kosmos/chef
kosmos/chef
8
3
Fork 0
Code Issues 30 Pull Requests 3 Projects 2 Activity

Run certbot using the binary provided by the Ubuntu PPA

Browse Source
This commit is contained in:
Greg Karékinian 2019-03-14 10:52:44 +01:00
parent fa27187f11
commit 36e046ea73
9 changed files with 9 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
site-cookbooks/5apps-hubot/recipes/xmpp_schlupp.rb
View File

@ -143,8 +143,7 @@ end
unless node.chef_environment == "development" unless node.chef_environment == "development"
execute "letsencrypt cert for #{express_domain}" do execute "letsencrypt cert for #{express_domain}" do
command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{express_domain} -d #{express_domain} -n" command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{express_domain} -d #{express_domain} -n"
cwd "/usr/local/certbot"
not_if { File.exist? "/etc/letsencrypt/live/#{express_domain}/fullchain.pem" } not_if { File.exist? "/etc/letsencrypt/live/#{express_domain}/fullchain.pem" }
notifies :create, "template[#{node['nginx']['dir']}/sites-available/#{express_domain}]", :immediately notifies :create, "template[#{node['nginx']['dir']}/sites-available/#{express_domain}]", :immediately
end end

3
site-cookbooks/5apps-xmpp_server/recipes/letsencrypt.rb
View File

@ -12,8 +12,7 @@ end
# Generate a Let's Encrypt cert (only if no cert has been generated before). # Generate a Let's Encrypt cert (only if no cert has been generated before).
# The renew cron will take care of renewing # The renew cron will take care of renewing
execute "letsencrypt cert for 5apps xmpp" do execute "letsencrypt cert for 5apps xmpp" do
command "./certbot-auto certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/letsencrypt_hook.sh auth\" --manual-cleanup-hook \"/root/letsencrypt_hook.sh cleanup\" --deploy-hook letsencrypt_renew_hook --email ops@5apps.com -d 5apps.com -d muc.5apps.com -d xmpp.5apps.com -n" command "/usr/bin/certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/letsencrypt_hook.sh auth\" --manual-cleanup-hook \"/root/letsencrypt_hook.sh cleanup\" --deploy-hook letsencrypt_renew_hook --email ops@5apps.com -d 5apps.com -d muc.5apps.com -d xmpp.5apps.com -n"
cwd "/usr/local/certbot"
not_if do not_if do
File.exist?("/etc/prosody/certs/5apps.com.crt") File.exist?("/etc/prosody/certs/5apps.com.crt")
end end

3
site-cookbooks/kosmos-hubot/recipes/botka_freenode.rb
View File

@ -122,8 +122,7 @@ unless node.chef_environment == "development"
# reloaded after adding the vhost or sth, because it does work on the second # reloaded after adding the vhost or sth, because it does work on the second
# run. # run.
execute "letsencrypt cert for #{express_domain}" do execute "letsencrypt cert for #{express_domain}" do
command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{express_domain} -d #{express_domain} -n" command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{express_domain} -d #{express_domain} -n"
cwd "/usr/local/certbot"
not_if { File.exist? "/etc/letsencrypt/live/#{express_domain}/fullchain.pem" } not_if { File.exist? "/etc/letsencrypt/live/#{express_domain}/fullchain.pem" }
notifies :create, "template[#{node['nginx']['dir']}/sites-available/#{express_domain}]", :immediately notifies :create, "template[#{node['nginx']['dir']}/sites-available/#{express_domain}]", :immediately
end end

3
site-cookbooks/kosmos-ipfs/recipes/letsencrypt.rb
View File

@ -52,8 +52,7 @@ unless node.chef_environment == "development"
# Generate a Let's Encrypt cert (only if the nginx vhost exists and no cert # Generate a Let's Encrypt cert (only if the nginx vhost exists and no cert
# has been generated before. The renew cron will take care of renewing # has been generated before. The renew cron will take care of renewing
execute "letsencrypt cert for ipfs.kosmos.org" do execute "letsencrypt cert for ipfs.kosmos.org" do
command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{root_directory} -d ipfs.kosmos.org -n" command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{root_directory} -d ipfs.kosmos.org -n"
cwd "/usr/local/certbot"
only_if do only_if do
File.exist?("#{node['nginx']['dir']}/sites-enabled/ipfs.kosmos.org") && File.exist?("#{node['nginx']['dir']}/sites-enabled/ipfs.kosmos.org") &&
!File.exist?("/etc/letsencrypt/live/ipfs.kosmos.org/fullchain.pem") !File.exist?("/etc/letsencrypt/live/ipfs.kosmos.org/fullchain.pem")

3
site-cookbooks/kosmos-mastodon/recipes/nginx.rb
View File

@ -39,8 +39,7 @@ end
unless node.chef_environment == "development" unless node.chef_environment == "development"
include_recipe "kosmos-base::letsencrypt" include_recipe "kosmos-base::letsencrypt"
execute "letsencrypt cert for #{server_name}" do execute "letsencrypt cert for #{server_name}" do
command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/mastodon -d #{server_name} -n" command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/mastodon -d #{server_name} -n"
cwd "/usr/local/certbot"
not_if { File.exist? "/etc/letsencrypt/live/#{server_name}/fullchain.pem" } not_if { File.exist? "/etc/letsencrypt/live/#{server_name}/fullchain.pem" }
notifies :create, "template[#{node['nginx']['dir']}/sites-available/mastodon]", :immediately notifies :create, "template[#{node['nginx']['dir']}/sites-available/mastodon]", :immediately
end end

10
site-cookbooks/kosmos-mediawiki/recipes/default.rb
View File

@ -63,15 +63,7 @@ unless node.chef_environment == "development"
include_recipe "kosmos-base::letsencrypt" include_recipe "kosmos-base::letsencrypt"
execute "letsencrypt cert for wiki.kosmos.org" do execute "letsencrypt cert for wiki.kosmos.org" do
command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['mediawiki']['docroot_dir']} -d wiki.kosmos.org -n" command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['mediawiki']['docroot_dir']} -d wiki.kosmos.org -n"
cwd "/usr/local/certbot"
not_if { File.exist? "/etc/letsencrypt/live/wiki.kosmos.org/fullchain.pem" }
notifies :reload, "service[nginx]", :delayed
end
execute "letsencrypt cert for wiki.kosmos.org" do
command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node["mediawiki"]["docroot_dir"]} -d wiki.kosmos.org -n"
cwd "/usr/local/certbot"
not_if { File.exist? "/etc/letsencrypt/live/wiki.kosmos.org/fullchain.pem" } not_if { File.exist? "/etc/letsencrypt/live/wiki.kosmos.org/fullchain.pem" }
notifies :reload, "service[nginx]", :delayed notifies :reload, "service[nginx]", :delayed
end end

3
site-cookbooks/kosmos-parity/recipes/letsencrypt.rb
View File

@ -33,8 +33,7 @@ nginx_site "#{hostname}" do
end end
execute "letsencrypt cert for #{hostname}" do execute "letsencrypt cert for #{hostname}" do
command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{hostname} -d #{hostname} -n" command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/#{hostname} -d #{hostname} -n"
cwd "/usr/local/certbot"
not_if { File.exist? "/etc/letsencrypt/live/#{hostname}/fullchain.pem" } not_if { File.exist? "/etc/letsencrypt/live/#{hostname}/fullchain.pem" }
notifies :reload, "service[nginx]", :delayed notifies :reload, "service[nginx]", :delayed
end end

3
site-cookbooks/kosmos-wordpress/recipes/nginx.rb
View File

@ -38,8 +38,7 @@ unless node.chef_environment == "development"
include_recipe "kosmos-base::letsencrypt" include_recipe "kosmos-base::letsencrypt"
execute "letsencrypt cert for blog.kosmos.org" do execute "letsencrypt cert for blog.kosmos.org" do
command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['wordpress']['dir']} -d blog.kosmos.org -n" command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['wordpress']['dir']} -d blog.kosmos.org -n"
cwd "/usr/local/certbot"
not_if { File.exist? "/etc/letsencrypt/live/blog.kosmos.org/fullchain.pem" } not_if { File.exist? "/etc/letsencrypt/live/blog.kosmos.org/fullchain.pem" }
notifies :reload, "service[nginx]", :delayed notifies :reload, "service[nginx]", :delayed
end end

3
site-cookbooks/sockethub/recipes/proxy.rb
View File

@ -43,8 +43,7 @@ unless node.chef_environment == "development"
include_recipe "kosmos-base::letsencrypt" include_recipe "kosmos-base::letsencrypt"
execute "letsencrypt cert for sockethub.kosmos.org" do execute "letsencrypt cert for sockethub.kosmos.org" do
command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/sockethub -d sockethub.kosmos.org -n" command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/sockethub -d sockethub.kosmos.org -n"
cwd "/usr/local/certbot"
not_if { File.exist? "/etc/letsencrypt/live/sockethub.kosmos.org/fullchain.pem" } not_if { File.exist? "/etc/letsencrypt/live/sockethub.kosmos.org/fullchain.pem" }
notifies :reload, "service[nginx]", :delayed notifies :reload, "service[nginx]", :delayed
end end