magic_recipes_two 0.0.57 → 0.0.58

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    MDI1MmI5YWQ3OTAxNmM0NmI4NTZhNGI4MWVkOTBmNzZiYTYwYjVmOQ==
+    ODhiNWIwYzJiODAwOGUyYmRlOTgzZGExZmE2ZWVhYzc0YWM4Y2Q0YQ==
   data.tar.gz: !binary |-
-    NTBmMDFkZjE3Y2M0YWRhMTE5Zjg2ZjViY2UwMWRkMDA2ZDI3NWRmZQ==
+    MTU4MjY5MzBjZDNiMWI3NzUxOTc5Zjg3MWJmOTZhMzdmZTc0ZjM4Ng==
 SHA512:
   metadata.gz: !binary |-
-    NGEyNDdhZjg1OGJhNTU0YzJhZjg2YzZmZWRhOTQyMDgzNGIzYWMzZmNhZjBh
-    MzFmZDI4NTk5ZjY4YmE0YTRmNWI4ZjcwNDE0YTE0MGJiOWRhYmU1ZWZmYWU0
-    MGE1N2IyNTJiYzQ4ZGIyNmJmNzUxZmM0NDhmZGQwZTNjZmVjMmY=
+    YWNmNmM3ZTZhOGUyMDU4YmQzNmZjNzlmYWY4YjEwMjQyZjY3NDhlM2VkNGZm
+    ZWVkYmZmOTg5NzY4NmM0MWM5MWIxMmQ5Mjk2ZjM0ZmUxZDgzNmU1ZTRlZTE5
+    OTY0NjBlZTkyODcwM2EwOTk1N2IwNzQ3ZWRjMjExOWZiYWJkN2U=
   data.tar.gz: !binary |-
-    ZWRhYzk3MTY4Nzc5ZGNlYTg3NGRjNTJiMzA3OGUxM2FjYzJiOTYzYjg0ODg2
-    MzBmN2EwYzRkNGRiNDI0NjNmYzg5Yjk0YzQyZmRhOWRmOTEzMzc5MjdiNzg5
-    ZDY0YjRiMGY5OWUzNjY5NTMxZTE1ZjY0YTJjZTg3MTEwZjg0M2U=
+    NjNjNzY1NmFjMjAxMzM0ZWVkMDg1NzkzNWNjZTRmMmM5ODU2NjM5MzY1Y2M1
+    YzU5ZmMyODk5M2FkOGQ0MzAwZWU3MjdlZGY2MTlhOTQzZmMzZWJlYTllMWQw
+    NWJmN2Y0ZDhkNTdmN2Q0MDU1ZTg4YTBhYWE0OWE3NDQyYTY1NjY=

data/lib/capistrano/magic_recipes/lets_encrypt.rb

@@ -0,0 +1 @@
+load File.expand_path("../../tasks/lets_encrypt.rake", __FILE__)

data/lib/capistrano/magic_recipes/version.rb

@@ -1,5 +1,5 @@
 module Capistrano
   module MagicRecipes
-    VERSION = "0.0.57"
+    VERSION = "0.0.58"
   end
 end

data/lib/capistrano/tasks/lets_encrypt.rake

@@ -0,0 +1,59 @@
+# require 'capistrano/magic_recipes/base_helpers'
+# include Capistrano::MagicRecipes::BaseHelpers
+
+namespace :load do
+  task :defaults do
+    set :lets_encrypt_roles,    -> { :web }
+    set :lets_encrypt_path,     -> { "~" }
+  end
+end
+
+namespace :lets_encrypt do
+  
+  desc "Install certbot LetsEncrypt"
+  task :install do
+    on release_roles fetch(:lets_encrypt_roles) do
+      execute "cd #{ fetch(:lets_encrypt_path) } ; wget https://dl.eff.org/certbot-auto"
+      execute "cd #{ fetch(:lets_encrypt_path) } ; chmod a+x certbot-auto"
+    end
+  end
+  
+  
+  desc "Install certbot LetsEncrypt"
+  task :certonly do
+    on release_roles fetch(:lets_encrypt_roles) do
+      # execute "./certbot-auto certonly --webroot -w /var/www/example -d example.com -d www.example.com -w /var/www/thing -d thing.is -d m.thing.is"
+      execute "#{ fetch(:lets_encrypt_path) }/certbot-auto certonly --webroot -w #{current_path}/public#{ fetch(:nginx_major_domain, false) ? " -d #{fetch(:nginx_major_domain).to_s.gsub(/^\*?\./, "")} -d www.#{fetch(:nginx_major_domain).to_s.gsub(/^\*?\./, "")}" : ""} #{ Array(fetch(:nginx_domains)).map{ |d| "-d #{d.gsub(/^\*?\./, "")} -d www.#{d.gsub(/^\*?\./, "")}" }.join(" ") }"
+    end
+  end
+  
+  
+  desc "Install certbot LetsEncrypt"
+  ## http://serverfault.com/a/825032
+  task :auto_renew do
+    on release_roles fetch(:lets_encrypt_roles) do
+      execute "echo '42 0,12 * * * root #{ fetch(:lets_encrypt_path) }/certbot-auto renew --quiet' | cat > /etc/cron.d/lets_encrypt"
+    end
+  end
+  
+  
+  desc "Install certbot LetsEncrypt"
+  task :test_renew do
+    on release_roles fetch(:lets_encrypt_roles) do
+      execute "#{ fetch(:lets_encrypt_path) }/certbot-auto renew --dry-run"
+    end
+  end
+  
+  
+  desc "Generate Strong Diffie-Hellman Group"
+  task :generate_dhparam do
+    on release_roles fetch(:lets_encrypt_roles) do
+      execute :sudo, "openssl dhparam -out #{ fetch(:nginx_ssl_dh_path) }/#{ fetch(:nginx_ssl_dh_file) } 2048"
+    end
+  end
+  
+  
+end
+
+
+

data/lib/capistrano/tasks/nginx.rake

@@ -27,6 +27,10 @@ namespace :load do
     set :nginx_hooks,                 -> { true }
     ## Lets Encrypt - Challenge Path
     set :allow_well_known,            -> { false }
+    # Diffie-Hellman settings
+    set :nginx_ssl_dh_path,           -> { "/etc/ssl/certs" }
+    set :nginx_ssl_dh_file,           -> { "dhparam.pem" }
+    set :nginx_ssl_diffie_hellman,    -> { false }
     ## NginX Proxy-Caching
     # Cache Rails
     set :proxy_cache_rails,           -> { false }

data/lib/generators/capistrano/magic_recipes/templates/nginx.conf.erb

@@ -156,12 +156,36 @@ server {
 
 server {
 <% if fetch(:nginx_use_ssl) %>
-  listen                443<%= ' default_server ssl' if fetch(:default_site) %>;
+  listen                443 ssl http2<%= ' default_server' if fetch(:default_site) %>;
+  listen                [::]:443 ssl http2<%= ' default_server' if fetch(:default_site) %>;
   ssl                   on;
   ssl_certificate       <%= fetch(:nginx_ssl_certificate_path) %>/<%= fetch(:nginx_ssl_certificate) %>;
   ssl_certificate_key   <%= fetch(:nginx_ssl_certificate_key_path) %>/<%= fetch(:nginx_ssl_certificate_key) %>;
+  <% if fetch(:nginx_ssl_diffie_hellman, false) %>
+  # https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04
+  # from https://cipherli.st/
+  # and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
+  ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
+  ssl_prefer_server_ciphers   on;
+  ssl_ciphers                 "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
+  ssl_ecdh_curve              secp384r1;
+  ssl_session_cache           shared:SSL:10m;
+  ssl_session_tickets         off;
+  ssl_stapling                on;
+  ssl_stapling_verify         on;
+  resolver                    8.8.8.8 8.8.4.4 valid=300s;
+  resolver_timeout            5s;
+  ## Disable preloading HSTS for now.  You can use the commented out header line that includes
+  ## the "preload" directive if you understand the implications.
+  # => add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
+  add_header                  Strict-Transport-Security "max-age=63072000; includeSubdomains";
+  add_header                  X-Frame-Options DENY;
+  add_header                  X-Content-Type-Options nosniff;
+  ssl_dhparam                 <%= fetch(:nginx_ssl_dh_path) %>/<%= fetch(:nginx_ssl_dh_file) %>;
+  <% end %>
 <% else %>
   listen                80<%= ' default deferred' if fetch(:default_site) %>;
+  listen                [::]:80<%= ' default deferred' if fetch(:default_site) %>;
 <% end %>
   <% if fetch(:nginx_major_domain) %>
   server_name           <%= ".#{fetch(:nginx_major_domain).gsub(/^\*?\./, "")}" %>;

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: magic_recipes_two
 version: !ruby/object:Gem::Version
-  version: 0.0.57
+  version: 0.0.58
 platform: ruby
 authors:
 - Torsten Wetzel
@@ -137,6 +137,7 @@ files:
 - lib/capistrano/magic_recipes/db.rb
 - lib/capistrano/magic_recipes/exception_pages.rb
 - lib/capistrano/magic_recipes/inform_slack.rb
+- lib/capistrano/magic_recipes/lets_encrypt.rb
 - lib/capistrano/magic_recipes/monit.rb
 - lib/capistrano/magic_recipes/nginx.rb
 - lib/capistrano/magic_recipes/redis.rb
@@ -148,6 +149,7 @@ files:
 - lib/capistrano/tasks/db.rake
 - lib/capistrano/tasks/exception_pages.rake
 - lib/capistrano/tasks/inform_slack.rake
+- lib/capistrano/tasks/lets_encrypt.rake
 - lib/capistrano/tasks/monit.rake
 - lib/capistrano/tasks/monit_sidekiq.rake
 - lib/capistrano/tasks/nginx.rake