From 5777a45f0ac9443482e26e5131b6a18caed78645 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Tue, 22 Apr 2025 17:28:44 +0400 Subject: [PATCH] Fix/improve ejabberd cert renewals --- site-cookbooks/kosmos-ejabberd/recipes/letsencrypt.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/site-cookbooks/kosmos-ejabberd/recipes/letsencrypt.rb b/site-cookbooks/kosmos-ejabberd/recipes/letsencrypt.rb index 05a2fae..adda660 100644 --- a/site-cookbooks/kosmos-ejabberd/recipes/letsencrypt.rb +++ b/site-cookbooks/kosmos-ejabberd/recipes/letsencrypt.rb @@ -16,8 +16,8 @@ set -e for domain in $RENEWED_DOMAINS; do case $domain in kosmos.org|kosmos.chat|5apps.com) - cp "${RENEWED_LINEAGE}/privkey.pem" /opt/ejabberd/conf/$domain.key - cp "${RENEWED_LINEAGE}/fullchain.pem" /opt/ejabberd/conf/$domain.crt + cp "/etc/letsencrypt/live/${domain}/privkey.pem" /opt/ejabberd/conf/$domain.key + cp "/etc/letsencrypt/live/${domain}/fullchain.pem" /opt/ejabberd/conf/$domain.crt chown ejabberd:ejabberd /opt/ejabberd/conf/$domain.* chmod 600 /opt/ejabberd/conf/$domain.* /opt/ejabberd-#{node["ejabberd"]["version"]}/bin/ejabberdctl reload_config @@ -44,7 +44,7 @@ end # Generate a Let's Encrypt cert (only if no cert has been generated before). # The systemd timer will take care of renewing execute "letsencrypt cert for kosmos.org domains" do - command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.org\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d uploads.xmpp.kosmos.org -n" + command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d upload.kosmos.org -d proxy.kosmos.org -d pubsub.kosmos.org -d uploads.xmpp.kosmos.org -n" not_if do File.exist?("/etc/letsencrypt/live/kosmos.org/fullchain.pem") end