Initial Let's Encrypt setup for Kosmos subdomains

Refs #6

site-cookbooks/kosmos-wordpress/recipes/nginx.rb

@@ -11,6 +11,7 @@ node.set_unless['php-fpm']['pools'] = []
 
 include_recipe "php-fpm::configure"
 include_recipe 'php-fpm::repository' unless node['php-fpm']['skip_repository_install']
+include_recipe "kosmos-base::letsencrypt"
 
 if node['php-fpm']['package_name'].nil?
   if platform_family?("rhel")
@@ -62,22 +63,11 @@ include_recipe "kosmos-nginx"
 
 include_recipe "wordpress::app"
 
-data_bag_item = Chef::EncryptedDataBagItem.load('certificates', 'wildcard_kosmos_org')
-
-ssl_cert_path = "/etc/ssl/private/wildcard.kosmos.org.crt"
-file ssl_cert_path do
-  content   data_bag_item['ssl_cert']
-  mode      0600
-  owner     'www-data'
-  sensitive true
-end
-
-ssl_key_path = "/etc/ssl/private/wildcard.kosmos.org.key"
-file ssl_key_path do
-  content   data_bag_item['ssl_key']
-  mode      0600
-  owner     'www-data'
-  sensitive true
+execute "letsencrypt cert for blog.kosmos.org" do
+  command "./letsencrypt-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['wordpress']['dir']} -d blog.kosmos.org"
+  cwd "/usr/local/letsencrypt"
+  not_if { File.exist? "/etc/letsencrypt/live/blog.kosmos.org/fullchain.pem" }
+  notifies :reload, "service[nginx]", :delayed
 end
 
 template "#{node['nginx']['dir']}/sites-available/wordpress" do
@@ -87,8 +77,8 @@ template "#{node['nginx']['dir']}/sites-available/wordpress" do
     server_name:    node['wordpress']['server_name'],
     server_aliases: node['wordpress']['server_aliases'],
     server_port:    node['wordpress']['server_port'],
-    ssl_cert:       ssl_cert_path,
-    ssl_key:        ssl_key_path
+    ssl_cert:       "/etc/letsencrypt/live/blog.kosmos.org/fullchain.pem",
+    ssl_key:        "/etc/letsencrypt/live/blog.kosmos.org/privkey.pem"
   )
   action :create
   notifies :reload, "service[nginx]", :delayed