provision: delay initialization of secrets until provision time

when we create the DO 1-click image, the key also gets snapshotted.

https://community.letsencrypt.org/t/receiving-expiration-emails-for-dozens-of-domains/165441

src/nginxconfig.ejs

@@ -87,7 +87,10 @@ server {
     ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA256;
     ssl_prefer_server_ciphers off;
 
+    # dhparams is generated only after dns setup
+<% if (endpoint !== 'ip' && endpoint !== 'setup') { -%>
     ssl_dhparam /home/yellowtent/platformdata/dhparams.pem;
+<% } -%>
     add_header Strict-Transport-Security "max-age=63072000";
 
     <% if ( ocsp ) { -%>

src/provision.js

@@ -10,6 +10,7 @@ exports = module.exports = {
 const assert = require('assert'),
     backups = require('./backups.js'),
     backuptask = require('./backuptask.js'),
+    blobs = require('./blobs.js'),
     BoxError = require('./boxerror.js'),
     branding = require('./branding.js'),
     constants = require('./constants.js'),
@@ -61,6 +62,7 @@ async function setupTask(domain, auditSource) {
     assert.strictEqual(typeof auditSource, 'object');
 
     try {
+        await blobs.initSecrets();
         await cloudron.setupDnsAndCert(constants.DASHBOARD_LOCATION, domain, auditSource, (progress) => setProgress('setup', progress.message));
         await cloudron.setDashboardDomain(domain, auditSource);
         setProgress('setup', 'Done'),

src/server.js

@@ -6,7 +6,6 @@ exports = module.exports = {
 };
 
 const assert = require('assert'),
-    blobs = require('./blobs.js'),
     cloudron = require('./cloudron.js'),
     constants = require('./constants.js'),
     database = require('./database.js'),
@@ -380,7 +379,6 @@ async function start() {
 
     await database.initialize();
     await settings.initCache(); // pre-load very often used settings
-    await blobs.initSecrets();
     await cloudron.initialize();
     await util.promisify(gHttpServer.listen.bind(gHttpServer))(constants.PORT, '127.0.0.1');
     await safe(eventlog.add(eventlog.ACTION_START, { userId: null, username: 'boot' }, { version: constants.VERSION })); // can fail if db down