From 0301818fa87bf588dfcd13c1644936aa5537fa15 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Hugo=20H=C3=B6rnquist?= <hugo@lysator.liu.se>
Date: Mon, 13 Dec 2021 23:38:02 +0100
Subject: Gandalf web certbot.

---
 modules/profiles/manifests/gandalf_web.pp | 54 +++++++++++++++++++++++++++++--
 1 file changed, 52 insertions(+), 2 deletions(-)

(limited to 'modules')

diff --git a/modules/profiles/manifests/gandalf_web.pp b/modules/profiles/manifests/gandalf_web.pp
index 810064b..1295d83 100644
--- a/modules/profiles/manifests/gandalf_web.pp
+++ b/modules/profiles/manifests/gandalf_web.pp
@@ -1,4 +1,6 @@
-class profiles::gandalf_web {
+class profiles::gandalf_web (
+  String $certname,
+) {
 
   class { '::nginx':
     manage_repo          => false,
@@ -13,6 +15,7 @@ class profiles::gandalf_web {
       'text/plain' => 'wiki txt',
     },
     include_modules_enabled => true,
+    server_purge            => true,
   }
 
   file { '/etc/nginx/modules-enabled':
@@ -21,7 +24,41 @@ class profiles::gandalf_web {
     recurse => true,
   }
 
-  $certname = 'bookmark.gandalf.adrift.space'
+  # TODO this fails at bootstrapping, since letsencrypt requires nginx
+  # to be enabled, but nginx can't be enabled if any cert file is
+  # missing
+  # Letsencrypt::Certonly <| |> -> Nginx::Resource::Server <| |>
+
+  $domains = [
+    'bookmark.gandalf.adrift.space',
+    'calendar.gandalf.adrift.space',
+    'repo.gandalf.adrift.space',
+    'gandalf.adrift.space',
+    'hack.adrift.space',
+    'adrift.space',
+  ]
+
+  ensure_packages (['cronie',], { ensure => installed })
+
+  ensure_packages (['certbot', 'certbot-nginx'], { ensure => installed })
+  class { '::letsencrypt':
+    config   => {
+      email  => 'hugo@hornquist.se',
+      # server => 'https://acme-staging-v02.api.letsencrypt.org/directory',
+      server => 'https://acme-v02.api.letsencrypt.org/directory',
+    },
+    manage_install => false,
+  }
+
+  letsencrypt::certonly { $certname:
+    ensure             => present,
+    domains            => $domains,
+    manage_cron        => true,
+    plugin             => 'nginx',
+    additional_args    => [ '--quiet', ],
+    # pre_hook_commands  => [ 'systemctl stop nginx.service', ],
+    post_hook_commands => [ 'systemctl restart nginx.service', ],
+  }
 
 
   nginx::resource::server { 'gandalf':
@@ -49,4 +86,17 @@ class profiles::gandalf_web {
     server      => 'gandalf',
   }
 
+  nginx::resource::server { 'repo.gandalf.adrift.space':
+    ipv6_enable         => true,
+    ipv6_listen_options => '',
+    server_name         => [ 'repo.gandalf.adrift.space', ],
+    ssl                 => true,
+    ssl_cert             => "/etc/letsencrypt/live/${certname}/fullchain.pem",
+    ssl_key              => "/etc/letsencrypt/live/${certname}/privkey.pem",
+    ssl_redirect         => true,
+    index_files          => [ 'index.html', ],
+    www_root             => '/usr/net/repo/',
+    use_default_location => true,
+  }
+
 }
-- 
cgit v1.2.3