update cert paths

Author: Anandkumar Patel

ansible/group_vars/alpha-navi-proxy.yml

@@ -1,12 +1,10 @@
 ---
 name: nginx
 
-docker_image: "{{ name }}"
-docker_image_version: "1.10"
+container_image: "{{ name }}"
+container_tag: "1.10"
 
-docker_restart_command: kill -s SIGHUP
-
-docker_container_run_opts: >
+container_run_opts: >
   -d
   -h {{ name }}
   -p 0.0.0.0:443:443
@@ -15,5 +13,4 @@ docker_container_run_opts: >
   -v /etc/nginx/sites-available/:/etc/nginx/sites-enabled/:ro
   -v /etc/nginx/ssl/dhparam.pem:/etc/nginx/ssl/dhparam.pem:ro
   -v /etc/ssl/certs/{{ user_content_domain }}:/etc/ssl/certs/{{ user_content_domain }}:ro
-  -v /etc/ssl/private:/etc/ssl/private:ro
   -v /var/log/nginx:/var/log/nginx

ansible/navi-proxy.yml

@@ -5,5 +5,7 @@
   roles:
     - role: datadog
       has_dd_integration: yes
+
     - role: content-domain-certs
-    - role: container_restart
+
+    - role: container_kill_start

ansible/roles/content-domain-certs/tasks/main.yml

@@ -3,19 +3,29 @@
   tags: [ certs ]
   become: true
   file:
-    dest: /opt/ssl/{{ user_content_domain }}
+    dest: /etc/ssl/certs/{{ user_content_domain }}
     state: directory
 
 - name: put certs in place
   tags: [ certs ]
   become: true
   copy:
     src: "{{ user_content_domain }}/{{ item }}"
-    dest: /opt/ssl/{{ user_content_domain }}/{{ item }}
+    dest: /etc/ssl/certs/{{ user_content_domain }}/{{ item }}
     mode: 0400
     owner: root
     group: root
   with_items:
   - ca.pem
   - key.pem
   - cert.pem
+
+- name: create chained cert
+  tags: [ certs ]
+  become: true
+  shell: >
+    cat
+    /etc/ssl/certs/{{ user_content_domain }}/cert.pem
+    /etc/ssl/certs/{{ user_content_domain }}/ca.pem
+    >
+    /etc/ssl/certs/{{ user_content_domain }}/chained.pem

ansible/roles/nginx-proxied-service/templates/01-navi.conf

@@ -35,8 +35,8 @@ server {
   access_log /var/log/nginx/{{ name }}.ssl.access.log;
 
   ssl on;
-  ssl_certificate /etc/ssl/certs/{{ user_content_domain }}/{{ user_content_domain }}.chained.crt;
-  ssl_certificate_key /etc/ssl/private/{{ user_content_domain }}.key;
+  ssl_certificate /etc/ssl/certs/{{ user_content_domain }}/chained.pem;
+  ssl_certificate_key /etc/ssl/certs/{{ user_content_domain }}/key.pem;
   ssl_trusted_certificate /etc/ssl/certs/{{ user_content_domain }}/ca.pem;
 
   ssl_session_cache shared:SSL:10m;