Râu Cao
7452ae1ee7
Allows to point other domains' `_acme-challenge.example.com` entries at `example.com.letsencrypt.kosmos.chat` so we can validate from our side without access to the other domain's DNS records. Used for 5apps.com XMPP for now. Can be used for others later.
60 lines
2.4 KiB
Ruby
60 lines
2.4 KiB
Ruby
#
|
|
# Cookbook:: kosmos-ejabberd
|
|
# Recipe:: letsencrypt
|
|
#
|
|
|
|
include_recipe "kosmos-base::letsencrypt"
|
|
|
|
ejabberd_post_hook = <<-EOF
|
|
#!/usr/bin/env bash
|
|
|
|
set -e
|
|
|
|
# Copy the ejabberd certificate and restart the server if it has been renewed
|
|
# This is necessary because the ejabberd user doesn't have access to the
|
|
# letsencrypt live folder
|
|
for domain in $RENEWED_DOMAINS; do
|
|
case $domain in
|
|
kosmos.org|5apps.com)
|
|
cp "${RENEWED_LINEAGE}/privkey.pem" /opt/ejabberd/conf/$domain.key
|
|
cp "${RENEWED_LINEAGE}/fullchain.pem" /opt/ejabberd/conf/$domain.crt
|
|
chown ejabberd:ejabberd /opt/ejabberd/conf/$domain.*
|
|
chmod 600 /opt/ejabberd/conf/$domain.*
|
|
/opt/ejabberd-#{node["ejabberd"]["version"]}/bin/ejabberdctl reload_config
|
|
;;
|
|
esac
|
|
done
|
|
EOF
|
|
|
|
file "/etc/letsencrypt/renewal-hooks/post/ejabberd" do
|
|
content ejabberd_post_hook
|
|
mode 0755
|
|
owner "root"
|
|
group "root"
|
|
end
|
|
|
|
gandi_api_credentials = data_bag_item('credentials', 'gandi_api_5apps')
|
|
|
|
template "/root/gandi_dns_certbot_hook.sh" do
|
|
variables access_token: gandi_api_credentials["access_token"]
|
|
mode 0700
|
|
end
|
|
|
|
# Generate a Let's Encrypt cert (only if no cert has been generated before).
|
|
# The systemd timer will take care of renewing
|
|
execute "letsencrypt cert for kosmos xmpp" do
|
|
command "certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d kosmos.chat -d uploads.xmpp.kosmos.org -n"
|
|
not_if do
|
|
File.exist?("/etc/letsencrypt/live/kosmos.org/fullchain.pem")
|
|
end
|
|
end
|
|
|
|
# Generate a Let's Encrypt cert (only if no cert has been generated before).
|
|
# The systemd timer will take care of renewing
|
|
execute "letsencrypt cert for 5apps xmpp" do
|
|
command "certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth letsencrypt.kosmos.chat\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.chat\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@5apps.com -d 5apps.com -d muc.5apps.com -d xmpp.5apps.com -d uploads.xmpp.5apps.com -n"
|
|
not_if do
|
|
File.exist?("/etc/letsencrypt/live/5apps.com/fullchain.pem")
|
|
end
|
|
end
|