Planet cert renewal (#284)

* run renewal as user nginx

* configure template to serve files from well-known/acme-challenge and include defualt_server nginix configuration

salt/planet/config/nginx.planet.conf.jinja

@@ -1,9 +1,17 @@
 {% for site, info in salt["pillar.get"]("planet", {}).get("sites").items() %}
 
 server {
-    listen 80;
+    listen 80 default_server;
     server_name {{ site }};
-    return 301 https://$host$request_uri;
+
+    location /.well-known/acme-challenge/ {
+      alias /etc/lego/.well-known/acme-challenge/;
+      try_files $uri =404;
+    }
+
+    location / {
+      return 301 https://$host$request_uri;
+    }
 }
 
 server {

salt/planet/init.sls

@@ -27,7 +27,7 @@ lego_bootstrap:
 
 lego_renew:
   cron.present:
-    - name: /usr/local/bin/lego -a --email="infrastructure-staff@python.org" {% if pillar["dc"] == "vagrant" %}--server=https://salt-master.vagrant.psf.io:14000/dir{% endif %} --domains="{{ grains['fqdn'] }}" {%- for domain in pillar['planet']['subject_alternative_names']  %} --domains {{ domain }}{%- endfor %} --http --http.webroot /etc/lego --path /etc/lego --key-type ec256  renew --days 30 && /usr/sbin/service nginx reload
+    - name: sudo -u nginx /usr/local/bin/lego -a --email="infrastructure-staff@python.org" {% if pillar["dc"] == "vagrant" %}--server=https://salt-master.vagrant.psf.io:14000/dir{% endif %} --domains="{{ grains['fqdn'] }}" {%- for domain in pillar['planet']['subject_alternative_names']  %} --domains {{ domain }}{%- endfor %} --http --http.webroot /etc/lego --path /etc/lego --key-type ec256  renew --days 30 && /usr/sbin/service nginx reload
     - identifier: roundup_lego_renew
     - hour: 0
     - minute: random