summaryrefslogtreecommitdiff
path: root/puppet/modules/site_apache
diff options
context:
space:
mode:
authorelijah <elijah@riseup.net>2016-08-31 14:54:46 -0700
committerelijah <elijah@riseup.net>2016-09-01 10:49:22 -0700
commit8116e007cfd4dbee8282247348cf45473dcde45e (patch)
treeecf8cfbc790ef57c3519c947a1fa76d0c1a4e5a2 /puppet/modules/site_apache
parentd679399af0898b959b8b84a8e8d1e2e03c4e21b5 (diff)
added support for Let's Encrypt
Diffstat (limited to 'puppet/modules/site_apache')
-rw-r--r--puppet/modules/site_apache/files/conf.d/acme.conf10
-rw-r--r--puppet/modules/site_apache/manifests/common.pp2
-rw-r--r--puppet/modules/site_apache/manifests/common/acme.pp38
3 files changed, 50 insertions, 0 deletions
diff --git a/puppet/modules/site_apache/files/conf.d/acme.conf b/puppet/modules/site_apache/files/conf.d/acme.conf
new file mode 100644
index 00000000..cdddf53e
--- /dev/null
+++ b/puppet/modules/site_apache/files/conf.d/acme.conf
@@ -0,0 +1,10 @@
+#
+# Allow ACME certificate verification if /srv/acme exists.
+#
+<IfModule mod_headers.c>
+ Alias "/.well-known/acme-challenge/" "/srv/acme/"
+ <Directory "/srv/acme/*">
+ Require all granted
+ Header set Content-Type "application/jose+json"
+ </Directory>
+</IfModule>
diff --git a/puppet/modules/site_apache/manifests/common.pp b/puppet/modules/site_apache/manifests/common.pp
index 8a11759a..208c15d5 100644
--- a/puppet/modules/site_apache/manifests/common.pp
+++ b/puppet/modules/site_apache/manifests/common.pp
@@ -27,4 +27,6 @@ class site_apache::common {
}
include site_apache::common::tls
+ include site_apache::common::acme
+
}
diff --git a/puppet/modules/site_apache/manifests/common/acme.pp b/puppet/modules/site_apache/manifests/common/acme.pp
new file mode 100644
index 00000000..eda4148b
--- /dev/null
+++ b/puppet/modules/site_apache/manifests/common/acme.pp
@@ -0,0 +1,38 @@
+#
+# Allows for potential ACME validations (aka Let's Encrypt)
+#
+class site_apache::common::acme {
+ #
+ # well, this doesn't work:
+ #
+ # apache::config::global {'acme.conf':}
+ #
+ # since /etc/apache2/conf.d is NEVER LOADED BY APACHE
+ # https://gitlab.com/shared-puppet-modules-group/apache/issues/11
+ #
+
+ file {
+ '/etc/apache2/conf-available/acme.conf':
+ ensure => present,
+ source => 'puppet:///modules/site_apache/conf.d/acme.conf',
+ require => Package[apache],
+ notify => Service[apache];
+ '/etc/apache2/conf-enabled/acme.conf':
+ ensure => link,
+ target => '/etc/apache2/conf-available/acme.conf',
+ require => Package[apache],
+ notify => Service[apache];
+ }
+
+ file {
+ '/srv/acme':
+ ensure => 'directory',
+ owner => 'www-data',
+ group => 'www-data',
+ mode => '0755';
+ '/srv/acme/ok':
+ owner => 'www-data',
+ group => 'www-data',
+ content => 'ok';
+ }
+}