bundles/nginx: add deployment of vhost configs

bundles/nginx/files/site_template

@@ -0,0 +1,25 @@
+server {
+    server_name ${domain};
+    root ${webroot if webroot else '/var/www/{}/'.format(domain)};
+    index ${index if index else 'index.html index.htm'};
+
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+
+    ssl_certificate /var/lib/dehydrated/certs/${domain}/fullchain.pem;
+    ssl_certificate_key /var/lib/dehydrated/certs/${domain}/privkey.pem;
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';
+    ssl_dhparam /etc/ssl/certs/dhparam.pem;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache shared:SSL:10m;
+    ssl_stapling on;
+    ssl_stapling_verify on;
+
+    add_header Strict-Transport-Security "max-age=31104000; preload";
+    add_header X-Frame-Options "DENY";
+
+% if extras:
+<%include file="extras/${node.name}/${domain}" />
+% endif
+}

bundles/nginx/items.py

@@ -21,3 +21,19 @@ svc_systemd = {
         },
     },
 }
+
+for domain, config in node.metadata.get('nginx', {}).get('vhosts', {}).items():
+    files['/etc/nginx/sites/{}'.format(domain)] = {
+        'source': 'site_template',
+        'content_type': 'mako',
+        'context': {
+            'domain': domain,
+            **config
+        },
+        'needs': {
+            'action:letsencrypt_update_certificates',
+        },
+        'triggers': {
+            'svc_systemd:nginx:restart',
+        },
+    }

bundles/nginx/metadata.py

@@ -24,3 +24,16 @@ def defaults(metadata):
             'worker_connections': 1000,
         },
     }, DEFAULTS, DONE
+
+
+@metadata_processor
+def letsencrypt(metadata):
+    if not node.has_bundle('letsencrypt'):
+        return metadata, DONE
+
+    le = metadata.setdefault('letsencrypt', {}).setdefault('domains', {})
+
+    for domain in metadata.get('nginx', {}).get('vhosts', {}).keys():
+        le[domain] = set()
+
+    return metadata, RUN_ME_AGAIN