feat(provision): use LE wildcard cert for *.collections

refs #17604
Arvados-DCO-1.1-Signed-off-by: Javier Bértoli <jbertoli@curii.com>

diff --git a/tools/salt-install/config_examples/multi_host/aws/certs/README.md b/tools/salt-install/config_examples/multi_host/aws/certs/README.md
index 00d486e1cd83ca42e2cf56bcd81da0df5cd8fb6f..dc9043217ed20bdef72c17546e4072cd485fef9b 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/certs/README.md
+++ b/tools/salt-install/config_examples/multi_host/aws/certs/README.md
@@ -7,7 +7,7 @@ The nodes requiring certificates are:
 
 * CLUSTER.DOMAIN
 * collections.CLUSTER.DOMAIN
-* \*\-\-collections.CLUSTER.DOMAIN
+* \*.collections.CLUSTER.DOMAIN
 * download.CLUSTER.DOMAIN
 * keep.CLUSTER.DOMAIN
 * workbench.CLUSTER.DOMAIN

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/arvados.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/arvados.sls
index 4ecc65e28f0f97c4702f2a10cfc34a7bb828d5c0..f7052efc105abcce54b1e50aa6b294debacf13b8 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/arvados.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/arvados.sls
@@ -175,7 +175,7 @@ arvados:
         InternalURLs:
           'http://localhost:8004': {}
       WebDAV:
-        ExternalURL: 'https://*--collections.__CLUSTER__.__DOMAIN__:__KEEPWEB_EXT_SSL_PORT__/'
+        ExternalURL: 'https://*.collections.__CLUSTER__.__DOMAIN__:__KEEPWEB_EXT_SSL_PORT__/'
         InternalURLs:
           'http://localhost:9002': {}
       WebDAVDownload:

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt.sls
index 6ba8b9b099d9e3168d3996ae0c88f2e83b78e47f..90593307d3a1916c74fac32f001ec86d82b50302 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt.sls
@@ -8,23 +8,13 @@ letsencrypt:
   use_package: true
   pkgs:
     - certbot: latest
-    - python3-certbot-nginx
+    - python3-certbot-dns-route53
   config:
     server: https://acme-v02.api.letsencrypt.org/directory
     email: __INITIAL_USER_EMAIL__
-    authenticator: nginx
-    webroot-path: /var/www
+    authenticator: dns-route53
     agree-tos: true
     keep-until-expiring: true
     expand: true
     max-log-backups: 0
     deploy-hook: systemctl reload nginx
-
-### NGINX
-nginx:
-  ### SNIPPETS
-  snippets:
-    ### LETSENCRYPT DEFAULT PATH
-    letsencrypt_well_known.conf:
-      - location /.well-known:
-        - root: /var/www

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepweb_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepweb_configuration.sls
index dc34ea6fd5f0094c378062ed09e299bf2e78b6be..35ec9b0da734492d1237119c1fe2b0cf862a2006 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepweb_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/letsencrypt_keepweb_configuration.sls
@@ -10,6 +10,7 @@ letsencrypt:
       - download.__CLUSTER__.__DOMAIN__
     collections.__CLUSTER__.__DOMAIN__:
       - collections.__CLUSTER__.__DOMAIN__
+      - *.collections.__CLUSTER__.__DOMAIN__
 
 ### NGINX
 nginx:

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_controller_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_controller_configuration.sls
index 3be1696602459a68598d3f4e2b44c524dc7f3d06..aa11cca74e7ff5d4b6558255b2596b9c47dc850d 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_controller_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_controller_configuration.sls
@@ -29,7 +29,6 @@ nginx:
             - server_name: __CLUSTER__.__DOMAIN__
             - listen:
               - 80 default
-            - include: snippets/letsencrypt_well_known.conf
             - location /:
               - return: '301 https://$host$request_uri'
 

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepproxy_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepproxy_configuration.sls
index 5d8b37e595a5a0d17d981c62b1bf1a5f68728f82..fac97f3c6c4cfb32a6b569eb9d4fd14669d6ef59 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepproxy_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepproxy_configuration.sls
@@ -24,7 +24,6 @@ nginx:
             - server_name: keep.__CLUSTER__.__DOMAIN__
             - listen:
               - 80
-            - include: snippets/letsencrypt_well_known.conf
             - location /:
               - return: '301 https://$host$request_uri'
 

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepweb_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepweb_configuration.sls
index fca42160766215c04663198ce1d1ed25bf32d5be..5a25ae899106bca90d4fa3e4fedf5a8eccea4170 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepweb_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_keepweb_configuration.sls
@@ -21,10 +21,9 @@ nginx:
         overwrite: true
         config:
           - server:
-            - server_name: '~^((.*--)?collections|download)\.__CLUSTER__\.__DOMAIN__'
+            - server_name: '~^((.*\.)?collections|download)\.__CLUSTER__\.__DOMAIN__'
             - listen:
               - 80
-            - include: snippets/letsencrypt_well_known.conf
             - location /:
               - return: '301 https://$host$request_uri'
 
@@ -36,7 +35,7 @@ nginx:
           cmd: create-initial-cert-collections.__CLUSTER__.__DOMAIN__-collections.__CLUSTER__.__DOMAIN__
         config:
           - server:
-            - server_name: '~^(.*--)?collections\.__CLUSTER__\.__DOMAIN__'
+            - server_name: '*.collections.__CLUSTER__.__DOMAIN__'
             - listen:
               - __CONTROLLER_EXT_SSL_PORT__ http2 ssl
             - index: index.html index.htm

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_webshell_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_webshell_configuration.sls
index 46f8ad0386aa00f96fc720db7ff2c3f2aa52da66..49c86dd313c22041f1b8001a13d13ddcbbeb3319 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_webshell_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_webshell_configuration.sls
@@ -25,7 +25,6 @@ nginx:
             - server_name: webshell.__CLUSTER__.__DOMAIN__
             - listen:
               - 80
-            - include: snippets/letsencrypt_well_known.conf
             - location /:
               - return: '301 https://$host$request_uri'
 

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_websocket_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_websocket_configuration.sls
index e89b780da64d122fa6c3f64d6a20f0c7f70f735d..c9671cd0c263625a7262677f27abe00bb95051a5 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_websocket_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_websocket_configuration.sls
@@ -24,7 +24,6 @@ nginx:
             - server_name: ws.__CLUSTER__.__DOMAIN__
             - listen:
               - 80
-            - include: snippets/letsencrypt_well_known.conf
             - location /:
               - return: '301 https://$host$request_uri'
 

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench2_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench2_configuration.sls
index a3e58e2e25dc040fe718ce61b69c0b503bc981a6..bd4123539e4192f323a802c57161084829a36e2c 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench2_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench2_configuration.sls
@@ -22,7 +22,6 @@ nginx:
             - server_name: workbench2.__CLUSTER__.__DOMAIN__
             - listen:
               - 80
-            - include: snippets/letsencrypt_well_known.conf
             - location /:
               - return: '301 https://$host$request_uri'
 

diff --git a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench_configuration.sls b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench_configuration.sls
index 38e59cc1ba1f4c274205a7d9b080e7238babe457..ec28b98c60da3930d3bb28db35e8c9dfd4fa44b5 100644 (file)
--- a/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench_configuration.sls
+++ b/tools/salt-install/config_examples/multi_host/aws/pillars/nginx_workbench_configuration.sls
@@ -31,7 +31,6 @@ nginx:
             - server_name: workbench.__CLUSTER__.__DOMAIN__
             - listen:
               - 80
-            - include: snippets/letsencrypt_well_known.conf
             - location /:
               - return: '301 https://$host$request_uri'