Migrate akkounts proxy to openresty

roles/openresty_proxy.rb

@@ -45,6 +45,7 @@ default_run_list = %w(
 production_run_list = %w(
   role[openresty]
   kosmos_assets::nginx_site
+  kosmos-akkounts::nginx
 )
 
 env_run_lists(

site-cookbooks/kosmos-akkounts/metadata.rb

@@ -7,7 +7,7 @@ long_description 'Installs/configures kosmos-akkounts'
 version '0.2.0'
 chef_version '>= 18.0'
 
-depends 'kosmos-nginx'
+depends 'kosmos_openresty'
 depends "kosmos-nodejs"
 depends "redisio"
 depends "postgresql"

site-cookbooks/kosmos-akkounts/recipes/nginx.rb

@@ -3,11 +3,13 @@
 # Recipe:: nginx
 #
 
-include_recipe "kosmos-nginx"
-app_name    = "akkounts"
-domain      = node[app_name]["domain"]
+app_name = "akkounts"
+domain   = node[app_name]["domain"]
 
-nginx_certbot_site domain
+tls_cert_for domain do
+  auth "gandi_dns"
+  action :create
+end
 
 upstream_hosts = []
 search(:node, "role:akkounts").each do |node|
@@ -15,10 +17,8 @@ search(:node, "role:akkounts").each do |node|
 end
 upstream_hosts.push("localhost") if upstream_hosts.empty?
 
-template "#{node['nginx']['dir']}/sites-available/#{domain}" do
-  source "nginx_conf_#{app_name}.erb"
-  owner 'www-data'
-  mode 0640
+openresty_site domain do
+  template "nginx_conf_#{app_name}.erb"
   variables port: node[app_name]['port'],
             domain: domain,
             upstream_port: node["akkounts"]["port"],
@@ -26,9 +26,4 @@ template "#{node['nginx']['dir']}/sites-available/#{domain}" do
             root_dir: "/opt/#{app_name}/public",
             ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
             ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
-  notifies :reload, 'service[nginx]', :delayed
-end
-
-nginx_site domain do
-  action :enable
 end

site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts.erb

@@ -10,7 +10,7 @@ proxy_cache_path /var/cache/nginx/akkounts levels=1:2
                  max_size=1g inactive=120m use_temp_path=off;
 
 server {
-  listen 443 ssl http2;
+  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
   listen [::]:443 ssl http2;
   server_name <%= @domain %>;