Generate letsencrypt certificates for mediawiki sites

diff --git a/.rubocop_todo.yml b/.rubocop_todo.yml
index f5b756028f392d8d8f9d4c1a0eabf38f7b16ac63..d566e2bccb3ef4c0be8ad081759795b32aa0a36e 100644 (file)
--- a/.rubocop_todo.yml
+++ b/.rubocop_todo.yml
@@ -13,7 +13,7 @@ Metrics/AbcSize:
 # Offense count: 27
 # Configuration parameters: CountComments.
 Metrics/BlockLength:
-  Max: 356
+  Max: 359
 
 # Offense count: 3
 Metrics/CyclomaticComplexity:

diff --git a/cookbooks/mediawiki/.foodcritic b/cookbooks/mediawiki/.foodcritic
index a085263c88d33bf5f31d0db1a6beb8cd2a9ef9f6..26719e832809179bd8996ff850845a98508358e9 100644 (file)
--- a/cookbooks/mediawiki/.foodcritic
+++ b/cookbooks/mediawiki/.foodcritic
@@ -1,3 +1,4 @@
 ~FC001
+~FC021
 ~FC064
 ~FC065

diff --git a/cookbooks/mediawiki/providers/site.rb b/cookbooks/mediawiki/providers/site.rb
index 7c5792aa04decf24420ce34acdddf64eb44c76cf..24b53c8faed420473759fb3b2ef0f9b46f45566f 100644 (file)
--- a/cookbooks/mediawiki/providers/site.rb
+++ b/cookbooks/mediawiki/providers/site.rb
@@ -454,15 +454,19 @@ action :create do
 
   ports = new_resource.ssl_enabled ? [80, 443] : [80]
 
+  ssl_certificate new_resource.name do
+    domains [new_resource.name] + Array(new_resource.aliases)
+    only_if { new_resource.ssl_enabled }
+  end
+
   apache_site new_resource.name do
     cookbook "mediawiki"
     template "apache.erb"
     directory site_directory
     variables :aliases => Array(new_resource.aliases),
               :private => new_resource.private,
-              :ports => ports,
-              :ssl_certificate => new_resource.ssl_certificate,
-              :ssl_certificate_chain => new_resource.ssl_certificate_chain
+              :ssl_enabled => new_resource.ssl_enabled,
+              :ports => ports
     reload_apache false
   end
 

diff --git a/cookbooks/mediawiki/resources/site.rb b/cookbooks/mediawiki/resources/site.rb
index b05ebe4c313601de226b271f381d697ee8e769a2..2521bc65ddfdcc940d67a5e4a0613efe13530d82 100644 (file)
--- a/cookbooks/mediawiki/resources/site.rb
+++ b/cookbooks/mediawiki/resources/site.rb
@@ -40,8 +40,6 @@ attribute :site_readonly, :kind_of => [String, TrueClass, FalseClass], :default
 attribute :admin_user, :kind_of => String, :default => "Admin"
 attribute :admin_password, :kind_of => String, :required => true
 attribute :ssl_enabled, :kind_of => [TrueClass, FalseClass], :default => false
-attribute :ssl_certificate, :kind_of => String
-attribute :ssl_certificate_chain, :kind_of => String
 attribute :private_accounts, :kind_of => [TrueClass, FalseClass], :default => false
 attribute :private, :kind_of => [TrueClass, FalseClass], :default => false
 attribute :recaptcha_public_key, :kind_of => String

diff --git a/cookbooks/mediawiki/templates/default/apache.erb b/cookbooks/mediawiki/templates/default/apache.erb
index 7aed4b3e71139acc3780a2ae9b0159baf700e835..a3cb02ad1d926c213f22c324f14dd304509e62dc 100644 (file)
--- a/cookbooks/mediawiki/templates/default/apache.erb
+++ b/cookbooks/mediawiki/templates/default/apache.erb
@@ -21,6 +21,10 @@
 
   DocumentRoot <%= @directory %>
 
+<% if @ssl_enabled -%>
+  RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/
+<% end -%>
+
   php_admin_value open_basedir <%= @directory %>/:/usr/share/php/:/tmp/
   #php_admin_value disable_functions "exec,shell_exec,system,passthru,popen,proc_open"
   php_value memory_limit 128M
@@ -57,6 +61,7 @@
   RewriteCond %{REQUEST_URI} !^/api\.php$
   RewriteCond %{REQUEST_URI} !^/opensearch_desc\.php$
   RewriteCond %{REQUEST_URI} !^/server-status
+  RewriteCond %{REQUEST_URI} !^/.well-known/
   RewriteCond %{LA-U:REQUEST_FILENAME} !-f
   RewriteCond %{LA-U:REQUEST_FILENAME} !-d
   RewriteRule ^/(.*) /wiki/$1 [R,L]