Enable SSL for dev apis

diff --git a/cookbooks/dev/recipes/default.rb b/cookbooks/dev/recipes/default.rb
index 3c5dafe250b2d8f56949c2b0a69f70ab17e5bd70..aefd6594d0e8989c99eb74a1eed4633778f59e23 100644 (file)
--- a/cookbooks/dev/recipes/default.rb
+++ b/cookbooks/dev/recipes/default.rb
@@ -20,7 +20,7 @@
 require "yaml"
 require "securerandom"
 
-include_recipe "apache"
+include_recipe "apache::ssl"
 include_recipe "passenger"
 include_recipe "git"
 include_recipe "mysql"
@@ -201,6 +201,11 @@ if node[:postgresql][:clusters][:"9.5/main"]
         notifies :run, "execute[#{rails_directory}]"
       end
 
+      ssl_certificate site_name do
+        domains [site_name] + site_aliases
+        notifies :reload, "service[apache2]"
+      end
+
       apache_site site_name do
         template "apache.rails.erb"
         variables :name => site_name, :aliases => site_aliases, :secret_key_base => secret_key_base
@@ -241,6 +246,11 @@ if node[:postgresql][:clusters][:"9.5/main"]
     mode 0o644
   end
 
+  ssl_certificate "apis.dev.openstreetmap.org" do
+    domains "apis.dev.openstreetmap.org"
+    notifies :reload, "service[apache2]"
+  end
+
   apache_site "apis.dev.openstreetmap.org" do
     template "apache.apis.erb"
   end

diff --git a/cookbooks/dev/templates/default/apache.apis.erb b/cookbooks/dev/templates/default/apache.apis.erb
index 1afec5c9338659e7559d70e234813af5b2a1cb9e..c1eddbdb2b1e83924d95c986a9069a82e786163b 100644 (file)
--- a/cookbooks/dev/templates/default/apache.apis.erb
+++ b/cookbooks/dev/templates/default/apache.apis.erb
@@ -1,13 +1,28 @@
 # DO NOT EDIT - This file is being maintained by Chef
 
-<VirtualHost *:80>
+<VirtualHost *:443>
        ServerName apis.dev.openstreetmap.org
        ServerAdmin webmaster@openstreetmap.org
 
+       SSLEngine on
+       SSLCertificateFile /etc/ssl/certs/apis.dev.openstreetmap.org.pem
+       SSLCertificateKeyFile /etc/ssl/private/apis.dev.openstreetmap.org.key
+
+       CustomLog /var/log/apache2/apis.dev.openstreetmap.org-access.log combined
+       ErrorLog /var/log/apache2/apis.dev.openstreetmap.org-error.log
+
        DocumentRoot /srv/apis.dev.openstreetmap.org
+</VirtualHost>
+
+<VirtualHost *:80>
+       ServerName apis.dev.openstreetmap.org
+       ServerAdmin webmaster@openstreetmap.org
 
        CustomLog /var/log/apache2/apis.dev.openstreetmap.org-access.log combined
        ErrorLog /var/log/apache2/apis.dev.openstreetmap.org-error.log
+
+       RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/
+       RedirectPermanent / https://apis.dev.openstreetmap.org/
 </VirtualHost>
 
 <Directory /srv/apis.dev.openstreetmap.org>

diff --git a/cookbooks/dev/templates/default/apache.rails.erb b/cookbooks/dev/templates/default/apache.rails.erb
index 7301fd83415761ed75b199413d085b2a5cbe7d0d..4eab0d2ee83d4df689d29ee35a4362357c556e58 100644 (file)
--- a/cookbooks/dev/templates/default/apache.rails.erb
+++ b/cookbooks/dev/templates/default/apache.rails.erb
@@ -1,22 +1,40 @@
 # DO NOT EDIT - This file is being maintained by Chef
 
-<VirtualHost *:80>
+<VirtualHost *:443>
         ServerName <%= @name %>
 <% @aliases.each do |alias_name| -%>
         ServerAlias <%= alias_name %>
 <% end -%>
         ServerAdmin webmaster@openstreetmap.org
 
-        DocumentRoot /srv/<%= @name %>/public
+        SSLEngine on
+        SSLCertificateFile /etc/ssl/certs/<%= @name %>.pem
+        SSLCertificateKeyFile /etc/ssl/private/<%= @name %>.key
 
         CustomLog /var/log/apache2/<%= @name %>-access.log combined
         ErrorLog /var/log/apache2/<%= @name %>-error.log
 
+        DocumentRoot /srv/<%= @name %>/public
+
         RailsEnv production
 
         SetEnv SECRET_KEY_BASE <%= @secret_key_base %>
 </VirtualHost>
 
+<VirtualHost *:80>
+        ServerName <%= @name %>
+<% @aliases.each do |alias_name| -%>
+        ServerAlias <%= alias_name %>
+<% end -%>
+        ServerAdmin webmaster@openstreetmap.org
+
+        CustomLog /var/log/apache2/<%= @name %>-access.log combined
+        ErrorLog /var/log/apache2/<%= @name %>-error.log
+
+        RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/
+        RedirectPermanent / https://<%= @name %>/
+</VirtualHost>
+
 <Directory /srv/<%= @name %>/public>
         Require all granted
 </Directory>

diff --git a/cookbooks/dev/templates/default/apis.html.erb b/cookbooks/dev/templates/default/apis.html.erb
index e226350821acf3f3a426a0b093beb5a8972f50e5..d630014cbee21c7cce8d1a0b57df9b7d5bc31e3e 100644 (file)
--- a/cookbooks/dev/templates/default/apis.html.erb
+++ b/cookbooks/dev/templates/default/apis.html.erb
@@ -14,7 +14,7 @@ for testing clients against or as a data sandbox.</p>
 </tr>
 <% node[:dev][:rails].each do |name,details| -%>
 <tr>
-<td><a href="http://<%= name %>.apis.dev.openstreetmap.org/"><%= name %></a></td>
+<td><a href="https://<%= name %>.apis.dev.openstreetmap.org/"><%= name %></a></td>
 <td><%= details[:repository] %></td>
 <td><%= details[:revision] %></td>
 </tr>