magic_recipes_two 0.0.59 → 0.0.60

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    ZWNmYWQ5NTk0NGIxZDJlMGI0YmM4Y2QzNTFkM2M5NGIxNzJiZDkxOQ==
+    ZWU1ZTk5ODlhNmNkZWE2NmU2ODg0NDg0MmE3YjA1YTVkNjI4ZWFmNg==
   data.tar.gz: !binary |-
-    ZGNkNTdiODYwNzI3ZTQxYzlmYWJkMzdiNTZlOGM2ZmJjNzUwMzExYQ==
+    MDA3ZjJiMmZmNDBhMzNjMTVmYjZiM2Y1MDg5NzQ1ODIwZTJkMmI5MQ==
 SHA512:
   metadata.gz: !binary |-
-    OWVkMTMzNDNmYzQ4ZmYwOWQ2ZGUyMmM5ZGYxZWU3OTJhZjllNDFkZDcwOTY4
-    M2VlMzlhMjJkYjYzZGVkZWZhMzBkOTQ0MDdjY2FmMjcwZWJlMzEzMmZjNzFk
-    OWVmMGUzYjI4ZDQwZThhNDA0YjI3NWMwMDllNTU1MmNlZjkzNDg=
+    MmU2NjQ5MmNkNWViYjY1MjhjZjRhNmY2MzYyYzBiNjM5OWNiYThlNDFkM2Vm
+    YWNmOGEwNzIyYTZmNzhkNjQzOTQwMTIwMzMzMmY5ZTRkNjM1ZTJmMTAyYTZj
+    N2ViZGVmZDU1Nzg1ZWI5ZDMyOTlmYmMwMjJlZGIyZmI3N2U1NjE=
   data.tar.gz: !binary |-
-    MmY3Nzc2MzEyYTI1MTdlM2VhNjk5MTBmM2E4MTA2MmE0MTA4ZGY1ZDlmYjgy
-    ZmExYzM0YzM4YWZkM2U1NjBkMzAzY2QzYjIyNDY0NjI0MWY4MjA4ZmY0M2E0
-    NDRmMjgyZjg2NzgzZjI2NDBjMGEyMzhlMjQ1NmYzNWExMjFmOGE=
+    NGU5YTgxODc5NGJkYjE0ZDRlM2ZlNTk1Y2RkNzUwOTcxYzZjMzE0NTUzOTI0
+    YjNmMWE3OTIyMjAzMzJmZGRmZjBiMjg4ZmMzODNhODI3MDNjMDY2N2I3ZTI4
+    NWM1MGJkOTJmMjViYjNmOTBkYzUzOTE3ZGY3MjljYzk2NGM0YWY=

data/lib/capistrano/magic_recipes/version.rb

@@ -1,5 +1,5 @@
 module Capistrano
   module MagicRecipes
-    VERSION = "0.0.59"
+    VERSION = "0.0.60"
   end
 end

data/lib/capistrano/tasks/lets_encrypt.rake

@@ -3,8 +3,12 @@
 
 namespace :load do
   task :defaults do
-    set :lets_encrypt_roles,    -> { :web }
-    set :lets_encrypt_path,     -> { "~" }
+    set :lets_encrypt_roles,        -> { :web }
+    set :lets_encrypt_path,         -> { "~" }
+    set :lets_encrypt_renew_minute, -> { "23" }
+    set :lets_encrypt_renew_hour1,  -> { "0" }
+    set :lets_encrypt_renew_hour2,  -> { "12" }
+    set :lets_encrypt_cron_log,     -> { "#{shared_path}/log/lets_encrypt_cron.log" }
   end
 end
 
@@ -13,8 +17,10 @@ namespace :lets_encrypt do
   desc "Install certbot LetsEncrypt"
   task :install do
     on release_roles fetch(:lets_encrypt_roles) do
-      execute "cd #{ fetch(:lets_encrypt_path) } ; wget https://dl.eff.org/certbot-auto"
-      execute "cd #{ fetch(:lets_encrypt_path) } ; chmod a+x certbot-auto"
+      within fetch(:lets_encrypt_path) do
+        execute "wget https://dl.eff.org/certbot-auto"
+        execute "chmod a+x certbot-auto"
+      end
     end
   end
   
@@ -32,15 +38,25 @@ namespace :lets_encrypt do
   ## http://serverfault.com/a/825032
   task :auto_renew do
     on release_roles fetch(:lets_encrypt_roles) do
-      execute :sudo, "echo '42 0,12 * * * root #{ fetch(:lets_encrypt_path) }/certbot-auto renew --quiet' | cat > /etc/cron.d/lets_encrypt"
+      # execute :sudo, "echo '42 0,12 * * * root (#{ fetch(:lets_encrypt_path) }/certbot-auto renew --quiet) >> #{shared_path}/lets_encrypt_cron.log 2>&1' | cat > #{ fetch(:lets_encrypt_path) }/lets_encrypt_cronjob"
+      execute :sudo, "echo '#{ fetch(:lets_encrypt_renew_minute) } #{ fetch(:lets_encrypt_renew_hour1) },#{ fetch(:lets_encrypt_renew_hour2) } * * * root #{ fetch(:lets_encrypt_path) }/certbot-auto renew --no-self-upgrade --post-hook \"#{fetch(:nginx_service_path)} restart\"  >> #{ fetch(:lets_encrypt_cron_log) } 2>&1' | cat > #{ fetch(:lets_encrypt_path) }/lets_encrypt_cronjob"
+      execute :sudo, "mv -f #{ fetch(:lets_encrypt_path) }/lets_encrypt_cronjob /etc/cron.d/lets_encrypt"
+      execute :sudo, "chown -f root:root /etc/cron.d/lets_encrypt"
+      execute :sudo, "chmod -f 0644 /etc/cron.d/lets_encrypt"
     end
   end
   
   
-  desc "Install certbot LetsEncrypt"
-  task :test_renew do
+  desc "Dry-Run Renew LetsEncrypt"
+  task :dry_renew do
     on release_roles fetch(:lets_encrypt_roles) do
-      execute :sudo, "#{ fetch(:lets_encrypt_path) }/certbot-auto renew --dry-run"
+      # execute :sudo, "#{ fetch(:lets_encrypt_path) }/certbot-auto renew --dry-run"
+      output = capture(:sudo, "#{ fetch(:lets_encrypt_path) }/certbot-auto renew --dry-run")
+      puts "#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#"
+      output.each_line do |line|
+          puts line
+      end
+      puts "#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#"
     end
   end
   
@@ -52,6 +68,18 @@ namespace :lets_encrypt do
     end
   end
   
+  desc "Check CRON logs in syslog"
+  task :check_cron_logs do
+    on release_roles fetch(:lets_encrypt_roles) do
+      # execute "grep CRON /var/log/syslog"
+      output = capture("grep CRON /var/log/syslog")
+      puts "#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#"
+      output.each_line do |line|
+          puts line
+      end
+      puts "#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#*#"
+    end
+  end
   
 end
 

data/lib/generators/capistrano/magic_recipes/templates/nginx.conf.erb

@@ -166,8 +166,8 @@ server {
   # from https://cipherli.st/
   # and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html
   ssl_protocols               TLSv1 TLSv1.1 TLSv1.2;
+  ssl_ciphers               'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
   ssl_prefer_server_ciphers   on;
-  ssl_ciphers                 "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
   ssl_ecdh_curve              secp384r1;
   ssl_session_cache           shared:SSL:10m;
   ssl_session_tickets         off;

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: magic_recipes_two
 version: !ruby/object:Gem::Version
-  version: 0.0.59
+  version: 0.0.60
 platform: ruby
 authors:
 - Torsten Wetzel
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-03-23 00:00:00.000000000 Z
+date: 2017-03-24 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails