kosmos/chef
8
3
Fork 0
Code Issues 34 Pull Requests 3 Projects 2 Activity

Initial Let's Encrypt setup for Kosmos subdomains

Browse Source 
Refs #6
This commit is contained in:
Greg Karékinian
2016-05-06 16:41:06 +02:00
parent 3da46705ba
commit 0aaf3f3b55
6 changed files with 46 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
site-cookbooks/kosmos-wordpress/recipes/nginx.rb
View File

@@ -11,6 +11,7 @@ node.set_unless['php-fpm']['pools'] = []
include_recipe "php-fpm::configure"
include_recipe 'php-fpm::repository' unless node['php-fpm']['skip_repository_install']
include_recipe "kosmos-base::letsencrypt"
if node['php-fpm']['package_name'].nil?
if platform_family?("rhel")
@@ -62,22 +63,11 @@ include_recipe "kosmos-nginx"
include_recipe "wordpress::app"
data_bag_item = Chef::EncryptedDataBagItem.load('certificates', 'wildcard_kosmos_org')
ssl_cert_path = "/etc/ssl/private/wildcard.kosmos.org.crt"
file ssl_cert_path do
content data_bag_item['ssl_cert']
mode 0600
owner 'www-data'
sensitive true
end
ssl_key_path = "/etc/ssl/private/wildcard.kosmos.org.key"
file ssl_key_path do
content data_bag_item['ssl_key']
mode 0600
owner 'www-data'
sensitive true
execute "letsencrypt cert for blog.kosmos.org" do
command "./letsencrypt-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['wordpress']['dir']} -d blog.kosmos.org"
cwd "/usr/local/letsencrypt"
not_if { File.exist? "/etc/letsencrypt/live/blog.kosmos.org/fullchain.pem" }
notifies :reload, "service[nginx]", :delayed
end
template "#{node['nginx']['dir']}/sites-available/wordpress" do
@@ -87,8 +77,8 @@ template "#{node['nginx']['dir']}/sites-available/wordpress" do
server_name: node['wordpress']['server_name'],
server_aliases: node['wordpress']['server_aliases'],
server_port: node['wordpress']['server_port'],
ssl_cert: ssl_cert_path,
ssl_key: ssl_key_path
ssl_cert: "/etc/letsencrypt/live/blog.kosmos.org/fullchain.pem",
ssl_key: "/etc/letsencrypt/live/blog.kosmos.org/privkey.pem"
)
action :create
notifies :reload, "service[nginx]", :delayed

6
site-cookbooks/kosmos-wordpress/templates/default/nginx.conf.erb
View File

@@ -1,6 +1,8 @@
server {
listen 80;
listen <%= @server_port %> ssl;
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
listen <%= @server_port %> ssl spdy;
<% end -%>
server_name <%= @server_name %> <%= @server_aliases.join(" ") %>;
access_log /var/log/nginx/<%= @server_name %>.access.log;
@@ -29,6 +31,8 @@ server {
fastcgi_param SCRIPT_FILENAME <%= @docroot %>$fastcgi_script_name;
}
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>;
<% end -%>
}