X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/5479793887e0b883ba46ad689390cf745297ece6..aabbf4d8f3be25ce4e2253074a6c49ab7573ac03:/cookbooks/kibana/recipes/default.rb?ds=inline

diff --git a/cookbooks/kibana/recipes/default.rb b/cookbooks/kibana/recipes/default.rb
index 160d3233c..a3c8dc9f9 100644
--- a/cookbooks/kibana/recipes/default.rb
+++ b/cookbooks/kibana/recipes/default.rb
@@ -1,4 +1,3 @@
-# coding: utf-8
 #
 # Cookbook Name:: kibana
 # Recipe:: default
@@ -9,7 +8,7 @@
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
-#     http://www.apache.org/licenses/LICENSE-2.0
+#     https://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
@@ -20,7 +19,7 @@
 
 require "yaml"
 
-include_recipe "apache::ssl"
+include_recipe "apache"
 
 apache_module "proxy_http"
 
@@ -68,6 +67,11 @@ systemd_service "kibana@" do
   after "network.target"
   user "kibana"
   exec_start "/opt/kibana-#{version}/bin/kibana -c /etc/kibana/%i.yml"
+  private_tmp true
+  private_devices true
+  protect_system "full"
+  protect_home true
+  no_new_privileges true
   restart "on-failure"
 end
 
@@ -79,7 +83,7 @@ node[:kibana][:sites].each do |name, details|
                         "elasticsearch_url" => details[:elasticsearch_url],
                         "pid_file" => "/var/run/kibana/#{name}.pid",
                         "log_file" => "/var/log/kibana/#{name}.log"
-    ))
+                      ))
     owner "root"
     group "root"
     mode 0o644
@@ -89,6 +93,12 @@ node[:kibana][:sites].each do |name, details|
   service "kibana@#{name}" do
     action [:enable, :start]
     supports :status => true, :restart => true, :reload => false
+    subscribes :restart, "systemd_service[kibana@]"
+  end
+
+  ssl_certificate details[:site] do
+    domains details[:site]
+    notifies :reload, "service[apache2]"
   end
 
   apache_site details[:site] do