Switch blogs to letsencrypt

diff --git a/cookbooks/blogs/recipes/default.rb b/cookbooks/blogs/recipes/default.rb
index f90c3ce5d4d07395308162aa7bc13feca4b995f8..6c0127ea20e82cd609b9d4fd56bca1fdb6353bba 100644 (file)
--- a/cookbooks/blogs/recipes/default.rb
+++ b/cookbooks/blogs/recipes/default.rb
@@ -59,6 +59,12 @@ execute "/srv/blogs.openstreetmap.org" do
   group "blogs"
 end
 
+ssl_certificate "blops.openstreetmap.org" do
+  domains "blogs.openstreetmap.org"
+  fallback_certificate "openstreetmap"
+  notifies :reload, "service[apache2]"
+end
+
 apache_site "blogs.openstreetmap.org" do
   template "apache.erb"
   directory "/srv/blogs.openstreetmap.org/build"

diff --git a/cookbooks/blogs/templates/default/apache.erb b/cookbooks/blogs/templates/default/apache.erb
index 1cb0fe44c6c43972d90b0a344b63e969de029392..7986de43060fade4e3634c621af096325c86bf30 100644 (file)
--- a/cookbooks/blogs/templates/default/apache.erb
+++ b/cookbooks/blogs/templates/default/apache.erb
@@ -7,6 +7,7 @@
    CustomLog /var/log/apache2/<%= @name %>-access.log combined
    ErrorLog /var/log/apache2/<%= @name %>-error.log
 
+   RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/
    Redirect permanent / https://<%= @name %>/
 </VirtualHost>
 
@@ -20,6 +21,8 @@
    DocumentRoot <%= @directory %>
 
    SSLEngine on
+   SSLCertificateFile /etc/ssl/certs/<%= @name %>.pem
+   SSLCertificateKeyFile /etc/ssl/private/<%= @name %>.key
 </VirtualHost>
 
 <Directory <%= @directory %>>