Initial Let's Encrypt setup for Kosmos subdomains

Refs #6

site-cookbooks/kosmos-mediawiki/recipes/default.rb

@@ -47,23 +47,13 @@ end
 include_recipe "mediawiki"
 include_recipe "kosmos-nginx"
 include_recipe "mediawiki::nginx"
+include_recipe "kosmos-base::letsencrypt"
 
-data_bag_item = Chef::EncryptedDataBagItem.load('certificates', 'wildcard_kosmos_org')
-
-ssl_cert_path = "/etc/ssl/private/wildcard.kosmos.org.crt"
-file ssl_cert_path do
-  content   data_bag_item['ssl_cert']
-  mode      0600
-  owner     'www-data'
-  sensitive true
-end
-
-ssl_key_path = "/etc/ssl/private/wildcard.kosmos.org.key"
-file ssl_key_path do
-  content   data_bag_item['ssl_key']
-  mode      0600
-  owner     'www-data'
-  sensitive true
+execute "letsencrypt cert for wiki.kosmos.org" do
+  command "./letsencrypt-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node["mediawiki"]["docroot_dir"]} -d wiki.kosmos.org"
+  cwd "/usr/local/letsencrypt"
+  not_if { File.exist? "/etc/letsencrypt/live/wiki.kosmos.org/fullchain.pem" }
+  notifies :reload, "service[nginx]", :delayed
 end
 
 template "#{node['nginx']['dir']}/sites-available/mediawiki" do
@@ -71,8 +61,8 @@ template "#{node['nginx']['dir']}/sites-available/mediawiki" do
   variables(
     docroot:        node['mediawiki']['webdir'],
     server_name:    node['mediawiki']['server_name'],
-    ssl_cert:       ssl_cert_path,
-    ssl_key:        ssl_key_path
+    ssl_cert:       "/etc/letsencrypt/live/wiki.kosmos.org/fullchain.pem",
+    ssl_key:        "/etc/letsencrypt/live/wiki.kosmos.org/privkey.pem"
   )
   action :create
   notifies :reload, "service[nginx]", :delayed