Allow to update Mumble server certificates
ClosedPublic
Actions

Authored by dereckson on Nov 3 2016, 02:01.

Details

Reviewers

Theaptos
Sandlayth

Maniphest Tasks

T853: Deploy a Let's encrypt certificate to the Mumble server

Commits

rOPSc356aa59ba95: Allow to update Mumble server certificates

Summary

The Mumble server certificate is managed by Let's encrypt.
It's renewed on Ysul and deployed to nginx folder.

We then need to copy new certificates to Mumble jail
and restart the Murmur server.

This code takes care of this copy/restart operation.
A follow-up change should amend Let's encrypt configuration
to call this script automatically when the certificate is renewed.

Ref. T853.

Test Plan

Tested on Ysul to deploy the current certificate.

Copy, permissions and restart works fine.

Diff Detail

Repository

rOPS Nasqueron Operations

Lint

No Lint Coverage

Unit

No Test Coverage

Branch

murmur

Build Status

Buildable 1051
Build 1266: arc lint + arc unit

Event Timeline

dereckson updated this revision to Diff 1736.Nov 3 2016, 02:01

dereckson retitled this revision from to Allow to update Mumble server certificates.

dereckson updated this object.

dereckson edited the test plan for this revision. (Show Details)

dereckson added reviewers: Theaptos, Sandlayth.

dereckson added a subscriber: fauve.

dereckson added inline comments.Nov 3 2016, 02:03

roles/mumble/certificates/files/update-mumble-certificates
15	Is there a compact way to write these blocks in pure sh?

dereckson added inline comments.Nov 3 2016, 02:05

roles/mumble/certificates/init.sls
12	At first, I wondered if /usr/local/sbin would be more appropriated. Then, I've seen there existed some attempts to call jexec as non root user. http://web.archive.org/web/20070630041040/http://people.collaborativefusion.com/~wmoran/code/jailme.html