kosmos/chef
8
3
Fork 0
Code Issues 34 Pull Requests 3 Projects 2 Activity

Create a nginx_certbot_site resource to remove duplication

Browse Source 
It creates a folder, the nginx vhost for certbot and HTTP redirects, and
also runs certbot and recreates the nginx vhost that includes the TLS
cert
This commit is contained in:
Greg Karékinian
2019-03-15 19:03:28 +01:00
parent b30dcab4da
commit 17f1b2a20a
23 changed files with 152 additions and 302 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
site-cookbooks/sockethub/attributes/default.rb
View File

@@ -1,3 +1,4 @@
node.default['sockethub']['port'] = '10551'
node.default['sockethub']['external_port'] = '10550'
node.default['sockethub']['revision'] = 'v2.0.5'
node.default['sockethub']['port'] = '10551'
node.default['sockethub']['external_port'] = '10550'
node.default['sockethub']['revision'] = 'v2.0.5'
node.default['sockethub']['nginx']['server_name'] = 'sockethub.kosmos.org'

37
site-cookbooks/sockethub/recipes/proxy.rb
View File

@@ -2,14 +2,12 @@
# Cookbook Name:: sockethub
# Recipe:: proxy
#
# Copyright 2015-2017, Kosmos
# Copyright 2015-2019, Kosmos
#
# All rights reserved - Do Not Redistribute
#
unless node.chef_environment == "development"
include_recipe "kosmos-base::letsencrypt"
include_recipe "firewall"
firewall_rule 'sockethub' do
port node['sockethub']['external_port'].to_i
@@ -19,36 +17,27 @@ unless node.chef_environment == "development"
end
include_recipe 'kosmos-nginx'
server_name = node['sockethub']['nginx']['server_name']
directory "/var/www/sockethub" do
owner node["nginx"]["user"]
group node["nginx"]["group"]
action :create
recursive true
end
template "#{node['nginx']['dir']}/sites-available/sockethub" do
template "#{node['nginx']['dir']}/sites-available/#{server_name}" do
source 'nginx_conf_sockethub.erb'
owner 'www-data'
mode 0640
variables sockethub_port: node['sockethub']['port'],
sockethub_external_port: node['sockethub']['external_port'],
server_name: 'sockethub.kosmos.org',
ssl_cert: "/etc/letsencrypt/live/sockethub.kosmos.org/fullchain.pem",
ssl_key: "/etc/letsencrypt/live/sockethub.kosmos.org/privkey.pem"
server_name: server_name,
ssl_cert: "/etc/letsencrypt/live/#{server_name}/fullchain.pem",
ssl_key: "/etc/letsencrypt/live/#{server_name}/privkey.pem"
notifies :reload, 'service[nginx]', :delayed
end
unless node.chef_environment == "development"
include_recipe "kosmos-base::letsencrypt"
execute "letsencrypt cert for sockethub.kosmos.org" do
command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/sockethub -d sockethub.kosmos.org -n"
not_if { File.exist? "/etc/letsencrypt/live/sockethub.kosmos.org/fullchain.pem" }
notifies :reload, "service[nginx]", :delayed
end
# Legacy vhost
nginx_site "sockethub" do
action :disable
end
nginx_site 'sockethub' do
enable true
nginx_site server_name do
action :enable
end
nginx_certbot_site server_name

11
site-cookbooks/sockethub/templates/default/nginx_conf_sockethub.erb
View File

@@ -8,12 +8,10 @@ map $http_upgrade $connection_upgrade {
'' close;
}
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
server {
listen 80; # For Let's Encrypt
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
listen <%= @sockethub_external_port %> ssl http2;
add_header Strict-Transport-Security "max-age=15768000";
<% end -%>
server_name <%= @server_name %>;
@@ -23,10 +21,6 @@ server {
# We might need real ETags, disable those for now
gzip off;
location /.well-known {
root "/var/www/sockethub";
}
location / {
# Increase number of buffers. Default is 8
proxy_buffers 1024 8k;
@@ -38,8 +32,7 @@ server {
proxy_set_header Connection $connection_upgrade;
}
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>;
<% end -%>
}
<% end -%>