Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(planet): remove lego in favor of haproxy #477

Merged
merged 2 commits into from
Aug 22, 2024
Merged

fix(planet): remove lego in favor of haproxy #477

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eeaeb84
fix: remove lego from pythonplanet in favor of haproxy
JacobCoffee Aug 22, 2024
fca25c7
chore: clean up unused server blocks
JacobCoffee Aug 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 0 additions & 25 deletions salt/planet/config/nginx.planet.conf.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,5 @@
{% for site, info in salt["pillar.get"]("planet", {}).get("sites").items() %}

server {
listen 80 default_server;
server_name {{ site }};

location /.well-known/acme-challenge/ {
alias /etc/lego/.well-known/acme-challenge/;
try_files $uri =404;
}

location / {
return 301 https://$host$request_uri;
}
}

server {
listen 443 ssl;
server_name {{ site }};
error_log /var/log/nginx/{{ site }}.error.log;
access_log /var/log/nginx/{{ site }}.access.log;
ssl_certificate /etc/lego/certificates/{{ grains['fqdn'] }}.crt;
JacobCoffee marked this conversation as resolved.
Show resolved Hide resolved
ssl_certificate_key /etc/lego/certificates/{{ grains['fqdn'] }}.key;

root /srv/{{ site }}/;
}

server {
listen 9000 ssl;
server_name {{ site }};
Expand Down
25 changes: 0 additions & 25 deletions salt/planet/init.sls
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
include:
- nginx
- tls.lego

git:
pkg.installed
Expand Down Expand Up @@ -33,30 +32,6 @@ planet-user:
- require:
- pkg: consul-pkgs

lego_bootstrap:
cmd.run:
- name: /usr/local/bin/lego -a --email="[email protected]" {% if pillar["dc"] == "vagrant" %}--server=https://salt-master.vagrant.psf.io:14000/dir{% endif %} --domains="{{ grains['fqdn'] }}" {%- for domain in pillar['planet']['subject_alternative_names'] %} --domains {{ domain }}{%- endfor %} --http --path /etc/lego --key-type ec256 run
- creates: /etc/lego/certificates/{{ grains['fqdn'] }}.json

lego_renew:
cron.present:
- name: sudo -u nginx /usr/local/bin/lego -a --email="[email protected]" {% if pillar["dc"] == "vagrant" %}--server=https://salt-master.vagrant.psf.io:14000/dir{% endif %} --domains="{{ grains['fqdn'] }}" {%- for domain in pillar['planet']['subject_alternative_names'] %} --domains {{ domain }}{%- endfor %} --http --http.webroot /etc/lego --path /etc/lego --key-type ec256 renew --days 30 && /usr/sbin/service nginx reload
- identifier: roundup_lego_renew
- hour: 0
- minute: random

lego_config:
file.managed:
- name: /etc/nginx/conf.d/lego.conf
- source: salt://tls/config/lego.conf.jinja
- template: jinja
- user: root
- group: root
- mode: "0644"
- require:
- sls: tls.lego
- cmd: lego_bootstrap

/srv/planet/:
file.directory:
- user: planet
Expand Down
Loading