kosmos/chef
kosmos/chef
8
3
Fork 0
Code Issues 30 Pull Requests 3 Projects 2 Activity

Fix/improve ejabberd cert renewals

Browse Source
This commit is contained in:
Râu Cao 2025-04-22 17:28:44 +04:00
parent f23c37312e
commit 5777a45f0a
Signed by: raucao
GPG Key ID: 37036C356E56CC51
1 changed files with 3 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
site-cookbooks/kosmos-ejabberd/recipes/letsencrypt.rb
View File

@ -16,8 +16,8 @@ set -e
for domain in $RENEWED_DOMAINS; do for domain in $RENEWED_DOMAINS; do
case $domain in case $domain in
kosmos.org|kosmos.chat|5apps.com) kosmos.org|kosmos.chat|5apps.com)
cp "${RENEWED_LINEAGE}/privkey.pem" /opt/ejabberd/conf/$domain.key cp "/etc/letsencrypt/live/${domain}/privkey.pem" /opt/ejabberd/conf/$domain.key
cp "${RENEWED_LINEAGE}/fullchain.pem" /opt/ejabberd/conf/$domain.crt cp "/etc/letsencrypt/live/${domain}/fullchain.pem" /opt/ejabberd/conf/$domain.crt
chown ejabberd:ejabberd /opt/ejabberd/conf/$domain.* chown ejabberd:ejabberd /opt/ejabberd/conf/$domain.*
chmod 600 /opt/ejabberd/conf/$domain.* chmod 600 /opt/ejabberd/conf/$domain.*
/opt/ejabberd-#{node["ejabberd"]["version"]}/bin/ejabberdctl reload_config /opt/ejabberd-#{node["ejabberd"]["version"]}/bin/ejabberdctl reload_config
@ -44,7 +44,7 @@ end
# Generate a Let's Encrypt cert (only if no cert has been generated before). # Generate a Let's Encrypt cert (only if no cert has been generated before).
# The systemd timer will take care of renewing # The systemd timer will take care of renewing
execute "letsencrypt cert for kosmos.org domains" do execute "letsencrypt cert for kosmos.org domains" do
command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.org\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d uploads.xmpp.kosmos.org -n" command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d upload.kosmos.org -d proxy.kosmos.org -d pubsub.kosmos.org -d uploads.xmpp.kosmos.org -n"
not_if do not_if do
File.exist?("/etc/letsencrypt/live/kosmos.org/fullchain.pem") File.exist?("/etc/letsencrypt/live/kosmos.org/fullchain.pem")
end end