greg committed
1 parent
3da46705ba
commit
0aaf3f3b55
6 files changed
+46
-69
No files matched your search
@@ -1,15 +0,0 @@
|
||||
{
|
||||
"id": "wildcard_kosmos_org",
|
||||
"ssl_cert": {
|
||||
"encrypted_data": "qmx5Z5ZKRwks8monIPphrlc9Sm6KXqISO3kEv9m23bVcU/T1KxbdEu7/+9uM\nnEphL88hzOys92FbjDRvP3lmHN0CjGqamAwcPCiFEIX3oZ0GL+Cws6VaVnVa\nnTPCeVHRjNZ4J2Ss8bGdLJc2m4wAEcxEd9i9zLGmClpVpIO+Fq9NuwhB8JnK\ndTMj6NTV6u2QDcSpV+4gpnXExiFDK6QMR62737UZdkQ1C34E7Rs/ja8jsvpv\nX1WNbhGMpZ9FAgJUwchVSCZOClqanbCVXL6agJXvTGGqb6P5ffsnzKC6uvSl\n1c7FvLpjdMwZ159DSuLNXlsEJNv2yI/RpejjDBRKrOJezGQW/QFaFu3ETItO\n9vEO/UnQ9QuBZfxtOAF/9X1w5EiRagkf9+U7snKvunhH+AIqfk+n1I16VoaZ\nVjB7MkXHjXohV1XNCz/sxKYCKcBl5AVe01tTQSpmqlZ23lN6rYkePaMo3Y4d\nuRwbMHBIW1cEIy88yBq7Nc1oPxqVwtqJQCjA1O95jeVAzP2Masr9G+376wQZ\nUAJR9Tvqh64cOPh8/Sgzsc0eGfF9ndiw20Lz0j5nHvHjpf3XFUDQufpL0rKP\n6cu9kjM8qwvVD4+O7o58/nkMlKFSyrDKVg7q8U2wjtWP/yJ/0SSBE3j/z9pX\nWoa0fDlxJAWUsVu1NcKCTmjsXTela46vBCBQvIra/zVEzXgwubPq+2Ni3G49\nZ6UgI5dHdxLg2FrrAsLxFgMf6tivtYtsJM1l9Mu4jz5Rn1/r/EroibtPi0Up\nYGfabdQxDsca//YxLAX+j3rWDWvLFkpTULve+yZTCnv8Wz+mQNQiQHzMAL5j\nQJAYmxtY15ZDwCohDbX38KJuhcWX+L2kOvLn4qcjHUDzm6U3VM1ywx0EFOgw\n/mXdAICeZnLAFKyuz2JVzkimqm5SNxI4GVLFiRbuB/KfGUnhfVtVLMqKSuz9\n7BJLyXmVBJIXSeyRmNbMV+NIyMBzliLp8j64w+f4hUQhFub/owphhPHYEZSc\n2zbxq0VTcaqLfr8XyD4ylzjAxlmyWJdX9Kop1wLo6h6LJqfORsYTSmKTuZRJ\ntWcemz/R2PM0HiDXr0GTZ7NWphMWVZDl+fF67CnclGfPgFPQD3gfplPiN4Ec\nJ6bMiF6C5ZtPAbPBYxa0pXzCh7GCrRnoPY4ErIg86EUchbbEnrm+wNd98DgO\nXPu6WkXUyMB/hArxGAExxm0j6VlgFBWo5uFYMZWTF4iw0YaiUg4tW3geN28w\nFTtmb0PVYzNNz3VCScKjnSyfVNS4B4pz3W/ZTAzHGR7FupzG2H0WuIFjMLb5\nNtPVXJnq048oRcc53OAvzFE7RgEg+l+mfsR3kJtwdMUSL3fG05X9t6TpFL9p\neA8BNnr3KNPlgGsJoskHJd0WvLCmbG7a7rSI5RPwzPEy/1VzGTzQj/JPtZcN\nvLtXFRylU/N0EIOiP+2VYScn+0XJhyjNbI9S8gYwqT3Q08ZaNI9HVrYGwfHV\ntWOGcdzZkTmc26DjGPvaDfZkjAsaAIy9kNVnr2u0WtOevLvG7zkMvHCbxB2c\nGxK/OfGkAeMas1OB1kwHpBYGLd61yBCDsgQtSnYNa9KOR+l+0pj5wtI8ZydG\n/40IZK4Okga+DBHPUcoN0xr++F8iKR5RiDQm3cHev8A0R3XEaqG7L2EC0XgJ\n1rjb0MfTkgUzifSmvijwgAJ5Ns6Iu543VWDHN53Sm3dqpZsOJ5n0/xobBdjM\nOI4WsgubuijomeaOes/nOeB0a+QneB8RT/zfqRrFVH0paCgPqB+JmdBDuQ2H\nAr3ym4lPI0AiFvG7oxdCBJuyFJ3fy2X13fY4tyDlaf8/58HzRU7Bh0ldo60W\nsRDLHTf8bAIEiBtA0hW9RhQ/k2Ya7zuBVM3gg7Ch7IZpgum/uKzab93gB6Z9\noUJGe+AXsgJ7AbBMSguOYGtEGjS1NeOHQFRxjfzKPBKUumF1fyn1u1rYmAm0\ndPb1H+qQH3r6OrOs3DuowbZNiZwqRW2ZZINTCfJ3alHeLuMC+a3z4jGJQ5Vh\nc3HGf/sIbUjzi4MJHr7EpGIdRDx9FkSTrMUYsoEuCq6oC7Vk/mjCM6FotrFO\nZ6FS5MIKdblVDazxJQ9ZV8CY788M4ZrFjqOEh4GNUgmgmEsUOEg2QuCgjHll\nALQD8h1+AGQ4ABksxC6EQ6o/7j0pnnNzLSCONLU38S0WAneD6lyuPveb5uHb\nhInsIY+8U7ZDt6scEnDhUwQR8kWI3GCMolt/r89eP82AHlX7j/VblYBeKt7e\nDb7NIDgBVOTYQAudu/CTuzl92QrpdaAHI0l7RIA+POLrhvOQWzDOIkp8x0mz\nuFChMkECoHfKqLIxVOTpR8wW5EoVe3bDvVEzbsmN4d6FSaEXFtN2Uq+aIj0I\nNeLWYMID+Tq9rtR0Cm+OTptcsRscij7YbChmLxYGsK0l0msTGTL+4LMWyWoD\n2YZfqprJmWzAs6pFiv3BUJLUC3+gyBt5TiUEF4OYgOEqjOqQgvp/z75q+XXq\n9RPw5G612ZuVJ9c/2w2T1Wr0Anum29SyFcEiGwIRL3jWHbrqWCc2rdsy3zJL\n+5nkC6bJQVz0x+VFr0n5rFNtiWLWy34v9Y21lFO140Hgh/n87ExiwoMtAVN5\n7WNY2QPs1CUR8277K0Gb5xUsc4uvN3Bt1zSJijUl/krGPV/U3iY/ALzpsZgV\nkSIGaCoWmlaMRMRtWeawFavPsjJKdlvFLWA4+6ijbiJqN+u90g8xAbYTm4ZJ\nWbM0emq3E8mgncWvpGhwqTzY0XGqyTB32DPA404jCn9LXLuSeJKuq8hbiKw1\n2hh2ypvrvvggu3iUCQUvYDcYo108/OpvbZdSjLNm5ZlRqPBshWOKzNnXju/u\nmKmp1P4FvG7yW1Bw3cC6By8vKcaDOX6UqVeRSZpA0835MCnqMIlOy9wjN/mm\nCSPkbdKphXbMUG28Gm79GGbU6/10PjNlmf2bSy0UidCsjQYzoXb0Xr1yk9Ia\nj6kdV5L9vRmcEQjO3G5onEoW+seOp2ZrUpKtoDynNKNQYAcIHkHvcsrwEg1h\nXpLF6qwhy1BmjEvw8SOhFuaIpeooVcZ+xkLaniYrvXZulDqTZwZiOwZ6cNXA\nHkJUhVxLoEPVRqF6P9ybohBHef8qVsItYJ/w5Vc8mC849e+BiN3RYtdoXaQa\npMeoNjzNkAA0+McdXTrMbcGmNS6FcocGowTtHX6KXEpFVbW36OKez/tRdZnn\nowqyj79w/yeU5VEBUPtK9oqor1Duhvw+gPRVSwOR81KaNSvFHh9GU8OoIb+v\ngPnczqwNPDjDGDNIIBzfFLw9lDr+V5mu1JKYmQqB1V8mtiNUtAJWGkagOkBd\nL/rYuzPtUl+9YuqC/pDjyH3lwNKzw4TlMkbY/qsyMXfKqR3VW2i+LoeWbeqr\nYQGa20VaQ0rbWrnYC3rMIkKes7Euf3c+4C+Ulu6pa42UPLdU66IacgMq8tgt\nbFQJC3PJqQ/pWy/sG8XKKO0kjSGkLUX6rCa2JqXvuhQf/VLD5cakqrg0xFup\nO/Q7Ocb3wdZdDFWP3ifz4S1PwIbwxXVmLXUGE/ftpK8eQ7Trgu38mCxMT1ct\neeF8reK4LcBX339q5KfoKI2kxIEsVk9QFciRsIhyggpl5+G3vrcDjQKUXZrN\nG0vka6nVlHyfzhUvhSfO3gKlkkge0sKiemxiT3SG+FBvk01tq/kH32WDf8+B\ndK7cu0Z64VVq0IJlF7sMsZujvOZu0oCdGMrsUe7/R6CI+0iNOvm3UA/pmQvp\n62yMuPxVjQYln3zP+o2fd2I/7kvwp70xOJV3cC6QK5PrMJJOekD2ZxW+yTpv\nsu6JwDEczafL7x75qpPYgTIUoiYYypI1DXJSk7qSXPv7j4AhIZXkyuAaS5RN\noOkqWR38JvG2pykiHJx5bGG5aZJORoT6/VmiIXAvKJAX9b81otyzX/DSjUD3\nurBe11SoT/ww1Db6U4p8bbQ0DSPYpI335D6EgNW2BApR1zADakS0FS62Vasj\nVF4zj29WxX2MbHxo9BizouaJHffTFn+TY6XsWoEJUipTnbEgoRU1aVbt8N/M\nk1Qn2+S+d9ycbYDTLB1nTUh/E3NPK+4FzTBmkrfAGrfX1hMDy5nMMay1mCA7\n1tYkQbS7XjM3RX/jQnFHTfikBOVYtyaVhLjZ1hqT64y4OvBhAZHSGkrifGWi\nYfHKbxSJ9g0Cx0hXsaH0Q7bupRcBAT9PuLmpq6Hfa2y1z0OJ2VVvCnpXrifo\nsbVgfKI0c1x/aIcr9pjVaw3o/zbJFxNR2Q0JmpPVbjWGH3l/UKk4sacSzsBr\n90AP09ODWgm8Omh5zXA9I4e7LtasmnAno6Yglhqrd24iN6BjXF+PTkQ5D372\nsghSLqUge+7kiXW4iNjA0qjAuKbZ2NE5JbuC90RrJtn9onQ/PhhgT5JJFN3m\nGB9mKy7lzcUpmAHr01v48r+84XcVDVf29afhb5egjp9y3AkQs+QXsPBDlc6i\nuJhRvFiyjTpjktLaj+TbY+0Y/63EgsayAgIyDVUD+51VjZAy3DugfMMhnoVN\nNVj9fDrLYoXOfoA7MD7JjLw1ccZ6RcF9Wi/g3LN3SR7jRKUsaDLw7QpQ2Tgz\nTVyN5oy1wcb66ZRXRoI7mMgaxv4koGNHzgqC0eBLthuN0sn3hnlA1DlGlTxA\nIr4IiX0u/EwXyn0fh9b7TtretMY448gmb5uLqo5ABxQ7lZNupstJbRuVlLE/\nGhHjyKQoZQWNCBL56JKpYHpI/Y8Giw/Iwh0ta/2/gMQhAjPIkNHlM5aCTVO5\nt/3X8LW4XyHekPfELine truncated
|
||||
"iv": "ZwwZ+OH+cj0zP+Zi7IHJmw==\n",
|
||||
"version": 1,
|
||||
"cipher": "aes-256-cbc"
|
||||
},
|
||||
"ssl_key": {
|
||||
"encrypted_data": "d5kBGSohWVr/dDww5nNB/ZOUWpPnLUGHZ7NQ1So62TP/f2OHZ9BEKtHmRnV1\nVVevqwezB93GTIURKbMXUG2Vd56sa5Lb/ayJPO97GpuxPJ2yyw4Uj5iI6ZWy\nl/9QERgE2zsogi5l9vSMLxuEwpTI9WqcQgjQc9YkppoZHipSmJxUuWqCEpEC\n784//MuBRBJsOFvn9nkCvkVXkksSolRljmgOfsb+8svqaOwTvDe+HPwLkjdi\nFGMvFrQqywYPnPmyZrkmSWB87O3B3HoS6fEyUNFph/C5SfKMdRNJkCptWx5R\n4hLkD7dDHLXMagSqGwJ/VpKVHythy23ezNCDM0mXHoyFRAtUv29KQJVZOMlR\nymOZvToA6wE9hzH/xoaEozAtXYI5YnNMmEjGGk11DkUfpRyOAnmyy7ECjbHm\nVZid7iqhiRk93gRcoOUFS/XFLKTXndSVFVf8FizDf5cpPSHYJ28ZyModTiS1\nwThHUERUrgPcqFT2EX/9HGvBcI+yZ3eiroiH7IakswQczD0FHkWLi5RgVC9T\n4KzEAuvj8V8qsvbqbwI1st0ohPn0Ve2VsHYmG2Vpyd5zvFmGp/WS5oYFlzTd\ntRG1QejXD/PivI2Iih449p+84qnTzCMdkLnbsha/W0322dlKKXCZfMWCtWRH\nmnzfKQDczKWp1VSED8M2Eu/0wy8hnQXnUodghA88m5uk1SYyd8n6Gds+hENi\nFaNb+CwEcDauahujIo34DmqFbiMin1JlRj8vcWAngDk4Q1Mc7s72is+8e+p9\ntrQk183OSmtIR5UkmdSZcLrmdSacuSeoNmcxREmJwxeJCFi2nCiaWLan/3dv\nxiBvIr0upIrnXgou4va58lV6b2qLNKeaXAPUCQlbjpVk7YzWsLjTJWwyvOKT\n1tDmozD1u3PUUG2QZ0uMErBWyi8rNH2aytuXikXPLywZowopfjkP+Sx5Rnus\nVVQ+Q7OJVQpuErq+rAEtoG90+Zj4spKOat8ISqZOC2oBEPuU7/dOK8RsRLtn\nhYuPIjgF21lFHqB5cuyxVTZ+X/pdJ7siD6Zk0viMQtngFn+FC+oTxXUGHncU\n2VvotnGeB2dawsfSKKeYxSsz9aRSD9wuF3kRNgAcCGiAeerI30M1TnZYTnum\nApgjsxrfQw3qsEupEAjvsPiJLYmWqijL6Yb+30JUjIE9PwcNqp+5O7mUdchs\nPjvnMxPIlLKL2iPK+/6QKeIhT9Jv46sctrR9ZL+qYZprn4HMzYaY88v+Dua9\nzQ4ZKnY2a54nb+dsur2P8Xzq0pC4EMIilNCh8Kfk19h9mHMBLIwvnJ0ppavH\nAb/TaUGuH7c6Gm6nsSsISuGDslpgQnApJ7Okupyq4gzEZlkOTFeWYhPHkEvN\n0Iqdt8I110L68D3Pw67O+VX4ksjkyGFfkp/jP8RUz9z0ZR8SzJ1++AZODyxd\n6cGE633FKz471to6OKjdhH3o17ymHK6qTAiphYPDiCKyI+Xo/XylqGnaE0dY\nMjo4HCKxLoX5MeBFtBoGFReVF5+ZEDgtDvI6ZETELtpuvF5zz2kFs8Fn8c/E\n/907ObWNR5wtQLyotq++UseDJgsKC1p3SDFS0OIAuhVp6sOZ6fZ7CjP5wohC\n34iTjC55ThPBRNvESxwoNdjKi0mQR1ex16XCMoE+EZKrtb58uilcfWbb1Ug6\n5lRTbNytQMFYNXqGzuxubPSFQzG9dOEqWyrd6k3w599qeCf3Re6NE9NX+/Jo\n9FgqbNYj0WQGvtgFs/GaYf7b14iip6wlFAgy39iW7bcWT/M6VzXLDRoX6UM6\nYwcxouwH+skhNn+6SMD/2KHl6x6wRhozc5/i6lq5Ddy9YleIdQdLSFlKPYI1\njRUNsN4qVjJuu3qwRWAf4Ex28m0Qs5UgAV18jWOMQ4kiIp4XkVrBAY0o/5Y2\neZnByT1mFMu3/LNG7QyClfuqLhBI8v6xsXqlb0nqr2/EThqQ693SaA3XwLj4\nBIUSNr7NVwS5D5bLHOWn35h9hjtHUrZ/CfZxz/PGcRBroEHNaL/d2LQsEfxO\n66FxuJK+iI6irzlLVAQvJk8wq/LA3QwKUylFK+YhinV2V62cSFO6Jz+NALc7\nmDuD1mUUHEekuePJq3zu4wW2VojtcYusDjjI8ZeLeKwjzU2ynCR/zIbR9xc7\nItwT8+b88xDYXdD3b9gIanCvSRfR9nAUT6f00LHhP0tEIp2mSkcXA6SK2McC\nIQMq29X7pSli7sJdG4/OAmgTFgoYYoEeFIZsA9ZdG7LPZ2I70WZHRCvB9pCI\nfnTgdPYDlHqEiyAMDmxu6CLTV3QPo7WRfg/EdX8+jDyLfXWuqiKySvln3GfZ\nCb8u818=\n",
|
||||
"iv": "NpqZvfmGKPUWFaEDddjAeg==\n",
|
||||
"version": 1,
|
||||
"cipher": "aes-256-cbc"
|
||||
}
|
||||
}
|
||||
@@ -47,23 +47,13 @@ end
|
||||
include_recipe "mediawiki"
|
||||
include_recipe "kosmos-nginx"
|
||||
include_recipe "mediawiki::nginx"
|
||||
include_recipe "kosmos-base::letsencrypt"
|
||||
|
||||
data_bag_item = Chef::EncryptedDataBagItem.load('certificates', 'wildcard_kosmos_org')
|
||||
|
||||
ssl_cert_path = "/etc/ssl/private/wildcard.kosmos.org.crt"
|
||||
file ssl_cert_path do
|
||||
content data_bag_item['ssl_cert']
|
||||
mode 0600
|
||||
owner 'www-data'
|
||||
sensitive true
|
||||
end
|
||||
|
||||
ssl_key_path = "/etc/ssl/private/wildcard.kosmos.org.key"
|
||||
file ssl_key_path do
|
||||
content data_bag_item['ssl_key']
|
||||
mode 0600
|
||||
owner 'www-data'
|
||||
sensitive true
|
||||
execute "letsencrypt cert for wiki.kosmos.org" do
|
||||
command "./letsencrypt-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node["mediawiki"]["docroot_dir"]} -d wiki.kosmos.org"
|
||||
cwd "/usr/local/letsencrypt"
|
||||
not_if { File.exist? "/etc/letsencrypt/live/wiki.kosmos.org/fullchain.pem" }
|
||||
notifies :reload, "service[nginx]", :delayed
|
||||
end
|
||||
|
||||
template "#{node['nginx']['dir']}/sites-available/mediawiki" do
|
||||
@@ -71,8 +61,8 @@ template "#{node['nginx']['dir']}/sites-available/mediawiki" do
|
||||
variables(
|
||||
docroot: node['mediawiki']['webdir'],
|
||||
server_name: node['mediawiki']['server_name'],
|
||||
ssl_cert: ssl_cert_path,
|
||||
ssl_key: ssl_key_path
|
||||
ssl_cert: "/etc/letsencrypt/live/wiki.kosmos.org/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/wiki.kosmos.org/privkey.pem"
|
||||
)
|
||||
action :create
|
||||
notifies :reload, "service[nginx]", :delayed
|
||||
|
||||
@@ -11,6 +11,7 @@ node.set_unless['php-fpm']['pools'] = []
|
||||
|
||||
include_recipe "php-fpm::configure"
|
||||
include_recipe 'php-fpm::repository' unless node['php-fpm']['skip_repository_install']
|
||||
include_recipe "kosmos-base::letsencrypt"
|
||||
|
||||
if node['php-fpm']['package_name'].nil?
|
||||
if platform_family?("rhel")
|
||||
@@ -62,22 +63,11 @@ include_recipe "kosmos-nginx"
|
||||
|
||||
include_recipe "wordpress::app"
|
||||
|
||||
data_bag_item = Chef::EncryptedDataBagItem.load('certificates', 'wildcard_kosmos_org')
|
||||
|
||||
ssl_cert_path = "/etc/ssl/private/wildcard.kosmos.org.crt"
|
||||
file ssl_cert_path do
|
||||
content data_bag_item['ssl_cert']
|
||||
mode 0600
|
||||
owner 'www-data'
|
||||
sensitive true
|
||||
end
|
||||
|
||||
ssl_key_path = "/etc/ssl/private/wildcard.kosmos.org.key"
|
||||
file ssl_key_path do
|
||||
content data_bag_item['ssl_key']
|
||||
mode 0600
|
||||
owner 'www-data'
|
||||
sensitive true
|
||||
execute "letsencrypt cert for blog.kosmos.org" do
|
||||
command "./letsencrypt-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['wordpress']['dir']} -d blog.kosmos.org"
|
||||
cwd "/usr/local/letsencrypt"
|
||||
not_if { File.exist? "/etc/letsencrypt/live/blog.kosmos.org/fullchain.pem" }
|
||||
notifies :reload, "service[nginx]", :delayed
|
||||
end
|
||||
|
||||
template "#{node['nginx']['dir']}/sites-available/wordpress" do
|
||||
@@ -87,8 +77,8 @@ template "#{node['nginx']['dir']}/sites-available/wordpress" do
|
||||
server_name: node['wordpress']['server_name'],
|
||||
server_aliases: node['wordpress']['server_aliases'],
|
||||
server_port: node['wordpress']['server_port'],
|
||||
ssl_cert: ssl_cert_path,
|
||||
ssl_key: ssl_key_path
|
||||
ssl_cert: "/etc/letsencrypt/live/blog.kosmos.org/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/blog.kosmos.org/privkey.pem"
|
||||
)
|
||||
action :create
|
||||
notifies :reload, "service[nginx]", :delayed
|
||||
|
||||
@@ -1,6 +1,8 @@
|
||||
server {
|
||||
listen 80;
|
||||
listen <%= @server_port %> ssl;
|
||||
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
|
||||
listen <%= @server_port %> ssl spdy;
|
||||
<% end -%>
|
||||
server_name <%= @server_name %> <%= @server_aliases.join(" ") %>;
|
||||
|
||||
access_log /var/log/nginx/<%= @server_name %>.access.log;
|
||||
@@ -29,6 +31,8 @@ server {
|
||||
fastcgi_param SCRIPT_FILENAME <%= @docroot %>$fastcgi_script_name;
|
||||
}
|
||||
|
||||
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
|
||||
ssl_certificate <%= @ssl_cert %>;
|
||||
ssl_certificate_key <%= @ssl_key %>;
|
||||
<% end -%>
|
||||
}
|
||||
@@ -7,6 +7,8 @@
|
||||
# All rights reserved - Do Not Redistribute
|
||||
#
|
||||
|
||||
include_recipe "kosmos-base::letsencrypt"
|
||||
|
||||
firewall_rule 'sockethub' do
|
||||
port node['sockethub']['external_port'].to_i
|
||||
protocol :tcp
|
||||
@@ -15,23 +17,13 @@ end
|
||||
|
||||
include_recipe 'kosmos-nginx'
|
||||
|
||||
data_bag_item = Chef::EncryptedDataBagItem.load('certificates', 'wildcard_kosmos_org')
|
||||
|
||||
ssl_cert_path = "/etc/ssl/private/wildcard.kosmos.org.crt"
|
||||
file ssl_cert_path do
|
||||
content data_bag_item['ssl_cert']
|
||||
mode 0600
|
||||
owner 'www-data'
|
||||
sensitive true
|
||||
directory "/var/www/sockethub" do
|
||||
owner node["nginx"]["user"]
|
||||
group node["nginx"]["group"]
|
||||
action :create
|
||||
end
|
||||
|
||||
ssl_key_path = "/etc/ssl/private/wildcard.kosmos.org.key"
|
||||
file ssl_key_path do
|
||||
content data_bag_item['ssl_key']
|
||||
mode 0600
|
||||
owner 'www-data'
|
||||
sensitive true
|
||||
end
|
||||
include_recipe 'kosmos-nginx'
|
||||
|
||||
template "#{node['nginx']['dir']}/sites-available/sockethub" do
|
||||
source 'nginx_conf_sockethub.erb'
|
||||
@@ -40,11 +32,18 @@ template "#{node['nginx']['dir']}/sites-available/sockethub" do
|
||||
variables sockethub_port: node['sockethub']['port'],
|
||||
sockethub_external_port: node['sockethub']['external_port'],
|
||||
server_name: 'sockethub.kosmos.org',
|
||||
ssl_cert: ssl_cert_path,
|
||||
ssl_key: ssl_key_path
|
||||
ssl_cert: "/etc/letsencrypt/live/sockethub.kosmos.org/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/sockethub.kosmos.org/privkey.pem"
|
||||
notifies :reload, 'service[nginx]', :delayed
|
||||
end
|
||||
|
||||
execute "letsencrypt cert for sockethub.kosmos.org" do
|
||||
command "./letsencrypt-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/sockethub -d sockethub.kosmos.org"
|
||||
cwd "/usr/local/letsencrypt"
|
||||
not_if { File.exist? "/etc/letsencrypt/live/sockethub.kosmos.org/fullchain.pem" }
|
||||
notifies :reload, "service[nginx]", :delayed
|
||||
end
|
||||
|
||||
nginx_site 'sockethub' do
|
||||
enable true
|
||||
end
|
||||
@@ -9,8 +9,11 @@ map $http_upgrade $connection_upgrade {
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80; # For Let's Encrypt
|
||||
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
|
||||
listen <%= @sockethub_external_port %> ssl spdy;
|
||||
add_header Strict-Transport-Security "max-age=15768000";
|
||||
<% end -%>
|
||||
|
||||
server_name <%= @server_name %>;
|
||||
|
||||
@@ -20,6 +23,10 @@ server {
|
||||
# We might need real ETags, disable those for now
|
||||
gzip off;
|
||||
|
||||
location /.well-known {
|
||||
root "/var/www/sockethub";
|
||||
}
|
||||
|
||||
location / {
|
||||
# an HTTP header important enough to have its own Wikipedia entry:
|
||||
# http://en.wikipedia.org/wiki/X-Forwarded-For
|
||||
@@ -50,6 +57,8 @@ server {
|
||||
add_header 'Access-Control-Allow-Origin' '*';
|
||||
}
|
||||
|
||||
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
|
||||
ssl_certificate <%= @ssl_cert %>;
|
||||
ssl_certificate_key <%= @ssl_key %>;
|
||||
<% end -%>
|
||||
}
|
||||
Reference in new issue
Block a user