Rework letsencrypt

This patch is adding "API layer" to letsencrypt
images which is represented by set of scripts inside.

This scripts are called by kolla-ansible orchestration.

Change-Id: I61b70fb4e12ba03b96e79004e735d2ead0f52319

2 files changed, 83 insertions, 0 deletions

diff --git a/docker/letsencrypt/letsencrypt-base/Dockerfile.j2 b/docker/letsencrypt/letsencrypt-base/Dockerfile.j2
new file mode 100644
index 000000000..022ff2bfa
--- /dev/null
+++ b/docker/letsencrypt/letsencrypt-base/Dockerfile.j2
@@ -0,0 +1,14 @@
+FROM {{ namespace }}/{{ image_prefix }}base:{{ tag }}
+{% block labels %}
+LABEL maintainer="{{ maintainer }}" name="{{ image_name }}" build-date="{{ build_date }}"
+{% endblock %}
+
+{% block letsencrypt_base_header %}{% endblock %}
+
+{% import "macros.j2" as macros with context %}
+
+{{ macros.install_packages(cinder_base_packages | customizable("packages")) }}
+
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+
+{% block letsencrypt_base_footer %}{% endblock %}
diff --git a/docker/letsencrypt/letsencrypt-base/extend_start.sh b/docker/letsencrypt/letsencrypt-base/extend_start.sh
new file mode 100644
index 000000000..0300f0b44
--- /dev/null
+++ b/docker/letsencrypt/letsencrypt-base/extend_start.sh
@@ -0,0 +1,69 @@
+#!/bin/bash
+
+# Logs
+
+if [[ ! -d "/var/log/kolla/letsencrypt" ]]; then
+    mkdir -p /var/log/kolla/letsencrypt
+fi
+if [[ $(stat -c %a /var/log/kolla/letsencrypt) != "755" ]]; then
+    chmod 755 /var/log/kolla/letsencrypt
+fi
+
+# Structure for lego and webserver
+
+FOLDERS_LEGO="/etc/letsencrypt /etc/letsencrypt/lego /etc/letsencrypt/lego/internal /etc/letsencrypt/lego/external"
+FOLDERS_WEBSERVER="/etc/letsencrypt/http-01 /etc/letsencrypt/http-01/.well-known /etc/letsencrypt/http-01/.well-known/acme-challenge"
+
+if [[ "${KOLLA_BASE_DISTRO}" =~ debian|ubuntu ]]; then
+    USER="www-data"
+    GROUP="www-data"
+    USERGROUP_WEBSERVER="${USER}:${GROUP}"
+    USERGROUP="haproxy:haproxy"
+else
+    USER="apache"
+    GROUP="apache"
+    USERGROUP_WEBSERVER="${USER}:${GROUP}"
+    USERGROUP="haproxy:haproxy"
+fi
+
+for folder in ${FOLDERS_LEGO}; do
+    if [[ ! -d "${folder}" ]]; then
+        mkdir -p ${folder}
+    fi
+
+    if [[ $(stat -c %U:%G ${folder}) != "${USERGROUP}" ]]; then
+        if getent passwd ${USER} 2 > /dev/null; then
+            chown ${USERGROUP} ${folder}
+        fi
+    fi
+
+    if [[ "${folder}" == "/etc/letsencrypt" ]]; then
+        if [[ $(stat -c %a ${folder}) != "751" ]]; then
+            chmod 751 ${folder}
+        fi
+    else
+        if [[ $(stat -c %a ${folder}) != "755" ]]; then
+            chmod 755 ${folder}
+        fi
+    fi
+done
+
+for folder in ${FOLDERS_WEBSERVER}; do
+    if [[ ! -d "${folder}" ]]; then
+        mkdir -p ${folder}
+    fi
+
+    if [[ $(stat -c %U:%G ${folder}) != "${USERGROUP_WEBSERVER}" ]]; then
+        if getent passwd ${USER} 2 > /dev/null; then
+            chown ${USERGROUP_WEBSERVER} ${folder}
+        fi
+    fi
+
+    if [[ $(stat -c %a ${folder}) != "755" ]]; then
+        chmod 755 ${folder}
+    fi
+done
+
+if [ -e /usr/local/bin/kolla_letsencrypt_extend_start ]; then
+    . /usr/local/bin/kolla_letsencrypt_extend_start
+fi