From 46c79526fd34996605a97ce52437069aa6462cef Mon Sep 17 00:00:00 2001
From: Eric Wong <e@80x24.org>
Date: Sat, 14 Sep 2019 18:28:54 +0000
Subject: doc: update nntpd with NNTPS and STARTTLS examples

NNTPS and STARTTLS seems to be working for several months
without incident on news.public-inbox.org, so consider it a
success and maybe others can try using it.

HTTPS technically works, too, but isn't documented at
the moment since I can't recommend production deployments
without varnish protecting it.
---
 examples/public-inbox-nntpd@.service | 13 ++++++++-----
 examples/public-inbox-nntps.socket   | 12 ++++++++++++
 2 files changed, 20 insertions(+), 5 deletions(-)
 create mode 100644 examples/public-inbox-nntps.socket

(limited to 'examples')

diff --git a/examples/public-inbox-nntpd@.service b/examples/public-inbox-nntpd@.service
index a879841e..4dd2f5d7 100644
--- a/examples/public-inbox-nntpd@.service
+++ b/examples/public-inbox-nntpd@.service
@@ -7,8 +7,8 @@
 
 [Unit]
 Description = public-inbox NNTP server %i
-Wants = public-inbox-nntpd.socket
-After = public-inbox-nntpd.socket
+Wants = public-inbox-nntpd.socket public-inbox-nntps.socket
+After = public-inbox-nntpd.socket public-inbox-nntps.socket
 
 [Service]
 Environment = PI_CONFIG=/home/pi/.public-inbox/config \
@@ -18,17 +18,20 @@ PERL_INLINE_DIRECTORY=/tmp/.pub-inline
 LimitNOFILE = 30000
 ExecStartPre = /bin/mkdir -p -m 1777 /tmp/.pub-inline
 ExecStart = /usr/local/bin/public-inbox-nntpd \
--1 /var/log/public-inbox/nntpd.out.log
+-1 /var/log/public-inbox/nntpd.out.log \
+--cert /etc/ssl/certs/news.example.com.pem \
+--key /etc/ssl/private/news.example.com.key
 StandardError = syslog
 
 # NonBlocking is REQUIRED to avoid a race condition if running
 # simultaneous services
 NonBlocking = true
-Sockets = public-inbox-nntpd.socket
+
+Sockets = public-inbox-nntpd.socket public-inbox-nntps.socket
 
 KillSignal = SIGQUIT
 User = nobody
-Group = nogroup
+Group = ssl-cert
 ExecReload = /bin/kill -HUP $MAINPID
 TimeoutStopSec = 86400
 KillMode = process
diff --git a/examples/public-inbox-nntps.socket b/examples/public-inbox-nntps.socket
new file mode 100644
index 00000000..fa678196
--- /dev/null
+++ b/examples/public-inbox-nntps.socket
@@ -0,0 +1,12 @@
+# ==> /etc/systemd/system/public-inbox-nntps.socket <==
+[Unit]
+Description = public-inbox-nntps socket
+
+[Socket]
+ListenStream = 0.0.0.0:563
+BindIPv6Only = ipv6-only
+ListenStream = [::]:563
+Service = public-inbox-nntpd@1.service
+
+[Install]
+WantedBy = sockets.target
-- 
cgit v1.2.3-24-ge0c7