sky: certbot: configure certbot

esmil:
- don't install cron job, just use the packaged timer
- install deploy hook to reload nginx when certificates are updated

2 files changed, 23 insertions, 0 deletions

diff --git a/roles/sky/templates/certbot-nginx.sh.j2 b/roles/sky/templates/certbot-nginx.sh.j2
new file mode 100755
index 0000000..96ffe6d
--- /dev/null
+++ b/roles/sky/templates/certbot-nginx.sh.j2
@@ -0,0 +1,9 @@
+#!/bin/sh
+
+case "$RENEWED_LINEAGE" in
+*'/{{ domain_name }}')
+  exec systemctl reload nginx.service
+  ;;
+esac
+
+# vim: set ts=2 sw=2 et:
diff --git a/roles/sky/templates/letsencrypt.nginx.j2 b/roles/sky/templates/letsencrypt.nginx.j2
new file mode 100644
index 0000000..a04f58c
--- /dev/null
+++ b/roles/sky/templates/letsencrypt.nginx.j2
@@ -0,0 +1,14 @@
+server {
+	listen *:80;
+	listen [::]:80;
+	server_name {{ domain_name }} www.labitat.dk;
+
+	location /.well-known/acme-challenge {
+		root /var/www/letsencrypt;
+		try_files $uri $uri/ =404;
+	}
+
+	location / {
+		return 301 https://$host$request_uri;
+	}
+}