Sebastian Kippe
a77580d6da
The domain name is hardcoded exactly 12 times in just the letsencrypt recipe.
63 lines
2.2 KiB
Ruby
63 lines
2.2 KiB
Ruby
#
|
|
# Cookbook Name:: kosmos-ipfs
|
|
# Recipe:: letsencrypt
|
|
#
|
|
# Copyright 2017, Kosmos
|
|
#
|
|
# All rights reserved - Do Not Redistribute
|
|
#
|
|
# nginx config to generate a Let's Encrypt cert
|
|
|
|
unless node.chef_environment == "development"
|
|
include_recipe "kosmos-base::letsencrypt"
|
|
end
|
|
|
|
include_recipe "kosmos-nginx"
|
|
|
|
root_directory = "/var/www/#{node["kosmos-ipfs"]["nginx"]["domain"]}"
|
|
|
|
directory "#{root_directory}/.well-known/acme-challenge" do
|
|
owner node["nginx"]["user"]
|
|
group node["nginx"]["group"]
|
|
action :create
|
|
recursive true
|
|
end
|
|
|
|
template "#{node['nginx']['dir']}/sites-available/#{node["kosmos-ipfs"]["nginx"]["domain"]}" do
|
|
source "nginx_conf_#{node["kosmos-ipfs"]["nginx"]["domain"]}.erb"
|
|
owner 'www-data'
|
|
mode 0640
|
|
variables server_name: node["kosmos-ipfs"]["nginx"]["domain"],
|
|
root_directory: root_directory,
|
|
ssl_cert: "/etc/letsencrypt/live/#{node["kosmos-ipfs"]["nginx"]["domain"]}/fullchain.pem",
|
|
ssl_key: "/etc/letsencrypt/live/#{node["kosmos-ipfs"]["nginx"]["domain"]}/privkey.pem",
|
|
ipfs_api_port: node['kosmos-ipfs']['nginx']['api_port'],
|
|
ipfs_external_api_port: 5444
|
|
|
|
notifies :reload, 'service[nginx]', :delayed
|
|
end
|
|
|
|
nginx_site node["kosmos-ipfs"]["nginx"]["domain"] do
|
|
enable true
|
|
end
|
|
|
|
unless node.chef_environment == "development"
|
|
include_recipe "firewall"
|
|
firewall_rule 'ipfs_api' do
|
|
port 5444
|
|
protocol :tcp
|
|
command :allow
|
|
end
|
|
|
|
# Generate a Let's Encrypt cert (only if the nginx vhost exists and no cert
|
|
# has been generated before. The renew cron will take care of renewing
|
|
execute "letsencrypt cert for #{node["kosmos-ipfs"]["nginx"]["domain"]}" do
|
|
command "/usr/bin/certbot certonly --webroot --agree-tos --email ops@5apps.com --webroot-path #{root_directory} -d #{node["kosmos-ipfs"]["nginx"]["domain"]} -n"
|
|
only_if do
|
|
File.exist?("#{node['nginx']['dir']}/sites-enabled/#{node["kosmos-ipfs"]["nginx"]["domain"]}") &&
|
|
!File.exist?("/etc/letsencrypt/live/#{node["kosmos-ipfs"]["nginx"]["domain"]}/fullchain.pem")
|
|
end
|
|
notifies :create, "template[#{node['nginx']['dir']}/sites-available/#{node["kosmos-ipfs"]["nginx"]["domain"]}]", :delayed
|
|
end
|
|
end
|