5fa0fa661b
It does not have a ppa release. Add a cron job for renewal. When using the PPA a Systemd timer is part of the package
56 lines
1.1 KiB
Ruby
56 lines
1.1 KiB
Ruby
#
|
|
# Cookbook Name:: kosmos-base
|
|
# Recipe:: letsencrypt
|
|
#
|
|
# Copyright 2018, Kosmos
|
|
#
|
|
# All rights reserved - Do Not Redistribute
|
|
#
|
|
|
|
# Install certbot and set up hooks
|
|
|
|
# Remove the unless/else when we get rid of dev, running 15.04. No ppa for it
|
|
unless node["lsb"]["codename"] == "vivid"
|
|
apt_repository "certbot" do
|
|
uri "ppa:certbot/certbot"
|
|
end
|
|
|
|
package "certbot"
|
|
else
|
|
remote_file "/usr/bin/certbot" do
|
|
source "https://dl.eff.org/certbot-auto"
|
|
mode 0755
|
|
end
|
|
|
|
cron "renew Let's Encrypt certificates" do
|
|
hour "4"
|
|
mailto "logs@5apps.com"
|
|
command "/usr/bin/certbot -q renew"
|
|
end
|
|
end
|
|
|
|
directory "/etc/letsencrypt/renewal-hooks" do
|
|
recursive true
|
|
mode 0755
|
|
owner "root"
|
|
group "root"
|
|
end
|
|
|
|
file "/etc/letsencrypt/renewal-hooks/deploy/nginx" do
|
|
content <<-EOF
|
|
#!/usr/bin/env bash
|
|
# Reloading nginx is enough to read the new certificates
|
|
systemctl reload nginx
|
|
EOF
|
|
mode 0755
|
|
owner "root"
|
|
group "root"
|
|
end
|
|
|
|
gandi_api_data_bag_item = data_bag_item('credentials', 'gandi_api_5apps')
|
|
|
|
template "/root/gandi_dns_certbot_hook.sh" do
|
|
variables gandi_api_key: gandi_api_data_bag_item["key"]
|
|
mode 0770
|
|
end
|