#
# Cookbook:: irrigate-vault
# Recipe:: tls
#
# Copyright:: 2023, All Rights Reserved.

if node['vault']['tls']['domains'].empty?
  raise("The attribute node['vault']['tls']['domains'] must be set to a non-empty list to use the irrigate-vault::tls recipe")
end

execute 'amazon-linux-extras install epel -y' do
  creates '/etc/yum.repos.d/epel.repo'
end

packages = %w(
  certbot
  certbot-dns-route53
)

packages.each do |package_name|
  package package_name
end

# Configure credentials for the letsencrypt route53 plugin to automatically perform DNS validation
directory '/root/.aws' do
  action :create
  owner 'root'
  group 'root'
  mode '700'
end

credentials = data_bag_item('secrets', node['vault']['tls']['dns_validation_credentials_data_bag_name'])

template '/root/.aws/credentials' do
  source 'aws_credentials.erb'
  owner 'root'
  group 'root'
  mode '600'
  variables(
    access_key: credentials['access_key'],
    secret_key: credentials['secret_key']
  )
  sensitive true
end

# Configure deploy hook to deploy the credentials and reload Vault service
deploy_script = '/etc/letsencrypt/deploy-cert.sh'

template deploy_script do
  source 'letsencrypt_deploy_hook.sh.erb'
  owner 'root'
  group 'root'
  mode '700'
  variables(
    domain: node['vault']['tls']['domains'][0],
    cert_file: node['vault']['server']['config']['listener']['tls_cert_file'],
    key_file: node['vault']['server']['config']['listener']['tls_key_file']
  )
end

# Perform initial certificate generation
execute 'generate_certificate' do
  command "certbot certonly --dns-route53 -d #{node['vault']['tls']['domains'].join(',')} -m #{node['vault']['tls']['notifications_email']} -n --agree-tos --deploy-hook #{deploy_script}"
  creates "/etc/letsencrypt/live/#{node['vault']['tls']['domains'][0]}/fullchain.pem"
end

# Set up cron to automatically renew certificate
cron 'renew_certificate' do
  minute node['vault']['tls']['renew_cron']['minute']
  hour node['vault']['tls']['renew_cron']['hour']
  weekday node['vault']['tls']['renew_cron']['weekday']
  path '/bin:/sbin:/usr/bin:/usr/sbin'
  shell '/bin/bash'
  command "certbot renew --deploy-hook #{deploy_script}"
end