Skip to content
Snippets Groups Projects
Commit c6afc6306377 authored by Ian Baum's avatar Ian Baum
Browse files

Add le renew

parent 5541b5ea0331
No related branches found
No related tags found
No related merge requests found
......@@ -59,5 +59,10 @@
### Renewing
By default, when `gitlab-ctl reconfigure` is run, if the certificate is within 30 days of expiring, it will automatically be renewed.
There are two commands that can be used to renew your Let's Encrypt certificates.
1. `gitlab-ctl reconfigure`
1. `gitlab-ctl renew-le-certs`
Both commands require root privileges and will only perform a request to Let's Encrypt if the certificates are close to expiration date. Please consider [LE rate limits](https://letsencrypt.org/docs/rate-limits/) if you get an error during renewal.
......@@ -63,5 +68,10 @@
Both tools will only perform a request to Let's Encrypt if the certificates are near expiration, so you don't need to be concerned about hitting any [rate limits](https://letsencrypt.org/docs/rate-limits/).
It is recommended to setup a scheduled task to run `gitlab-ctl le-renew-certs` to ensure your Let's Encrypt certificates stay up to date automatically.
An example cron entry to check daily
```sh
0 0 * * * /opt/gitlab/bin/gitlab-ctl le-renew-certs > /dev/null
```
## Troubleshooting
......
#
# Copyright:: Copyright (c) 2018 GitLab Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
include_recipe 'gitlab::config'
if node['gitlab']['nginx']['enable'] && node['letsencrypt']['enable']
include_recipe 'letsencrypt::enable'
end
{
"run_list": [
"recipe[gitlab::letsencrypt_renew]"
]
}
#
# Copyright:: Copyright (c) 2018 GitLab Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
require "#{base_path}/embedded/service/omnibus-ctl/lib/gitlab_ctl"
add_command_under_category('renew-le-certs', "Let's Encrypt", "Renew the existing Let's Encrypt certificates", 2) do
status = GitlabCtl::Util.chef_run('solo.rb', 'renew-letsencrypt.json')
$stdout.puts status.stdout
$stderr.puts Rainbow("There was an error renewing Let's Encrypt certificates, please checkout the output").red if status.error?
end
......@@ -69,6 +69,11 @@
def userinfo(username)
Etc.getpwnam(username)
end
def chef_run(config, attribs)
cookbook_path = "/opt/gitlab/embedded/cookbooks"
run_command("/opt/gitlab/embedded/bin/chef-client -z -c #{cookbook_path}/#{config} -j #{cookbook_path}/#{attribs}")
end
end
end
end
......@@ -99,5 +99,5 @@
end
# This should work standalone for renewal purposes
describe 'letsencrypt::enable' do
describe 'letsencrypt::renew' do
let(:chef_run) do
......@@ -103,12 +103,6 @@
let(:chef_run) do
ChefSpec::SoloRunner.new do |node|
node.normal['gitlab']['external-url'] = 'https://standalone.fakehost.com'
node.normal['gitlab']['nginx']['log_directory'] = '/fake/dir'
node.normal['gitlab']['nginx']['ssl_certificate'] = '/fake/path/cert.crt'
node.normal['gitlab']['nginx']['ssl_certificate_key'] = '/fake/path/cert.key'
node.normal['gitlab']['logging'] = {}
end.converge('letsencrypt::enable')
ChefSpec::SoloRunner.converge('gitlab::letsencrypt_renew')
end
before do
allow(Gitlab).to receive(:[]).and_call_original
......@@ -111,7 +105,13 @@
end
before do
allow(Gitlab).to receive(:[]).and_call_original
stub_gitlab_rb(
external_url: 'https://standalone.fakehost.com',
letsencrypt: {
enable: true
}
)
end
it 'executes letsencrypt_certificate' do
......
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment