Simplify dirsrv setup

Connecting directly using zerotier, no more nginx

site-cookbooks/kosmos-dirsrv/resources/instance.rb

@@ -109,75 +109,4 @@ nsslapd-allow-anonymous-access: off
     action :nothing
   end
 
-  unless node.chef_environment == "development"
-    package "libnss3-tools" # provides pk12util
-
-    cookbook_file "#{Chef::Config[:file_cache_path]}/tls.ldif" do
-      source "tls.ldif"
-      owner "root"
-      group "root"
-    end
-
-    include_recipe "kosmos-nginx"
-    include_recipe "kosmos-base::letsencrypt"
-
-    dirsrv_hook = <<-EOF
-#!/usr/bin/env bash
-
-set -e
-
-# Copy the dirsrv certificate and restart the server if it has been renewed
-# This is necessary because dirsrv uses a different format for the certificates
-for domain in $RENEWED_DOMAINS; do
-  case $domain in
-  #{new_resource.hostname})
-    openssl pkcs12 -export -in "${RENEWED_LINEAGE}/fullchain.pem" -inkey "${RENEWED_LINEAGE}/privkey.pem" -out #{Chef::Config[:file_cache_path]}/#{new_resource.hostname}.p12 -name 'Server-Cert' -passout pass:
-    pk12util -i #{Chef::Config[:file_cache_path]}/#{new_resource.hostname}.p12 -d #{inst_dir} -W ''
-    # Remove the encryption key entries from the current database.
-    # They will be recreated on restart for the new certificate
-    awk '! /^dn: cn=3D|AES,cn=encrypted attribute keys,cn=userRoot/ {print; printf "\\n" ; }' RS="" #{inst_dir}/dse.ldif > #{inst_dir}/dse_new.ldif
-    mv #{inst_dir}/dse_new.ldif #{inst_dir}/dse.ldif
-    systemctl restart #{service_name}
-    ;;
-  esac
-done
-    EOF
-
-    file "/etc/letsencrypt/renewal-hooks/deploy/dirsrv" do
-      content dirsrv_hook
-      mode 0755
-      owner "root"
-      group "root"
-    end
-
-    template "#{node['nginx']['dir']}/sites-available/#{new_resource.hostname}" do
-      source 'nginx_conf_empty.erb'
-      owner node["nginx"]["user"]
-      mode 0640
-      notifies :reload, 'service[nginx]', :delayed
-    end
-
-    nginx_certbot_site new_resource.hostname do
-      notifies :run, "execute[letsencrypt cert for #{new_resource.hostname}]", :delayed
-    end
-
-    # Generate a Let's Encrypt cert (only if the nginx vhost exists and no cert
-    # has been generated before. The renew cron will take care of renewing
-    execute "letsencrypt cert for #{new_resource.hostname}" do
-      root_directory = "/var/www/#{new_resource.hostname}"
-      command "certbot certonly --webroot --agree-tos --email ops@kosmos.org --webroot-path #{root_directory} --deploy-hook /etc/letsencrypt/renewal-hooks/deploy/dirsrv -d #{new_resource.hostname} -n"
-      only_if do
-        ::File.exist?("#{node['nginx']['dir']}/sites-enabled/#{new_resource.hostname}_certbot") &&
-          !::File.exist?("/etc/letsencrypt/live/#{new_resource.hostname}/fullchain.pem")
-      end
-      notifies :run, "execute[add tls config]", :immediately
-    end
-
-    execute "add tls config" do
-      command "ldapadd -x -w #{new_resource.admin_password} -D '#{new_resource.bind_dn}' -f '#{Chef::Config[:file_cache_path]}/tls.ldif' -p #{new_resource.port} -h localhost"
-      sensitive true
-      action :nothing
-      notifies :restart, "service[#{service_name}]", :immediately
-    end
-  end
 end