kosmos/chef
kosmos/chef
8
3
Fork 0
Code Issues 30 Pull Requests 3 Projects 2 Activity

Improve the letsencrypt recipe

Browse Source 
Add missing dependency
Regenerate the nginx vhost after generating the cert for the first time
This commit is contained in:
Greg Karékinian 2017-03-20 13:18:23 +00:00
parent 14542f8419
commit bfd2d52ea8
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
site-cookbooks/5apps-xmpp_server/recipes/letsencrypt.rb
View File

@ -1,11 +1,14 @@
# nginx config to generate a Let's Encrypt cert # nginx config to generate a Let's Encrypt cert
include_recipe "kosmos-base::letsencrypt"
root_directory = "/var/www/xmpp.5apps.com" root_directory = "/var/www/xmpp.5apps.com"
directory root_directory do directory "#{root_directory}/.well-known" do
owner node["nginx"]["user"] owner node["nginx"]["user"]
group node["nginx"]["group"] group node["nginx"]["group"]
action :create action :create
recursive true
end end
template "#{node['nginx']['dir']}/sites-available/xmpp.5apps.com" do template "#{node['nginx']['dir']}/sites-available/xmpp.5apps.com" do
@ -19,11 +22,16 @@ template "#{node['nginx']['dir']}/sites-available/xmpp.5apps.com" do
notifies :reload, 'service[nginx]', :delayed notifies :reload, 'service[nginx]', :delayed
end end
# Generate a Let's Encrypt cert (only if the nginx vhost exists and no cert
# has been generated before. The renew cron will take care of renewing
execute "letsencrypt cert for xmpp.5apps.com" do execute "letsencrypt cert for xmpp.5apps.com" do
command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{root_directory} -d xmpp.5apps.com -n" command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{root_directory} -d xmpp.5apps.com -n"
cwd "/usr/local/certbot" cwd "/usr/local/certbot"
not_if { File.exist? "/etc/letsencrypt/live/xmpp.5apps.com/fullchain.pem" } only_if do
notifies :reload, "service[nginx]", :delayed File.exist?("#{node['nginx']['dir']}/sites-enabled/xmpp.5apps.com") &&
! File.exist?("/etc/letsencrypt/live/xmpp.5apps.com/fullchain.pem")
end
notifies :create, "template[#{node['nginx']['dir']}/sites-available/xmpp.5apps.com]", :delayed
notifies :run, "execute[copy the tls cert to prosody folder]", :delayed notifies :run, "execute[copy the tls cert to prosody folder]", :delayed
end end