#
# Cookbook Name:: kosmos-ipfs
# Recipe:: letsencrypt
#
# Copyright 2017, Kosmos
#
# All rights reserved - Do Not Redistribute
#
# nginx config to generate a Let's Encrypt cert

unless node.chef_environment == "development"
  include_recipe "kosmos-base::letsencrypt"
end

include_recipe "kosmos-nginx"

root_directory = "/var/www/#{node["kosmos-ipfs"]["nginx"]["domain"]}"

directory "#{root_directory}/.well-known/acme-challenge" do
  owner node["nginx"]["user"]
  group node["nginx"]["group"]
  action :create
  recursive true
end

template "#{node['nginx']['dir']}/sites-available/#{node["kosmos-ipfs"]["nginx"]["domain"]}" do
  source "nginx_conf_#{node["kosmos-ipfs"]["nginx"]["domain"]}.erb"
  owner 'www-data'
  mode 0640
  variables server_name:             node["kosmos-ipfs"]["nginx"]["domain"],
            root_directory:          root_directory,
            ssl_cert:                "/etc/letsencrypt/live/#{node["kosmos-ipfs"]["nginx"]["domain"]}/fullchain.pem",
            ssl_key:                 "/etc/letsencrypt/live/#{node["kosmos-ipfs"]["nginx"]["domain"]}/privkey.pem",
            ipfs_api_port:           node['kosmos-ipfs']['nginx']['api_port'],
            ipfs_external_api_port:  5444

  notifies :reload, 'service[nginx]', :delayed
end

nginx_site node["kosmos-ipfs"]["nginx"]["domain"] do
  enable true
end

unless node.chef_environment == "development"
  include_recipe "firewall"
  firewall_rule 'ipfs_api' do
    port     5444
    protocol :tcp
    command  :allow
  end

  # Generate a Let's Encrypt cert (only if the nginx vhost exists and no cert
  # has been generated before. The renew cron will take care of renewing
  execute "letsencrypt cert for #{node["kosmos-ipfs"]["nginx"]["domain"]}" do
    command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{root_directory} -d #{node["kosmos-ipfs"]["nginx"]["domain"]} -n"
    only_if do
      File.exist?("#{node['nginx']['dir']}/sites-enabled/#{node["kosmos-ipfs"]["nginx"]["domain"]}") &&
        !File.exist?("/etc/letsencrypt/live/#{node["kosmos-ipfs"]["nginx"]["domain"]}/fullchain.pem")
    end
    notifies :create, "template[#{node['nginx']['dir']}/sites-available/#{node["kosmos-ipfs"]["nginx"]["domain"]}]", :delayed
  end
end