Initial certbot support

diff --git a/manifests/site.pp b/manifests/site.pp
index 6af019eb3cfcf2878e482e4c280fbd55bfa57e5c..586d5c14a45462fae5647e4d8268fe6d93f4b98b 100644 (file)
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -32,8 +32,8 @@ define apache::site(
   $hidden_service       = false,
   $custom_directives    = false,
   $allow_override       = false,
-  $hosting_domain       = hiera('apache::site::domain', $::domain)
-
+  $hosting_domain       = hiera('apache::site::domain', $::domain),
+  $certbot              = false,
 ) {
   $vhost = $filename ? {
     ''      => "${name}",
@@ -118,6 +118,7 @@ define apache::site(
     custom_directives    => $custom_directives,
     allow_override       => $allow_override,
     hosting_domain       => $hosting_domain,
+    certbot              => $certbot,
   }
 
   # Enable or disable accordingly
@@ -128,5 +129,13 @@ define apache::site(
     owner          => $owner,
     group          => $group,
     vhost          => $vhost,
+    require        => Apache::Site::Config[$name],
+  }
+
+  if $certbot == true {
+    certbot::manage { $name:
+      pre_hook => '/usr/sbin/service apache2 reload',
+      require  => Apache::Site::Manage[$name],
+    }
   }
 }

diff --git a/manifests/site/config.pp b/manifests/site/config.pp
index a723eabb890cecdaa766fc02c34e91d1edb03f27..063c08f04db7f5470479d8e0439bd2b29eba3002 100644 (file)
--- a/manifests/site/config.pp
+++ b/manifests/site/config.pp
@@ -21,6 +21,7 @@ define apache::site::config(
   $custom_directives    = false,
   $allow_override       = false,
   $hosting_domain       = hiera('apache::site::domain', $::domain)
+  $certbot              = false,
 ) {
   case $source {
     true: {

diff --git a/templates/site.erb b/templates/site.erb
index 2ed510797b720ab235f12804cc9ce774434aa750..17ff13ebdf60898c4621dc400505eaed6d0b2ad1 100644 (file)
--- a/templates/site.erb
+++ b/templates/site.erb
@@ -38,6 +38,18 @@
      AllowOverride <%= @allow_override %>
    </Directory>
 <% end -%>
+<% if @certbot != false -%>
+   # Add Alias For Lets Encrypt WebRoot Authentication Using ACME
+   # See https://ubuntu101.co.za/ssl/postfix-and-dovecot-on-ubuntu-with-a-lets-encrypt-ssl-certificate/
+   AliasMatch ^/.well-known/acme-challenge/(.*)$ /var/spool/certbot/<%= @name %>/.well-known/acme-challenge/$1
+   Alias /.well-known/acme-challenge/ /var/spool/certbot/<%= @name %>/.well-known/acme-challenge/
+   <Directory "/var/spool/certbot/<%= @name %>/.well-known/acme-challenge/">
+     Options None
+     AllowOverride None
+     ForceType text/plain
+     RedirectMatch 404 "^(?!/\.well-known/acme-challenge/[\w-]{43}$)"
+   </Directory>
+<% end -%>
 </VirtualHost>
 # end vhost for <%= @title %>
 <% if @ssl == true %>