From d7274d50db65942198220e1c3074fd96076e6f08 Mon Sep 17 00:00:00 2001
From: "Antonio J. Delgado" <ad@susurrando.com>
Date: Wed, 29 Nov 2023 16:56:16 +0200
Subject: [PATCH] Add let's encrypt module

---
 manifests/init.pp | 18 ++++++++++++------
 metadata.json     |  4 ++++
 2 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/manifests/init.pp b/manifests/init.pp
index b2ea4ca..0dea326 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -54,6 +54,9 @@
 # [*users*]
 #   List of hashes with users information.
 #
+# [*cert_admin_mail*]
+#   Email to provide to Let's Encrypt in exchange for SSL certificates
+#
 class mastodon (
   String $ensure = 'present',
   String $hostname = 'mastodon.example.org',
@@ -94,6 +97,7 @@ class mastodon (
     'SESSION_RETENTION_PERIOD' => 31556952,
   },
   Array $users = [],
+  String $cert_admin_mail = 'cert-admin@example.org',
 ) {
   case $ensure {
     default: {
@@ -118,7 +122,6 @@ class mastodon (
     'bison',
     'build-essential',
     'ca-certificates',
-    'certbot',
     'ffmpeg',
     'file',
     'g++',
@@ -144,7 +147,6 @@ class mastodon (
     'pkg-config',
     # 'postgresql-contrib',
     'protobuf-compiler',
-    'python3-certbot-apache',
     # 'redis-tools',
     'wget',
     'zlib1g-dev',
@@ -324,10 +326,14 @@ class mastodon (
     timeout     => 0,
     require     => File["${mastodon_home}/live/.env.production"],
   }
-  exec { "register-${hostname}-letsencrypt":
-    command => "/etc/init.d/apache2 stop && /usr/bin/certbot certonly --agree-tos --email certs@susurrando.com -d ${hostname} -n --standalone && /etc/init.d/apache2 start",
-    creates => "/etc/letsencrypt/live/${hostname}/privkey.pem",
-    require => Package['python3-certbot-apache'],
+  class { 'letsencrypt':
+    email             => $cert_admin_mail,
+    renew_cron_ensure => 'present',
+  }
+  letsencrypt::certonly { $hostname:
+    domains            => [$hostname],
+    pre_hook_commands  => ['systemctl stop apache2'],
+    post_hook_commands => ['systemctl start apache2'],
   }
   apache::vhost { $hostname:
     ensure                => $ensure,
diff --git a/metadata.json b/metadata.json
index 1c8deec..3d9cde3 100644
--- a/metadata.json
+++ b/metadata.json
@@ -29,6 +29,10 @@
     {
       "name": "puppet-systemd", 
       "version_requirement": "4.0.1"
+    },
+    {
+      "name": "puppet-letsencrypt",
+      "version_requirement": "10.1.0"
     }
   ],
   "operatingsystem_support": [