#
# Cookbook Name:: sockethub
# Recipe:: proxy
#
# Copyright 2015-2017, Kosmos
#
# All rights reserved - Do Not Redistribute
#

unless node.chef_environment == "development"
  include_recipe "kosmos-base::letsencrypt"

  include_recipe "firewall"
  firewall_rule 'sockethub' do
    port     node['sockethub']['external_port'].to_i
    protocol :tcp
    command  :allow
  end
end

include_recipe 'kosmos-nginx'

directory "/var/www/sockethub" do
  owner     node["nginx"]["user"]
  group     node["nginx"]["group"]
  action    :create
  recursive true
end

template "#{node['nginx']['dir']}/sites-available/sockethub" do
  source 'nginx_conf_sockethub.erb'
  owner 'www-data'
  mode 0640
  variables sockethub_port:          node['sockethub']['port'],
            sockethub_external_port: node['sockethub']['external_port'],
            server_name:             'sockethub.kosmos.org',
            ssl_cert:                "/etc/letsencrypt/live/sockethub.kosmos.org/fullchain.pem",
            ssl_key:                 "/etc/letsencrypt/live/sockethub.kosmos.org/privkey.pem"
  notifies :reload, 'service[nginx]', :delayed
end

unless node.chef_environment == "development"
  execute "letsencrypt cert for sockethub.kosmos.org" do
    command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path /var/www/sockethub -d sockethub.kosmos.org -n"
    cwd "/usr/local/certbot"
    not_if { File.exist? "/etc/letsencrypt/live/sockethub.kosmos.org/fullchain.pem" }
    notifies :reload, "service[nginx]", :delayed
  end
end

nginx_site 'sockethub' do
  enable true
end