrix-nginx-proxy/templates/usr-local-bin/matrix-ssl-lets-encrypt-certificates-renew.j2
index bc45e85e..89113629 100644
--- a/roles/matrix-nginx-proxy/templates/usr-local-bin/matrix-ssl-lets-encrypt-certificates-renew.j2
+++ b/roles/matrix-nginx-proxy/templates/usr-local-bin/matrix-ssl-lets-encrypt-certificates-renew.j2
@@ -22,8 +22,9 @@ docker run \
 		--work-dir=/tmp \
 		--http-01-port 8080 \
 		{% if matrix_ssl_lets_encrypt_staging %}
-			--staging \
+		--staging \
 		{% endif %}
+		--key-type {{ matrix_ssl_lets_encrypt_key_type }} \
 		--standalone \
 		--preferred-challenges http \
 		--agree-tos \