From 9436284be2a07f57e44cfee36566d6ebe5d23116 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Greg=20Kar=C3=A9kinian?= <greg@karekinian.com>
Date: Sun, 19 Mar 2017 20:05:09 +0000
Subject: [PATCH] Use the latest certbot instead of the old letsencrypt

---
 .../kosmos-base/recipes/letsencrypt.rb        | 35 ++++++++++++++++---
 .../kosmos-mediawiki/recipes/default.rb       |  4 +--
 .../kosmos-wordpress/recipes/nginx.rb         |  4 +--
 site-cookbooks/sockethub/recipes/default.rb   |  2 +-
 site-cookbooks/sockethub/recipes/proxy.rb     |  4 +--
 5 files changed, 38 insertions(+), 11 deletions(-)

diff --git a/site-cookbooks/kosmos-base/recipes/letsencrypt.rb b/site-cookbooks/kosmos-base/recipes/letsencrypt.rb
index ec7f529..ad435e2 100644
--- a/site-cookbooks/kosmos-base/recipes/letsencrypt.rb
+++ b/site-cookbooks/kosmos-base/recipes/letsencrypt.rb
@@ -7,16 +7,43 @@
 # All rights reserved - Do Not Redistribute
 #
 
-git "/usr/local/letsencrypt" do
-  repository "https://github.com/letsencrypt/letsencrypt"
+git "/usr/local/certbot" do
+  repository "https://github.com/certbot/certbot"
   action     :sync
-  revision   "v0.5.0"
+  revision   "v0.12.0"
   user       "root"
   group      "root"
 end
 
+letsencrypt_renew_hook = <<-EOF
+#!/usr/bin/env bash
+
+# Reloading nginx is enough to read the new certificates
+systemctl reload nginx
+
+# Copy the prosody certificate and restart the server if it has been renewed
+# This is necessary because the prosody user doesn't have access to the
+# letsencrypt live folder
+echo "${RENEWED_DOMAINS}" | grep xmpp.5apps.com
+if [ $? -ne 1 ]; then
+  cp /etc/letsencrypt/live/xmpp.5apps.com/fullchain.pem /var/lib/prosody/xmpp.5apps.com.crt
+  cp /etc/letsencrypt/live/xmpp.5apps.com/privkey.pem /var/lib/prosody/xmpp.5apps.com.key
+  systemctl restart prosody
+else
+  exit 0
+fi
+EOF
+
+file "/usr/local/bin/letsencrypt_renew_hook" do
+  content letsencrypt_renew_hook
+  mode 0700
+  owner "root"
+  group "root"
+end
+
 cron "renew Let's Encrypt certificates" do
   minute "0"
   hour "4"
-  command "/usr/local/letsencrypt/letsencrypt-auto renew && service nginx restart"
+  # The post hook is only executed if a cert has been renewed
+  command "/usr/local/certbot/certbot-auto renew --renew-hook \"/usr/local/bin/letsencrypt_renew_hook\" -n"
 end
diff --git a/site-cookbooks/kosmos-mediawiki/recipes/default.rb b/site-cookbooks/kosmos-mediawiki/recipes/default.rb
index 8908e43..e9639ef 100644
--- a/site-cookbooks/kosmos-mediawiki/recipes/default.rb
+++ b/site-cookbooks/kosmos-mediawiki/recipes/default.rb
@@ -50,8 +50,8 @@ include_recipe "mediawiki::nginx"
 include_recipe "kosmos-base::letsencrypt"
 
 execute "letsencrypt cert for wiki.kosmos.org" do
-  command "./letsencrypt-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node["mediawiki"]["docroot_dir"]} -d wiki.kosmos.org"
-  cwd "/usr/local/letsencrypt"
+  command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node["mediawiki"]["docroot_dir"]} -d wiki.kosmos.org -n"
+  cwd "/usr/local/certbot"
   not_if { File.exist? "/etc/letsencrypt/live/wiki.kosmos.org/fullchain.pem" }
   notifies :reload, "service[nginx]", :delayed
 end
diff --git a/site-cookbooks/kosmos-wordpress/recipes/nginx.rb b/site-cookbooks/kosmos-wordpress/recipes/nginx.rb
index 4e57bb1..71fbd51 100644
--- a/site-cookbooks/kosmos-wordpress/recipes/nginx.rb
+++ b/site-cookbooks/kosmos-wordpress/recipes/nginx.rb
@@ -64,8 +64,8 @@ include_recipe "kosmos-nginx"
 include_recipe "wordpress::app"
 
 execute "letsencrypt cert for blog.kosmos.org" do
-  command "./letsencrypt-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['wordpress']['dir']} -d blog.kosmos.org"
-  cwd "/usr/local/letsencrypt"
+  command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{node['wordpress']['dir']} -d blog.kosmos.org -n"
+  cwd "/usr/local/certbot"
   not_if { File.exist? "/etc/letsencrypt/live/blog.kosmos.org/fullchain.pem" }
   notifies :reload, "service[nginx]", :delayed
 end
diff --git a/site-cookbooks/sockethub/recipes/default.rb b/site-cookbooks/sockethub/recipes/default.rb
index d66f80c..1428270 100644
--- a/site-cookbooks/sockethub/recipes/default.rb
+++ b/site-cookbooks/sockethub/recipes/default.rb
@@ -19,7 +19,7 @@ application "sockethub" do
   action :deploy
 
   repository 'https://github.com/sockethub/sockethub.git'
-  revision   'master'
+  revision   'v1.0.5'
 
   nodejs do
     entry_point '/srv/sockethub/current/bin/sockethub'
diff --git a/site-cookbooks/sockethub/recipes/proxy.rb b/site-cookbooks/sockethub/recipes/proxy.rb
index 46e0900..0663151 100644
--- a/site-cookbooks/sockethub/recipes/proxy.rb
+++ b/site-cookbooks/sockethub/recipes/proxy.rb
@@ -38,8 +38,8 @@ template "#{node['nginx']['dir']}/sites-available/sockethub" do
 end
 
 execute "letsencrypt cert for sockethub.kosmos.org" do
-  command "./letsencrypt-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/sockethub -d sockethub.kosmos.org"
-  cwd "/usr/local/letsencrypt"
+  command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/sockethub -d sockethub.kosmos.org -n"
+  cwd "/usr/local/certbot"
   not_if { File.exist? "/etc/letsencrypt/live/sockethub.kosmos.org/fullchain.pem" }
   notifies :reload, "service[nginx]", :delayed
 end