Enable SSL for imagery sites

[chef.git] / cookbooks / imagery / resources / site.rb

diff --git a/cookbooks/imagery/resources/site.rb b/cookbooks/imagery/resources/site.rb
index ea5884563aa22985f90f003626a32f2f21bcb5df..f8ab667319d6fcad61208bb4544b9c5a67c2b25a 100644 (file)
--- a/cookbooks/imagery/resources/site.rb
+++ b/cookbooks/imagery/resources/site.rb
@@ -30,20 +30,20 @@ action :create do
   directory "/srv/#{name}" do
     user "root"
     group "root"
-    mode 0755
+    mode 0o755
   end
 
   directory "/srv/imagery/layers/#{name}" do
     user "root"
     group "root"
-    mode 0755
+    mode 0o755
     recursive true
   end
 
   directory "/srv/imagery/overlays/#{name}" do
     user "root"
     group "root"
-    mode 0755
+    mode 0o755
     recursive true
   end
 
@@ -51,7 +51,7 @@ action :create do
     source "index.html.erb"
     user "root"
     group "root"
-    mode 0644
+    mode 0o644
     variables :title => title
   end
 
@@ -59,22 +59,42 @@ action :create do
     source "imagery.css"
     user "root"
     group "root"
-    mode 0644
+    mode 0o644
+  end
+
+  cookbook_file "/srv/#{name}/clientaccesspolicy.xml" do
+    source "clientaccesspolicy.xml"
+    user "root"
+    group "root"
+    mode 0o644
+  end
+
+  cookbook_file "/srv/#{name}/crossdomain.xml" do
+    source "crossdomain.xml"
+    user "root"
+    group "root"
+    mode 0o644
   end
 
   layers = Dir.glob("/srv/imagery/layers/#{name}/*.yml").collect do |path|
-    YAML.load(::File.read(path))
+    YAML.safe_load(::File.read(path), [Symbol])
   end
 
   template "/srv/#{name}/imagery.js" do
     source "imagery.js.erb"
     user "root"
     group "root"
-    mode 0644
+    mode 0o644
     variables :bbox => bbox, :layers => layers
   end
 
-  nginx_site name do
+  base_domains = [name] + Array(aliases)
+
+  ssl_certificate new_resource.name do
+    domains base_domains.flat_map { |d| [d, "a.#{d}", "b.#{d}", "c.#{d}"] }
+  end
+
+  nginx_site new_resource.name do
     template "nginx_imagery.conf.erb"
     directory "/srv/imagery/#{name}"
     restart_nginx false