56d14748f9
Only copy over the certs to the prosody directory if it's the 5apps.com wildcard, not for any 5apps.com subdomain
60 lines
1.7 KiB
Ruby
60 lines
1.7 KiB
Ruby
#
|
|
# Cookbook Name:: kosmos-base
|
|
# Recipe:: letsencrypt
|
|
#
|
|
# Copyright 2018, Kosmos
|
|
#
|
|
# All rights reserved - Do Not Redistribute
|
|
#
|
|
|
|
git "/usr/local/certbot" do
|
|
repository "https://github.com/certbot/certbot"
|
|
action :sync
|
|
revision "v0.26.1"
|
|
user "root"
|
|
group "root"
|
|
end
|
|
|
|
letsencrypt_renew_hook = <<-EOF
|
|
#!/usr/bin/env bash
|
|
|
|
# Reloading nginx is enough to read the new certificates
|
|
systemctl reload nginx
|
|
|
|
# Copy the prosody certificates and restart the server if it has been renewed
|
|
# This is necessary because the prosody user doesn't have access to the
|
|
# letsencrypt live folder
|
|
for domain in $RENEWED_DOMAINS; do
|
|
case $domain in
|
|
# Do not copy over when renewing other 5apps.com domains
|
|
5apps.com)
|
|
cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/5apps.com.crt
|
|
cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/5apps.com.key
|
|
cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/muc.5apps.com.crt
|
|
cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/muc.5apps.com.key
|
|
cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/xmpp.5apps.com.crt
|
|
cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/xmpp.5apps.com.key
|
|
chown prosody:prosody /etc/prosody/certs/*
|
|
chmod 600 /etc/prosody/certs/*.key
|
|
chmod 640 /etc/prosody/certs/*.crt
|
|
systemctl restart prosody
|
|
;;
|
|
esac
|
|
done
|
|
EOF
|
|
|
|
file "/usr/local/bin/letsencrypt_renew_hook" do
|
|
content letsencrypt_renew_hook
|
|
mode 0755
|
|
owner "root"
|
|
group "root"
|
|
end
|
|
|
|
cron "renew Let's Encrypt certificates" do
|
|
minute "0"
|
|
hour "4"
|
|
mailto "logs@5apps.com"
|
|
# The hook is only executed if a cert has been renewed
|
|
command "/usr/local/certbot/certbot-auto renew --deploy-hook letsencrypt_renew_hook -n 1> /dev/null"
|
|
end
|