terrafying-components 1.13.6 → 1.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 46403f4974ddbcadf18a638bf1158233231a0aac1f9f7949c2c7dfc321f7498d
-  data.tar.gz: 623d3e5b6d4e61a5630b3f84483110fab7e93400bef7b3e425250618318bb390
+  metadata.gz: 027ba420f40c64ea39dabaa69b9f6b63feaafd7e43b7cb016e735aeb4a46fb5b
+  data.tar.gz: dbbc8f0bb1a659c33a3a47b39dabda6a512d4b83288a6c0d2559c127eca6304c
 SHA512:
-  metadata.gz: e8da71a9c4d253c5ee45458f972ee45ca612a9cf3c71b4ca5f52efd369b764796a7f584f47665901e3b83c8eba39a7cc1856df541c95767ff0d2223ff822432e
-  data.tar.gz: ffcde3793996efb7ddd1bd3d18b4cb2cf184329fba989e2e53e22c84c8933386cfc5db612bd71483fbf19af211bff8f7cfaa8445549fca69dd3488d080a6a482
+  metadata.gz: 302656e4916d511bde944f6ebf9c240c16dd815bebf4a8486699825522a869611292fff9b885de6cd32f0c4dbcd095ffb49ffe3440d18508d284b9cd6fe074c8
+  data.tar.gz: 86d7be5a5a00bf6a60ac90cdd878c1696efd3e1b58ad6f03f1a7934e7a1c7b503b864df9b5feed50aacb4e84f77844e1cf035c3d108868f7fa6c4b850fce383c

data/lib/terrafying/components/letsencrypt.rb

@@ -16,6 +16,9 @@ module Terrafying
       def self.find(name, bucket, options = {})
         LetsEncrypt.new.find name, bucket, options
       end
+      def self.renew(name, bucket, options = {})
+      LetsEncrypt.new.renew name, bucket, options
+      end
 
       def initialize
         super
@@ -25,10 +28,12 @@ module Terrafying
       def setup_providers
         {
           staging: {
+            url: 'https://acme-staging-v02.api.letsencrypt.org/directory',
             ref: provider(:acme, alias: :staging, server_url: 'https://acme-staging-v02.api.letsencrypt.org/directory'),
             ca_cert: 'https://letsencrypt.org/certs/fakeleintermediatex1.pem'
           },
           live: {
+            url: 'https://acme-v02.api.letsencrypt.org/directory',
             ref: provider(:acme, alias: :live, server_url: 'https://acme-v02.api.letsencrypt.org/directory'),
             ca_cert: 'https://letsencrypt.org/certs/lets-encrypt-x3-cross-signed.pem.txt'
           }
@@ -54,8 +59,8 @@ module Terrafying
         provider :tls, {}
 
         resource :tls_private_key, "#{@name}-account",
-                 algorithm: 'ECDSA',
-                 ecdsa_curve: options[:curve]
+                  algorithm: "ECDSA",
+                  ecdsa_curve: options[:curve]
 
         resource :acme_registration, "#{@name}-reg",
                  provider: @acme_provider[:ref],
@@ -69,6 +74,16 @@ module Terrafying
                  key: File.join('', @prefix, @name, 'account.key'),
                  content: @account_key
 
+        resource :aws_s3_bucket_object, "#{@name}-config", {
+          bucket: @bucket,
+          key: File.join('', @prefix, @name, "config.json"),
+          content: {
+            id: output_of(:acme_registration, "#{@name}-reg", "id"),
+            url: @acme_provider[:url],
+            email_address: options[:email_address],
+          }.to_json,
+        }
+
         @ca_cert_acl = options[:public_certificate] ? 'public-read' : 'private'
 
         open(@acme_provider[:ca_cert], 'rb') do |cert|
@@ -126,17 +141,10 @@ module Terrafying
       def create_keypair_in(ctx, name, options = {})
         options = {
           common_name: name,
-          organization: 'uSwitch Limited',
-          validity_in_hours: 24 * 365,
-          allowed_uses: %w[
-            nonRepudiation
-            digitalSignature
-            keyEncipherment
-          ],
+          organization: "uSwitch Limited",
           dns_names: [],
           ip_addresses: [],
-          min_days_remaining: 21,
-          curve: 'P384'
+          curve: "P384",
         }.merge(options)
 
         key_ident = "#{@name}-#{tf_safe(name)}"
@@ -161,7 +169,7 @@ module Terrafying
         ctx.resource :acme_certificate, key_ident, {
                      provider: @acme_provider[:ref],
                      account_key_pem: @account_key,
-                     min_days_remaining: options[:min_days_remaining],
+                     min_days_remaining: 21,
                      dns_challenge: {
                        provider: 'route53'
                      },
@@ -169,27 +177,88 @@ module Terrafying
                    }.merge(cert_options)
 
         key_version = "${sha256(tls_private_key.#{key_ident}.private_key_pem)}"
+
         ctx.resource :aws_s3_bucket_object, "#{key_ident}-key",
                      bucket: @bucket,
                      key: object_key(name, :key, key_version),
                      content: output_of(:tls_private_key, key_ident, :private_key_pem)
+
         ctx.resource :aws_s3_bucket_object, "#{key_ident}-key-latest",
                      bucket: @bucket,
                      key: object_key(name, :key, 'latest'),
                      content: key_version
 
-        cert_version = "${sha256(acme_certificate.#{key_ident}.certificate_pem)}"
-        ctx.resource :aws_s3_bucket_object, "#{key_ident}-cert",
-                     bucket: @bucket,
-                     key: object_key(name, :cert, cert_version),
-                     content: output_of(:acme_certificate, key_ident, :certificate_pem).to_s + @ca_cert
-        ctx.resource :aws_s3_bucket_object, "#{key_ident}-cert-latest",
-                     bucket: @bucket,
-                     key: object_key(name, :cert, 'latest'),
-                     content: cert_version
+       cert_version = "${sha256(acme_certificate.#{key_ident}.certificate_pem)}"
+
+       ctx.resource :aws_s3_bucket_object, "#{key_ident}-cert",
+                    bucket: @bucket,
+                    key: object_key(name, :cert, cert_version),
+                    content: output_of(:acme_certificate, key_ident, :certificate_pem).to_s + @ca_cert,
+                    lifecycle: { ignore_changes: [ "content" ] } # the lambda will be updating it
+
+       ctx.resource :aws_s3_bucket_object, "#{key_ident}-cert-latest",
+                    bucket: @bucket,
+                    key: object_key(name, :cert, 'latest'),
+                    content: cert_version
 
-        reference_keypair(ctx, name, key_version: key_version, cert_version: cert_version)
+       reference_keypair(ctx, name, key_version: key_version, cert_version: cert_version)
       end
+
+      def renew(name, bucket, options={})
+        options = {
+          prefix: "",
+          provider: :staging,
+        }.merge(options)
+
+        @name = name
+        @bucket = bucket
+        @prefix = options[:prefix]
+
+        resource :aws_lambda_function, "#{@name}_lambda", {
+          function_name: "#{@name}_lambda",
+          s3_bucket: "uswitch-certbot-lambda",
+          s3_key: "certbot-lambda.zip",
+          handler: "main.handler",
+          runtime: "python3.7",
+          role: "${aws_iam_role.#{@name}_lambda_execution.arn}",
+          environment:{
+            variables: {
+              CA_BUCKET: @bucket,
+              CA_PREFIX: @prefix,
+            }
+          }
+        }
+        # Lambda execution role
+        resource :aws_iam_role, "#{@name}_lambda_execution", {
+          name: "#{@name}_lambda_execution",
+          assume_role_policy: JSON.pretty_generate(
+                {
+                  Version: "2012-10-17",
+                  Statement: [
+                    {
+                      Action: "sts:AssumeRole",
+                      Principal: {
+                        Service: "lambda.amazonaws.com"
+                        },
+                      Effect: "Allow",
+                      Sid: ""
+                    },
+                    {
+                      Action: [
+                        "s3:Put*",
+                        "s3:Get*",
+                        "s3:DeleteObject"
+                        ],
+                      Resource: ["arn:aws:s3:::#{@bucket}/#{@prefix}"],
+                      Effect: "Allow"
+                    }
+                  ]
+                }
+              )
+            }
+          self
+        end
+
     end
   end
 end

data/lib/terrafying/components/version.rb

@@ -2,6 +2,6 @@
 
 module Terrafying
   module Components
-    VERSION = '1.13.6'
+    VERSION = '1.14.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: terrafying-components
 version: !ruby/object:Gem::Version
-  version: 1.13.6
+  version: 1.14.0
 platform: ruby
 authors:
 - uSwitch Limited
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-11-01 00:00:00.000000000 Z
+date: 2019-12-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake