Update to latest master version

.rubocop.yml

@@ -1,34 +1,6 @@
 AllCops:
-  Include:
-    - Berksfile
-    - '**/Gemfile'
-    - Rakefile
-    - Thorfile
-    - Guardfile
-  Exclude:
-    - vendor/**
-
-ClassLength:
-  Enabled: false
-Documentation:
-  Enabled: false
-Encoding:
-  Enabled: false
-HashSyntax:
-  Enabled: false
-LineLength:
-  Enabled: false
-MethodLength:
-  Enabled: false
-SignalException:
-  Enabled: false
-TrailingCommaInArrayLiteral:
-  Enabled: false
-WordArray:
-  Enabled: false
-ClassAndModuleChildren:
-  Enabled: false
-AbcSize:
-  Enabled: false
-SpaceBeforeFirstArg:
-  Enabled: false
+  TargetChefVersion: 17.latest
+Chef/Modernize/FoodcriticComments:
+  Enabled: true
+Chef/Style/CopyrightCommentFormat:
+  Enabled: true

.travis.yml

@@ -14,7 +14,8 @@ cache:
 
 env:
   global:
-    - KITCHEN_LOCAL_YAML=.kitchen.dokken.yml
+    - KITCHEN_LOCAL_YAML=kitchen.dokken.yml
+    - CHEF_LICENSE="accept-no-persist"
   matrix:
     - CMD="chef exec cookstyle --display-cop-names --extra-details"
     - CMD="chef exec foodcritic ."

CHANGELOG.md

@@ -3,6 +3,59 @@ ACME Cookbook Changelog
 
 This file is used to list changes made in each version of the acme cookbook.
 
+Unreleased
+----------
+- seansith - Upgrade acme-client gem to v2.0.15
+
+4.1.6
+----------
+- ramereth - Allow `Integer` for `owner` and `group` properties
+- bugoff - Add processing as a valid authz status
+- thoutenbos - Update Test Kitchen
+- thoutenbos - Upgrade acme-client gem to v2.0.13
+
+4.1.5
+----------
+- twk3 - make private key file location configurable
+- thoutenbos - Upgrade acme-client gem to v2.0.9
+
+4.1.4
+----------
+- detjensrobert - Chef 17 Compatibility
+  - Enable `unified_mode` for all resources
+  - Cookstyle fixes
+  - Update test infra to use InSpec instead of legacy ServerSpec
+  - Update test cookbook to use latest cookbooks / resources
+  - Use standard location for Kitchen files according to [upstream](https://kitchen.ci/docs/getting-started/kitchen-yml/)
+  - Update `acme_client` gem to Ruby 3-compliant version
+
+4.1.3
+-----
+- essjayhch - Improve authz failure logging
+- redream - Typo fix
+- schrd - Add DNS validation support
+
+4.1.2
+-----
+- zedtux - upgrade acme-client version to 2.0.6
+
+4.1.1
+-----
+- petracvv - lazy evaluation in resource attributes
+
+4.1.0
+-----
+- hrak - Ease version constraints on supported platforms
+- zakame - Rename `endpoint` attribute to `dir`
+- zakame - Remove `chain` and `fullchain` properties
+- zakame - Switch to `pebble` for integration testing
+- zakame - Implement ACME v2 support
+- Dawnflash - Clean up token files after use
+- bby-bishopclark - Various trivial English fixes in README
+- rmoriz - bump acme-client gem to 2.0.3
+- SeanSith - Marked fullchain as a deprecated_property_alias
+- zakame - Fixes for the Travis and kitchen tests
+
 4.0.0
 -----
 The TLS-SNI-01 validation method has been removed as it is no longer supported by Let's Encrypt.

README.md

@@ -14,14 +14,15 @@ Starting with v4.0.0 of the acme cookbook the acme_ssl_certificate provider has
 Attributes
 ----------
 
-| Attribute      | Description                                                                                                                                                                    | Default                                          |
-| -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------       | --------------------------------------:          |
-| contact        | Contact information, default empty. Set to `mailto:[email protected]`                                                                                                             | []                                               |
-| dir            | ACME server endpoint, Set to `https://acme-staging-v02.api.letsencrypt.org/directory` if you want to use the Let's Encrypt staging environment and corresponding certificates. | `https://acme-v02.api.letsencrypt.org/directory` |
-| renew          | Days before the certificate expires at which the certificate will be renewed                                                                                                   | 30                                               |
-| source_ips     | IP addresses used by Let's Encrypt to verify the TLS certificates, it will change over time. This attribute is for firewall purposes. Allow these IPs for HTTP (tcp/80).       | ['66.133.109.36']                                |
-| private_key    | Private key content of registered account. Private keys identify the ACME client with the endpoint and are not transferable between staging and production endpoints.          | nil                                              |
-| key_size       | Default private key size used when resource property is not. Must be one out of: 2048, 3072, 4096.                                                                             | 2048                                             |
+| Attribute        | Description                                                                                                                                                                    | Default                                          |
+| ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------       | --------------------------------------:          |
+| contact          | Contact information, default empty. Set to `mailto:[email protected]`                                                                                                             | []                                               |
+| dir              | ACME server endpoint, Set to `https://acme-staging-v02.api.letsencrypt.org/directory` if you want to use the Let's Encrypt staging environment and corresponding certificates. | `https://acme-v02.api.letsencrypt.org/directory` |
+| renew            | Days before the certificate expires at which the certificate will be renewed                                                                                                   | 30                                               |
+| source_ips       | IP addresses used by Let's Encrypt to verify the TLS certificates, it will change over time. This attribute is for firewall purposes. Allow these IPs for HTTP (tcp/80).       | ['66.133.109.36']                                |
+| private_key      | Private key content of registered account. Private keys identify the ACME client with the endpoint and are not transferable between staging and production endpoints.          | nil                                              |
+| private_key_file | Filename where private key will be saved. If this file exists, the contents take precedence over the value set in `private_key`.                                               | `/etc/acme/account_private_key.pem`              |
+| key_size         | Default private key size used when resource property is not. Must be one out of: 2048, 3072, 4096.                                                                             | 2048                                             |
 
 
 Recipes
@@ -57,32 +58,32 @@ A working example can be found in the included `acme_client` test cookbook.
 Providers
 ---------
 ### certificate
-| Property            | Type    | Default  | Description                                            |
-|  ---                |  ---    |  ---     |  ---                                                   |
-| `cn`                | string  | _name_   | The common name for the certificate                    |
-| `alt_names`         | array   | []       | The common name for the certificate                    |
-| `crt`               | string  | nil      | File path to place the certificate                     |
-| `key`               | string  | nil      | File path to place the private key                     |
-| `key_size`          | integer | 2048     | Private key size. Must be one out of: 2048, 3072, 4096 |
-| `owner`             | string  | root     | Owner of the created files                             |
-| `group`             | string  | root     | Group of the created files                             |
-| `wwwroot`           | string  | /var/www | Path to the wwwroot of the domain                      |
-| `ignore_failure`    | boolean | false    | Whether to continue chef run if issuance fails         |
-| `retries`           | integer | 0        | Number of times to catch exceptions and retry          |
-| `retry_delay`       | integer | 2        | Number of seconds to wait between retries              |
-| `endpoint`          | string  | nil      | The Let's Encrypt endpoint to use                      |
-| `contact`           | array   | []       | The contact to use                                     |
+| Property            | Type           | Default  | Description                                            |
+|  ---                |  ---           |  ---     |  ---                                                   |
+| `cn`                | string         | _name_   | The common name for the certificate                    |
+| `alt_names`         | array          | []       | The common name for the certificate                    |
+| `crt`               | string         | nil      | File path to place the certificate                     |
+| `key`               | string         | nil      | File path to place the private key                     |
+| `key_size`          | integer        | 2048     | Private key size. Must be one out of: 2048, 3072, 4096 |
+| `owner`             | string,integer | root     | Owner of the created files                             |
+| `group`             | string,integer | root     | Group of the created files                             |
+| `wwwroot`           | string         | /var/www | Path to the wwwroot of the domain                      |
+| `ignore_failure`    | boolean        | false    | Whether to continue chef run if issuance fails         |
+| `retries`           | integer        | 0        | Number of times to catch exceptions and retry          |
+| `retry_delay`       | integer        | 2        | Number of seconds to wait between retries              |
+| `endpoint`          | string         | nil      | The Let's Encrypt endpoint to use                      |
+| `contact`           | array          | []       | The contact to use                                     |
 
 ### selfsigned
-| Property         | Type    | Default  | Description                                            |
-|  ---             |  ---    |  ---     |  ---                                                   |
-| `cn`             | string  | _name_   | The common name for the certificate                    |
-| `crt`            | string  | nil      | File path to place the certificate                     |
-| `key`            | string  | nil      | File path to place the private key                     |
-| `key_size`       | integer | 2048     | Private key size. Must be one out of: 2048, 3072, 4096 |
-| `chain`          | string  | nil      | File path to place the certificate chain               |
-| `owner`          | string  | root     | Owner of the created files                             |
-| `group`          | string  | root     | Group of the created files                             |
+| Property         | Type           | Default  | Description                                            |
+|  ---             |  ---           |  ---     |  ---                                                   |
+| `cn`             | string         | _name_   | The common name for the certificate                    |
+| `crt`            | string         | nil      | File path to place the certificate                     |
+| `key`            | string         | nil      | File path to place the private key                     |
+| `key_size`       | integer        | 2048     | Private key size. Must be one out of: 2048, 3072, 4096 |
+| `chain`          | string         | nil      | File path to place the certificate chain               |
+| `owner`          | string,integer | root     | Owner of the created files                             |
+| `group`          | string,integer | root     | Group of the created files                             |
 
 Example
 -------
@@ -122,6 +123,59 @@ acme_certificate "#{site}" do
 end
 ```
 
+DNS verification
+----------------
+
+Letsencrypt supports DNS validation. Depending on the setup there may be different ways to deploy an acme challenge to your infrastructure. If you want to use DSN validation, you have to provide two block arguments to the `acme_certificate` resource.
+
+Implement 2 methods in a library in your cookbook, each returning a `Proc` object. The following example uses a HTTP API to provide challenges to the DNS infrastructure.
+
+```ruby
+# my_cookbook/libraries/acme_dns.rb
+
+class Chef
+  class Recipe
+    def install_dns_challenge(apitoken)
+      Proc.new do |authorization, new_resource|
+        # use DNS authorization
+        authz = authorization.dns
+        fqdn = authorization.identifier['value']
+        r = Net::HTTP.post(URI("https://my_awesome_dns_api/#{fqdn}"), authz.record_content, {'Authorization' => "Token #{apitoken}"})
+        if r.code != '200'
+          fail "DNS API does not want to install Challenge for #{fqdn}"
+        else
+          # do some validation that the challenge has propagated to the infrastructure
+        end
+        # it is important that the authz and fqdn is passed back, so it can be passed to the remove_dns_challenge method
+        [authz, fqdn]
+      end
+    end
+    def remove_dns_challenge(apitoken)
+      Proc.new do |authz, fqdn|
+        uri = URI("https://my_awesome_dns_api/#{fqdn}")
+        Net::HTTP.start(uri.hostname, uri.port, use_ssl: uri.scheme=='https') do |http|
+          http.delete(uri, {'Authorization' => "Token #{apitoken}"})
+        end
+      end
+    end
+  end
+end
+```
+
+Use it in your recipe the following way:
+
+```ruby
+apitoken = chef_vault_item(vault, item)['dns_api_token']
+acme_certificate node['fqdn'] do
+  key '/path/to/key'
+  crt '/path/to/crt'
+  install_authz_block install_dns_challenge(apitoken)
+  remove_authz_block remove_dns_challenge(apitoken)
+end
+```
+
+
+
 Testing
 -------
 The kitchen includes a `pebble` server to run the integration tests with, so testing can run locally without interaction with the online APIs.

attributes/default.rb

@@ -3,7 +3,7 @@
 # Cookbook:: acme
 # Attribute:: default
 #
-# Copyright 2015-2018 Schuberg Philis
+# Copyright:: 2015-2021, Schuberg Philis
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -24,5 +24,6 @@
 default['acme']['source_ips']  = %w(66.133.109.36 64.78.149.164)
 
 default['acme']['private_key'] = nil
-default['acme']['gem_version'] = '2.0.1'
+default['acme']['private_key_file'] = '/etc/acme/account_private_key.pem'
+default['acme']['gem_version'] = '2.0.15'
 default['acme']['key_size']    = 2048