Generate letsencrypt certificates for mediawiki sites

.rubocop_todo.yml

@@ -13,7 +13,7 @@ Metrics/AbcSize:
 # Offense count: 27
 # Configuration parameters: CountComments.
 Metrics/BlockLength:
-  Max: 356
+  Max: 359
 
 # Offense count: 3
 Metrics/CyclomaticComplexity:

cookbooks/mediawiki/.foodcritic

@@ -1,3 +1,4 @@
 ~FC001
+~FC021
 ~FC064
 ~FC065

cookbooks/mediawiki/providers/site.rb

@@ -454,15 +454,19 @@ def whyrun_supported?
 
   ports = new_resource.ssl_enabled ? [80, 443] : [80]
 
+  ssl_certificate new_resource.name do
+    domains [new_resource.name] + Array(new_resource.aliases)
+    only_if { new_resource.ssl_enabled }
+  end
+
   apache_site new_resource.name do
     cookbook "mediawiki"
     template "apache.erb"
     directory site_directory
     variables :aliases => Array(new_resource.aliases),
               :private => new_resource.private,
-              :ports => ports,
-              :ssl_certificate => new_resource.ssl_certificate,
-              :ssl_certificate_chain => new_resource.ssl_certificate_chain
+              :ssl_enabled => new_resource.ssl_enabled,
+              :ports => ports
     reload_apache false
   end
 

cookbooks/mediawiki/resources/site.rb

@@ -40,8 +40,6 @@
 attribute :admin_user, :kind_of => String, :default => "Admin"
 attribute :admin_password, :kind_of => String, :required => true
 attribute :ssl_enabled, :kind_of => [TrueClass, FalseClass], :default => false
-attribute :ssl_certificate, :kind_of => String
-attribute :ssl_certificate_chain, :kind_of => String
 attribute :private_accounts, :kind_of => [TrueClass, FalseClass], :default => false
 attribute :private, :kind_of => [TrueClass, FalseClass], :default => false
 attribute :recaptcha_public_key, :kind_of => String

cookbooks/mediawiki/templates/default/apache.erb

@@ -21,6 +21,10 @@
 
   DocumentRoot <%= @directory %>
 
+<% if @ssl_enabled -%>
+  RedirectPermanent /.well-known/acme-challenge/ http://acme.openstreetmap.org/.well-known/acme-challenge/
+<% end -%>
+
   php_admin_value open_basedir <%= @directory %>/:/usr/share/php/:/tmp/
   #php_admin_value disable_functions "exec,shell_exec,system,passthru,popen,proc_open"
   php_value memory_limit 128M
@@ -57,6 +61,7 @@
   RewriteCond %{REQUEST_URI} !^/api\.php$
   RewriteCond %{REQUEST_URI} !^/opensearch_desc\.php$
   RewriteCond %{REQUEST_URI} !^/server-status
+  RewriteCond %{REQUEST_URI} !^/.well-known/
   RewriteCond %{LA-U:REQUEST_FILENAME} !-f
   RewriteCond %{LA-U:REQUEST_FILENAME} !-d
   RewriteRule ^/(.*) /wiki/$1 [R,L]