#
# Cookbook Name:: kosmos-base
# Recipe:: letsencrypt
#
# Copyright 2018, Kosmos
#
# All rights reserved - Do Not Redistribute
#

# Install certbot and set up hooks

apt_repository "certbot" do
  uri "http://ppa.launchpad.net/certbot/certbot/ubuntu"
  distribution node["lsb"]["codename"]
  components ["main"]
  keyserver "keyserver.ubuntu.com"
  key "7BF576066ADA65728FC7E70A8C47BE8E75BCA694"
end

package "certbot"

letsencrypt_renew_hook = <<-EOF
#!/usr/bin/env bash

# Reloading nginx is enough to read the new certificates
systemctl reload nginx

# Copy the prosody certificates and restart the server if it has been renewed
# This is necessary because the prosody user doesn't have access to the
# letsencrypt live folder
for domain in $RENEWED_DOMAINS; do
  case $domain in
  # Do not copy over when renewing other 5apps.com domains
  5apps.com)
    cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/5apps.com.crt
    cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/5apps.com.key
    cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/muc.5apps.com.crt
    cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/muc.5apps.com.key
    cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/xmpp.5apps.com.crt
    cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/xmpp.5apps.com.key
    chown prosody:prosody /etc/prosody/certs/*
    chmod 600 /etc/prosody/certs/*.key
    chmod 640 /etc/prosody/certs/*.crt
    systemctl restart prosody
    ;;
  esac
done
EOF

file "/usr/local/bin/letsencrypt_renew_hook" do
  content letsencrypt_renew_hook
  mode 0755
  owner "root"
  group "root"
end

unless node.chef_environment == "development"
  cron "renew Let's Encrypt certificates" do
    minute "0"
    hour "4"
    mailto "ops@5apps.com"
    # The post hook is only executed if a cert has been renewed
    command "certbot renew --renew-hook letsencrypt_renew_hook -n 1> /dev/null"
  end
end