Archive abandoned project

esh_letsencrypt/recipes/certs.rb

@@ -0,0 +1,84 @@
+#
+# Cookbook:: esh_letsencrypt
+# Recipe:: certs
+#
+# Copyright:: 2022, https://easyself.host
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+email = node['esh']['letsencrypt']['certs']['email']
+certs_list = node['esh']['letsencrypt']['certs']['list']
+
+certs_list.each do |domains|
+  if match = domains.match(/-d\s+(\S+)/)
+    first_domain = match[1]
+  end
+  execute "certbot certonly #{domains}" do
+    command <<~EOT
+    certbot certonly \
+      --standalone \
+      --non-interactive \
+      --agree-tos \
+      --email #{email} \
+      --key-type ecdsa \
+      --elliptic-curve secp384r1 \
+      --http-01-port=8899 \
+      #{domains}
+    EOT
+    not_if { ::File.directory?("/etc/letsencrypt/live/#{first_domain}") }
+    action :run
+  end
+end
+
+certs_list.each do |domains|
+  if match = domains.match(/-d\s+(\S+)/)
+    first_domain = match[1]
+  end
+  execute "certbot renew #{domains}" do
+    command <<~EOT
+    certbot renew \
+      --cert-name #{first_domain} \
+      --http-01-port=8899
+    EOT
+    only_if <<~EOT
+    cert_status=$(certbot certificates #{domains} 2>/dev/null)
+    valid_days=$(echo "$cert_status" | grep 'Expiry Date' | sed 's/.*VALID: \\([0-9]*\\) days.*/\\1/')
+    test $valid_days -le 30
+    EOT
+    action :run
+  end
+end
+
+# Copy certificates for HAProxy (if present)
+certs_list.each do |domains|
+  if match = domains.match(/-d\s+(\S+)/)
+    first_domain = match[1]
+  end
+  execute "copy certificate #{first_domain} for HAproxy" do
+    command <<~EOT
+    cat /etc/letsencrypt/live/#{first_domain}/fullchain.pem \
+      /etc/letsencrypt/live/#{first_domain}/privkey.pem \
+      > /etc/haproxy/crt/#{first_domain}.pem
+    EOT
+    only_if { File.directory?('/etc/haproxy/crt') }
+    only_if <<~EOT
+    test -f /etc/haproxy/crt/#{first_domain}.pem || exit 0
+    grep -qvFf \
+      /etc/letsencrypt/live/#{first_domain}/fullchain.pem \
+      -f /etc/letsencrypt/live/#{first_domain}/privkey.pem \
+      /etc/haproxy/crt/#{first_domain}.pem
+    EOT
+    notifies :reload, 'service[haproxy]', :delayed
+    action :run
+  end
+end

esh_letsencrypt/recipes/default.rb

@@ -0,0 +1,17 @@
+#
+# Cookbook:: esh_letsencrypt
+# Recipe:: default
+#
+# Copyright:: 2022, https://easyself.host
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.

esh_letsencrypt/recipes/serve.rb

@@ -0,0 +1,54 @@
+#
+# Cookbook:: esh_letsencrypt
+# Recipe:: serve
+#
+# Copyright:: 2022, https://easyself.host
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+auth = node['esh']['letsencrypt']['serve']['auth']
+miniserve_url = node['esh']['letsencrypt']['serve']['miniserve_url']
+listen = node['esh']['letsencrypt']['serve']['listen']
+
+remote_file '/usr/local/bin/miniserve' do
+  source miniserve_url
+  mode '0755'
+  action :create
+end
+
+systemd_unit 'letsencrypt-serve.service' do
+  content <<~EOU
+  [Unit]
+  Description=Serve letsencrypt certs
+  
+  [Service]
+  Type=simple
+  ExecStart=/usr/local/bin/miniserve \
+    --auth #{auth} \
+    --interfaces #{listen} \
+    --port 8898 \
+    --verbose \
+    /etc/letsencrypt/live
+  
+  [Install]
+  WantedBy=multi-user.target
+  EOU
+  action :create
+  verify false
+end
+
+service 'letsencrypt-serve' do
+  action [:enable, :start]
+  subscribes :restart, 'remote_file[/usr/local/bin/miniserve]', :delayed
+  subscribes :restart, 'systemd_unit[letsencrypt-serve.service]', :delayed
+end

esh_letsencrypt/recipes/snap.rb

@@ -0,0 +1,23 @@
+#
+# Cookbook:: esh_letsencrypt
+# Recipe:: snap
+#
+# Copyright:: 2022, https://easyself.host
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+execute 'snap install certbot' do
+  command 'snap install certbot --classic'
+  not_if 'snap list | grep -q certbot'
+  action :run
+end