Migrate garage proxies to openresty

site-cookbooks/kosmos_garage/metadata.rb

@@ -9,3 +9,4 @@ issues_url 'https://gitea.kosmos.org/kosmos/chef/issues'
 source_url 'https://gitea.kosmos.org/kosmos/chef'
 
 depends 'firewall'
+depends 'kosmos_openresty'

site-cookbooks/kosmos_garage/recipes/nginx_web.rb

@@ -3,9 +3,7 @@
 # Recipe:: nginx_web
 #
 
-include_recipe "kosmos-nginx"
-
-file "/etc/nginx/conf.d/garage.conf" do
+file "/etc/openresty/conf.d/garage.conf" do
   content <<-EOF
 upstream garage_web {
   server localhost:3902;
@@ -19,19 +17,15 @@ end
 domains = node['garage']['s3_web_domains']
 
 domains.each do |server_name|
-  nginx_certbot_site server_name
-
-  template "#{node['nginx']['dir']}/sites-available/#{server_name}" do
-    source 'nginx_conf_web.erb'
-    owner 'www-data'
-    mode 0640
-    variables server_name:         server_name,
-              ssl_cert:            "/etc/letsencrypt/live/#{server_name}/fullchain.pem",
-              ssl_key:             "/etc/letsencrypt/live/#{server_name}/privkey.pem"
-    notifies :reload, 'service[nginx]', :delayed
+  tls_cert_for server_name do
+    auth "gandi_dns"
+    action :create
   end
 
-  nginx_site server_name do
-    action :enable
+  openresty_site server_name do
+    template "nginx_conf_web.erb"
+    variables server_name: server_name,
+              ssl_cert:    "/etc/letsencrypt/live/#{server_name}/fullchain.pem",
+              ssl_key:     "/etc/letsencrypt/live/#{server_name}/privkey.pem"
   end
 end

site-cookbooks/kosmos_garage/templates/nginx_conf_web.erb

@@ -1,5 +1,5 @@
 server {
-  listen 443 http2 ssl;
+  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
   listen [::]:443 http2 ssl;
 
   server_name <%= @server_name %>;