diff --git a/site-cookbooks/5apps-hubot/recipes/xmpp_schlupp.rb b/site-cookbooks/5apps-hubot/recipes/xmpp_schlupp.rb index f35ec1e..fc521b0 100644 --- a/site-cookbooks/5apps-hubot/recipes/xmpp_schlupp.rb +++ b/site-cookbooks/5apps-hubot/recipes/xmpp_schlupp.rb @@ -143,8 +143,7 @@ end unless node.chef_environment == "development" execute "letsencrypt cert for #{express_domain}" do - command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{express_domain} -d #{express_domain} -n" - cwd "/usr/local/certbot" + command "certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{express_domain} -d #{express_domain} -n" not_if { File.exist? "/etc/letsencrypt/live/#{express_domain}/fullchain.pem" } notifies :create, "template[#{node['nginx']['dir']}/sites-available/#{express_domain}]", :immediately end diff --git a/site-cookbooks/5apps-xmpp_server/recipes/letsencrypt.rb b/site-cookbooks/5apps-xmpp_server/recipes/letsencrypt.rb index 9215fa8..93abc18 100644 --- a/site-cookbooks/5apps-xmpp_server/recipes/letsencrypt.rb +++ b/site-cookbooks/5apps-xmpp_server/recipes/letsencrypt.rb @@ -12,8 +12,7 @@ end # Generate a Let's Encrypt cert (only if no cert has been generated before). # The renew cron will take care of renewing execute "letsencrypt cert for 5apps xmpp" do - command "./certbot-auto certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/letsencrypt_hook.sh auth\" --manual-cleanup-hook \"/root/letsencrypt_hook.sh cleanup\" --deploy-hook letsencrypt_renew_hook --email ops@5apps.com -d 5apps.com -d muc.5apps.com -d xmpp.5apps.com -n" - cwd "/usr/local/certbot" + command "certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/letsencrypt_hook.sh auth\" --manual-cleanup-hook \"/root/letsencrypt_hook.sh cleanup\" --deploy-hook letsencrypt_renew_hook --email ops@5apps.com -d 5apps.com -d muc.5apps.com -d xmpp.5apps.com -n" not_if do File.exist?("/etc/prosody/certs/5apps.com.crt") end diff --git a/site-cookbooks/kosmos-base/recipes/letsencrypt.rb b/site-cookbooks/kosmos-base/recipes/letsencrypt.rb index 4db4544..1d489f8 100644 --- a/site-cookbooks/kosmos-base/recipes/letsencrypt.rb +++ b/site-cookbooks/kosmos-base/recipes/letsencrypt.rb @@ -7,14 +7,18 @@ # All rights reserved - Do Not Redistribute # -git "/usr/local/certbot" do - repository "https://github.com/certbot/certbot" - action :sync - revision "v0.26.1" - user "root" - group "root" +# Install certbot and set up hooks + +apt_repository "certbot" do + uri "http://ppa.launchpad.net/certbot/certbot/ubuntu" + distribution node["lsb"]["codename"] + components ["main"] + keyserver "keyserver.ubuntu.com" + key "7BF576066ADA65728FC7E70A8C47BE8E75BCA694" end +package "certbot" + letsencrypt_renew_hook = <<-EOF #!/usr/bin/env bash @@ -50,10 +54,12 @@ file "/usr/local/bin/letsencrypt_renew_hook" do group "root" end -cron "renew Let's Encrypt certificates" do - minute "0" - hour "4" - mailto "logs@5apps.com" - # The hook is only executed if a cert has been renewed - command "/usr/local/certbot/certbot-auto renew --deploy-hook letsencrypt_renew_hook -n 1> /dev/null" +unless node.chef_environment == "development" + cron "renew Let's Encrypt certificates" do + minute "0" + hour "4" + mailto "ops@5apps.com" + # The post hook is only executed if a cert has been renewed + command "certbot renew --renew-hook letsencrypt_renew_hook -n 1> /dev/null" + end end diff --git a/site-cookbooks/kosmos-hubot/recipes/botka_freenode.rb b/site-cookbooks/kosmos-hubot/recipes/botka_freenode.rb index e9b4f6b..04a159e 100644 --- a/site-cookbooks/kosmos-hubot/recipes/botka_freenode.rb +++ b/site-cookbooks/kosmos-hubot/recipes/botka_freenode.rb @@ -121,8 +121,7 @@ unless node.chef_environment == "development" # reloaded after adding the vhost or sth, because it does work on the second # run. execute "letsencrypt cert for #{express_domain}" do - command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{express_domain} -d #{express_domain} -n" - cwd "/usr/local/certbot" + command "certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{express_domain} -d #{express_domain} -n" not_if { File.exist? "/etc/letsencrypt/live/#{express_domain}/fullchain.pem" } notifies :create, "template[#{node['nginx']['dir']}/sites-available/#{express_domain}]", :immediately end diff --git a/site-cookbooks/kosmos-ipfs/recipes/letsencrypt.rb b/site-cookbooks/kosmos-ipfs/recipes/letsencrypt.rb index 65839d7..0b37130 100644 --- a/site-cookbooks/kosmos-ipfs/recipes/letsencrypt.rb +++ b/site-cookbooks/kosmos-ipfs/recipes/letsencrypt.rb @@ -52,8 +52,7 @@ unless node.chef_environment == "development" # Generate a Let's Encrypt cert (only if the nginx vhost exists and no cert # has been generated before. The renew cron will take care of renewing execute "letsencrypt cert for ipfs.kosmos.org" do - command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{root_directory} -d ipfs.kosmos.org -n" - cwd "/usr/local/certbot" + command "certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{root_directory} -d ipfs.kosmos.org -n" only_if do File.exist?("#{node['nginx']['dir']}/sites-enabled/ipfs.kosmos.org") && !File.exist?("/etc/letsencrypt/live/ipfs.kosmos.org/fullchain.pem") diff --git a/site-cookbooks/kosmos-mastodon/recipes/nginx.rb b/site-cookbooks/kosmos-mastodon/recipes/nginx.rb index 6db9868..6b68b19 100644 --- a/site-cookbooks/kosmos-mastodon/recipes/nginx.rb +++ b/site-cookbooks/kosmos-mastodon/recipes/nginx.rb @@ -39,8 +39,7 @@ end unless node.chef_environment == "development" include_recipe "kosmos-base::letsencrypt" execute "letsencrypt cert for #{server_name}" do - command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/mastodon -d #{server_name} -n" - cwd "/usr/local/certbot" + command "certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/mastodon -d #{server_name} -n" not_if { File.exist? "/etc/letsencrypt/live/#{server_name}/fullchain.pem" } notifies :create, "template[#{node['nginx']['dir']}/sites-available/mastodon]", :immediately end diff --git a/site-cookbooks/kosmos-mediawiki/recipes/default.rb b/site-cookbooks/kosmos-mediawiki/recipes/default.rb index cf37b16..3064bbc 100644 --- a/site-cookbooks/kosmos-mediawiki/recipes/default.rb +++ b/site-cookbooks/kosmos-mediawiki/recipes/default.rb @@ -63,19 +63,12 @@ unless node.chef_environment == "development" include_recipe "kosmos-base::letsencrypt" execute "letsencrypt cert for wiki.kosmos.org" do - command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['mediawiki']['docroot_dir']} -d wiki.kosmos.org -n" - cwd "/usr/local/certbot" - not_if { File.exist? "/etc/letsencrypt/live/wiki.kosmos.org/fullchain.pem" } - notifies :reload, "service[nginx]", :delayed - end - - execute "letsencrypt cert for wiki.kosmos.org" do - command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node["mediawiki"]["docroot_dir"]} -d wiki.kosmos.org -n" - cwd "/usr/local/certbot" + command "certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['mediawiki']['docroot_dir']} -d wiki.kosmos.org -n" not_if { File.exist? "/etc/letsencrypt/live/wiki.kosmos.org/fullchain.pem" } notifies :reload, "service[nginx]", :delayed end end + ssl_cert = "/etc/letsencrypt/live/wiki.kosmos.org/fullchain.pem" ssl_key = "/etc/letsencrypt/live/wiki.kosmos.org/privkey.pem" template "#{node['nginx']['dir']}/sites-available/mediawiki" do diff --git a/site-cookbooks/kosmos-parity/recipes/letsencrypt.rb b/site-cookbooks/kosmos-parity/recipes/letsencrypt.rb index fdb84a1..009237e 100644 --- a/site-cookbooks/kosmos-parity/recipes/letsencrypt.rb +++ b/site-cookbooks/kosmos-parity/recipes/letsencrypt.rb @@ -33,8 +33,7 @@ nginx_site "#{hostname}" do end execute "letsencrypt cert for #{hostname}" do - command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{hostname} -d #{hostname} -n" - cwd "/usr/local/certbot" + command "certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{hostname} -d #{hostname} -n" not_if { File.exist? "/etc/letsencrypt/live/#{hostname}/fullchain.pem" } notifies :reload, "service[nginx]", :delayed end diff --git a/site-cookbooks/kosmos-wordpress/recipes/nginx.rb b/site-cookbooks/kosmos-wordpress/recipes/nginx.rb index 6d04427..ed8a485 100644 --- a/site-cookbooks/kosmos-wordpress/recipes/nginx.rb +++ b/site-cookbooks/kosmos-wordpress/recipes/nginx.rb @@ -38,8 +38,7 @@ unless node.chef_environment == "development" include_recipe "kosmos-base::letsencrypt" execute "letsencrypt cert for blog.kosmos.org" do - command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['wordpress']['dir']} -d blog.kosmos.org -n" - cwd "/usr/local/certbot" + command "certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['wordpress']['dir']} -d blog.kosmos.org -n" not_if { File.exist? "/etc/letsencrypt/live/blog.kosmos.org/fullchain.pem" } notifies :reload, "service[nginx]", :delayed end diff --git a/site-cookbooks/sockethub/recipes/proxy.rb b/site-cookbooks/sockethub/recipes/proxy.rb index 7d5a3ba..8e4eb36 100644 --- a/site-cookbooks/sockethub/recipes/proxy.rb +++ b/site-cookbooks/sockethub/recipes/proxy.rb @@ -43,8 +43,7 @@ unless node.chef_environment == "development" include_recipe "kosmos-base::letsencrypt" execute "letsencrypt cert for sockethub.kosmos.org" do - command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/sockethub -d sockethub.kosmos.org -n" - cwd "/usr/local/certbot" + command "certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/sockethub -d sockethub.kosmos.org -n" not_if { File.exist? "/etc/letsencrypt/live/sockethub.kosmos.org/fullchain.pem" } notifies :reload, "service[nginx]", :delayed end