45 lines
1.8 KiB
Ruby
45 lines
1.8 KiB
Ruby
# Generate a Let's Encrypt cert for 5apps.com, muc.5apps.com and xmpp.5apps.com
|
|
|
|
include_recipe "kosmos-base::letsencrypt"
|
|
|
|
prosody_post_hook = <<-EOF
|
|
#!/usr/bin/env bash
|
|
|
|
# Copy the prosody certificates and restart the server if it has been renewed
|
|
# This is necessary because the prosody user doesn't have access to the
|
|
# letsencrypt live folder
|
|
for domain in $RENEWED_DOMAINS; do
|
|
case $domain in
|
|
# Do not copy over when renewing other 5apps.com domains
|
|
5apps.com)
|
|
cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/5apps.com.crt
|
|
cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/5apps.com.key
|
|
cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/muc.5apps.com.crt
|
|
cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/muc.5apps.com.key
|
|
cp "${RENEWED_LINEAGE}/fullchain.pem" /etc/prosody/certs/xmpp.5apps.com.crt
|
|
cp "${RENEWED_LINEAGE}/privkey.pem" /etc/prosody/certs/xmpp.5apps.com.key
|
|
chown prosody:prosody /etc/prosody/certs/*
|
|
chmod 600 /etc/prosody/certs/*.key
|
|
chmod 640 /etc/prosody/certs/*.crt
|
|
systemctl restart prosody
|
|
;;
|
|
esac
|
|
done
|
|
EOF
|
|
|
|
file "/etc/letsencrypt/renewal-hooks/post/prosody" do
|
|
content prosody_post_hook
|
|
mode 0755
|
|
owner "root"
|
|
group "root"
|
|
end
|
|
|
|
# Generate a Let's Encrypt cert (only if no cert has been generated before).
|
|
# The renew cron will take care of renewing
|
|
execute "letsencrypt cert for 5apps xmpp" do
|
|
command "/usr/bin/certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/letsencrypt_hook.sh auth\" --manual-cleanup-hook \"/root/letsencrypt_hook.sh cleanup\" --deploy-hook letsencrypt_renew_hook --email ops@5apps.com -d 5apps.com -d muc.5apps.com -d xmpp.5apps.com -n"
|
|
not_if do
|
|
File.exist?("/etc/prosody/certs/5apps.com.crt")
|
|
end
|
|
end
|