# nginx config to generate a Let's Encrypt cert include_recipe "kosmos-base::letsencrypt" root_directory = "/var/www/xmpp.5apps.com" directory "#{root_directory}/.well-known" do owner node["nginx"]["user"] group node["nginx"]["group"] action :create recursive true end template "#{node['nginx']['dir']}/sites-available/xmpp.5apps.com" do source 'nginx_conf_xmpp.5apps.com.erb' owner 'www-data' mode 0640 variables server_name: 'xmpp.5apps.com', root_directory: root_directory, ssl_cert: "/etc/letsencrypt/live/xmpp.5apps.com/fullchain.pem", ssl_key: "/etc/letsencrypt/live/xmpp.5apps.com/privkey.pem" notifies :reload, 'service[nginx]', :delayed end # Generate a Let's Encrypt cert (only if the nginx vhost exists and no cert # has been generated before. The renew cron will take care of renewing execute "letsencrypt cert for xmpp.5apps.com" do command "./certbot-auto certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{root_directory} -d xmpp.5apps.com -n" cwd "/usr/local/certbot" only_if do File.exist?("#{node['nginx']['dir']}/sites-enabled/xmpp.5apps.com") && !File.exist?("/etc/letsencrypt/live/xmpp.5apps.com/fullchain.pem") end notifies :create, "template[#{node['nginx']['dir']}/sites-available/xmpp.5apps.com]", :delayed notifies :run, "execute[copy the tls cert to prosody folder]", :delayed end execute "copy the tls cert to prosody folder" do action :nothing command <<-EOF cp /etc/letsencrypt/live/xmpp.5apps.com/fullchain.pem /var/lib/prosody/xmpp.5apps.com.crt cp /etc/letsencrypt/live/xmpp.5apps.com/privkey.pem /var/lib/prosody/xmpp.5apps.com.key EOF notifies :restart, "service[prosody]", :delayed end nginx_site 'xmpp.5apps.com' do enable true end