Enable LetsEncrypt when external_url is https
Here we change the default value of letsencrypt['enable'] from `false` to `nil`. This allows a user to specify explicit `true` or `false` if they want to, and then when they don't specify we use the code in `LetsEncrypt.should_enable?` as a heuristic to see if we should enable. The initial version of the heuristic is: url has https AND nginx is not disabled AND nginx is listening to https AND ( ( nginx certficate file is absent AND nginx key file is absent ) OR we previously were enabled ) The furry part is the 'we previously were enabled'. As enabling the letsencrypt module creates certificate files we would then treat these as user-supplied certificates and so fail to renew or otherwise manage the lifecycle of the certificates. * Changes default of `letsencrypt['enable']` to nil. It's falsey, but not definitive * Adds LetsEncrypt parse helper to the `letsencyrpt` attribute * Adds LetsEncrypt.should_enable? to hold the heuristic * Adds Gitlab['letsencrypt]['auto_enabled'] to the secrets file * Adds LetsEncrypt.save_auto_enabled to persist to the secrets file only if the ['letsencrypt]['auto_enabled'] attribute is missing from the secrets file * Splits SecretsHelper.load_gitlab_secrets out from read_gitlab_secrets, so we can load inspect the secrets file without fully loading it.
Showing
- CHANGELOG.md 3 additions, 0 deletionsCHANGELOG.md
- doc/settings/ssl.md 9 additions, 1 deletiondoc/settings/ssl.md
- files/gitlab-config-template/gitlab.rb.template 1 addition, 1 deletionfiles/gitlab-config-template/gitlab.rb.template
- files/gitlab-cookbooks/letsencrypt/attributes/default.rb 1 addition, 1 deletionfiles/gitlab-cookbooks/letsencrypt/attributes/default.rb
- files/gitlab-cookbooks/letsencrypt/libraries/lets_encrypt.rb 73 additions, 0 deletionsfiles/gitlab-cookbooks/letsencrypt/libraries/lets_encrypt.rb
- files/gitlab-cookbooks/letsencrypt/recipes/enable.rb 6 additions, 0 deletionsfiles/gitlab-cookbooks/letsencrypt/recipes/enable.rb
- files/gitlab-cookbooks/package/libraries/config/gitlab.rb 1 addition, 1 deletionfiles/gitlab-cookbooks/package/libraries/config/gitlab.rb
- files/gitlab-cookbooks/package/libraries/helpers/secrets_helper.rb 15 additions, 3 deletions...lab-cookbooks/package/libraries/helpers/secrets_helper.rb
- spec/chef/recipes/letsencrypt_spec.rb 38 additions, 0 deletionsspec/chef/recipes/letsencrypt_spec.rb
- spec/chef_helper.rb 1 addition, 1 deletionspec/chef_helper.rb
- spec/libraries/lets_encrypt_spec.rb 140 additions, 0 deletionsspec/libraries/lets_encrypt_spec.rb
Loading
Please register or sign in to comment