66 lines
1.9 KiB
Ruby
66 lines
1.9 KiB
Ruby
#
|
|
# Cookbook Name:: kosmos-base
|
|
# Recipe:: letsencrypt
|
|
#
|
|
# Copyright 2018, Kosmos
|
|
#
|
|
# All rights reserved - Do Not Redistribute
|
|
#
|
|
|
|
# Install certbot and set up hooks
|
|
|
|
apt_repository "certbot" do
|
|
uri "http://ppa.launchpad.net/certbot/certbot/ubuntu"
|
|
distribution node["lsb"]["codename"]
|
|
components ["main"]
|
|
keyserver "keyserver.ubuntu.com"
|
|
key "7BF576066ADA65728FC7E70A8C47BE8E75BCA694"
|
|
end
|
|
|
|
package "certbot"
|
|
|
|
letsencrypt_renew_hook = <<-EOF
|
|
#!/usr/bin/env bash
|
|
|
|
# Reloading nginx is enough to read the new certificates
|
|
systemctl reload nginx
|
|
|
|
# Copy the prosody certificates and restart the server if it has been renewed
|
|
# This is necessary because the prosody user doesn't have access to the
|
|
# letsencrypt live folder
|
|
for domain in $RENEWED_DOMAINS; do
|
|
case $domain in
|
|
# Do not copy over when renewing other 5apps.com domains
|
|
5apps.com)
|
|
cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/5apps.com.crt
|
|
cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/5apps.com.key
|
|
cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/muc.5apps.com.crt
|
|
cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/muc.5apps.com.key
|
|
cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/xmpp.5apps.com.crt
|
|
cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/xmpp.5apps.com.key
|
|
chown prosody:prosody /etc/prosody/certs/*
|
|
chmod 600 /etc/prosody/certs/*.key
|
|
chmod 640 /etc/prosody/certs/*.crt
|
|
systemctl restart prosody
|
|
;;
|
|
esac
|
|
done
|
|
EOF
|
|
|
|
file "/usr/local/bin/letsencrypt_renew_hook" do
|
|
content letsencrypt_renew_hook
|
|
mode 0755
|
|
owner "root"
|
|
group "root"
|
|
end
|
|
|
|
unless node.chef_environment == "development"
|
|
cron "renew Let's Encrypt certificates" do
|
|
minute "0"
|
|
hour "4"
|
|
mailto "ops@5apps.com"
|
|
# The post hook is only executed if a cert has been renewed
|
|
command "certbot renew --renew-hook letsencrypt_renew_hook -n 1> /dev/null"
|
|
end
|
|
end
|