templates/web.letsencrypt.ssl.template.yml

   1 env:
   2   LETSENCRYPT_DIR: "/shared/letsencrypt"
   3
   4 hooks:
   5   after_ssl:
   6     - exec:
   7        cmd:
   8          - if [ -z "$LETSENCRYPT_ACCOUNT_EMAIL" ]; then echo "LETSENCRYPT_ACCOUNT_EMAIL ENV variable is required and has not been set."; exit 1; fi
   9          - /bin/bash -c "if [[ ! \"$LETSENCRYPT_ACCOUNT_EMAIL\" =~ ([^@]+)@([^\.]+) ]]; then echo \"LETSENCRYPT_ACCOUNT_EMAIL is not a valid email address\"; exit 1; fi"
  10
  11     - exec:
  12        cmd:
  13          - cd /root && git clone https://github.com/Neilpang/le.git && cd /root/le && git reset --hard a7b7355dcf1f1b75fb581bf5d15cf26086d58c06
  14          - touch /var/spool/cron/crontabs/root
  15          - install -d -m 0755 -g root -o root $LETSENCRYPT_DIR
  16          - cd /root/le && LE_WORKING_DIR="${LETSENCRYPT_DIR}" ./le.sh install
  17
  18     # Ideally, we want to name the file 'letsencrypt' but we can't until the following is fixed
  19     # https://github.com/Neilpang/acme.sh/issues/164
  20     - file:
  21        path: /etc/runit/1.d/install_ssl_cert
  22        chmod: "+x"
  23        contents: |
  24           #!/bin/bash
  25           LE_WORKING_DIR="$$ENV_LETSENCRYPT_DIR" $$ENV_LETSENCRYPT_DIR/le.sh issue no $$ENV_DISCOURSE_HOSTNAME no 4096
  26           LE_WORKING_DIR="$$ENV_LETSENCRYPT_DIR" $$ENV_LETSENCRYPT_DIR/le.sh installcert $$ENV_DISCOURSE_HOSTNAME /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.cer /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.cer "sv reload nginx"
  27           # After the initial install, switch to Webroot plugin
  28           LE_WORKING_DIR="$$ENV_LETSENCRYPT_DIR" $$ENV_LETSENCRYPT_DIR/le.sh _setopt $$ENV_LETSENCRYPT_DIR/$$ENV_DISCOURSE_HOSTNAME/$$ENV_DISCOURSE_HOSTNAME.conf "Le_Webroot" "=" "/var/www/discourse/public"
  29
  30     - replace:
  31        filename: "/etc/nginx/conf.d/discourse.conf"
  32        from: /ssl_certificate.+/
  33        to: |
  34          ssl_certificate /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.cer;
  35
  36     - replace:
  37        filename: /shared/letsencrypt/account.conf
  38        from: /#ACCOUNT_EMAIL=.+/
  39        to: |
  40          ACCOUNT_EMAIL=$$ENV_LETSENCRYPT_ACCOUNT_EMAIL
  41
  42     - replace:
  43        filename: "/etc/nginx/conf.d/discourse.conf"
  44        from: /ssl_certificate_key.+/
  45        to: |
  46          ssl_certificate_key /shared/ssl/$$ENV_DISCOURSE_HOSTNAME.key; # remember the certificate for 2 months and automatically connect to HTTPS for this domain
  47
  48     - replace:
  49        filename: "/etc/nginx/conf.d/discourse.conf"
  50        from: /add_header.+/
  51        to: |
  52          add_header Strict-Transport-Security 'max-age=5184000';