138 lines
3.8 KiB
Python
138 lines
3.8 KiB
Python
directories = {
|
|
'/etc/nginx/sites': {
|
|
'purge': True,
|
|
'triggers': {
|
|
'svc_systemd:nginx:restart',
|
|
},
|
|
},
|
|
'/etc/nginx/ssl': {
|
|
'purge': True,
|
|
'triggers': {
|
|
'svc_systemd:nginx:restart',
|
|
},
|
|
},
|
|
'/var/www': {},
|
|
}
|
|
|
|
files = {
|
|
'/etc/nginx/nginx.conf': {
|
|
'content_type': 'mako',
|
|
'context': node.metadata['nginx'],
|
|
'triggers': {
|
|
'svc_systemd:nginx:restart',
|
|
},
|
|
},
|
|
'/etc/nginx/fastcgi.conf': {
|
|
'triggers': {
|
|
'svc_systemd:nginx:restart',
|
|
},
|
|
},
|
|
'/etc/nginx/sites/stub_status': {
|
|
'triggers': {
|
|
'svc_systemd:nginx:restart',
|
|
},
|
|
},
|
|
'/usr/local/share/icinga/plugins/check_nginx_status': {
|
|
'mode': '0755',
|
|
},
|
|
}
|
|
|
|
actions = {
|
|
'nginx-generate-dhparam': {
|
|
'command': 'openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048',
|
|
'unless': 'test -f /etc/ssl/certs/dhparam.pem',
|
|
},
|
|
}
|
|
|
|
svc_systemd = {
|
|
'nginx': {
|
|
'needs': {
|
|
'action:nginx-generate-dhparam',
|
|
'pkg_apt:nginx',
|
|
},
|
|
},
|
|
}
|
|
|
|
install_port80_redirect = False
|
|
port80_has_letsencrypt = False
|
|
for vhost, config in node.metadata.get('nginx/vhosts', {}).items():
|
|
if not 'domain' in config:
|
|
config['domain'] = vhost
|
|
|
|
files[f'/etc/nginx/sites/{vhost}'] = {
|
|
'source': 'site_template',
|
|
'content_type': 'mako',
|
|
'context': {
|
|
'vhost': vhost,
|
|
'php_version': node.metadata.get('php/version', ''),
|
|
**config,
|
|
},
|
|
'needs': set(),
|
|
'needed_by': {
|
|
'svc_systemd:nginx',
|
|
'svc_systemd:nginx:restart',
|
|
},
|
|
'triggers': {
|
|
'svc_systemd:nginx:restart',
|
|
},
|
|
}
|
|
|
|
if not 'webroot' in config:
|
|
directories[f'/var/www/{vhost}'] = {}
|
|
|
|
if node.has_bundle('zfs'):
|
|
directories[f'/var/www/{vhost}']['needs'] = {
|
|
'bundle:zfs',
|
|
}
|
|
|
|
directories[f'/var/www/{vhost}'].update(config.get('webroot_config', {}))
|
|
|
|
if config.get('ssl', 'letsencrypt') == 'letsencrypt':
|
|
files[f'/etc/nginx/sites/{vhost}']['needs'].add('action:letsencrypt_ensure-some-certificate_{}'.format(config['domain']))
|
|
files[f'/etc/nginx/sites/{vhost}']['needed_by'].add('action:letsencrypt_update_certificates')
|
|
port80_has_letsencrypt = True
|
|
install_port80_redirect = True
|
|
|
|
elif config.get('ssl', 'letsencrypt'):
|
|
files[f'/etc/nginx/ssl/{vhost}.crt'] = {
|
|
'content_type': 'mako',
|
|
'source': 'ssl_template',
|
|
'context': {
|
|
'domain': config['ssl'],
|
|
},
|
|
'needed_by': {
|
|
'svc_systemd:nginx',
|
|
'svc_systemd:nginx:restart',
|
|
},
|
|
'triggers': {
|
|
'svc_systemd:nginx:reload',
|
|
},
|
|
}
|
|
files[f'/etc/nginx/ssl/{vhost}.key'] = {
|
|
'content': repo.vault.decrypt_file('ssl/{}.key.pem.vault'.format(config['ssl'])),
|
|
'mode': '0600',
|
|
'needed_by': {
|
|
'svc_systemd:nginx',
|
|
'svc_systemd:nginx:restart',
|
|
},
|
|
'triggers': {
|
|
'svc_systemd:nginx:reload',
|
|
},
|
|
}
|
|
|
|
files[f'/etc/nginx/sites/{vhost}']['needs'].add(f'file:/etc/nginx/ssl/{vhost}.crt')
|
|
files[f'/etc/nginx/sites/{vhost}']['needs'].add(f'file:/etc/nginx/ssl/{vhost}.key')
|
|
install_port80_redirect = True
|
|
|
|
if install_port80_redirect:
|
|
files['/etc/nginx/sites/000-port80.conf'] = {
|
|
'source': 'port80.conf',
|
|
'content_type': 'mako',
|
|
'context': {
|
|
'needs_le': port80_has_letsencrypt,
|
|
},
|
|
'triggers': {
|
|
'svc_systemd:nginx:restart',
|
|
},
|
|
}
|