D4Science Infrastructure

We have a preliminary playbook that installs the tools and requests a certificate (with the machine hostname, if something different isn't specified).

Only the manual mode is supported right now.

We now have a script to request/renew the certificate, and a cron job that starts the renewal procedure if the certificate is going to expire in 7 days.

The last bits are specific scripts with the action to perform after a renewal (service restart for example. haproxy needs the certificate in one single file, so the script needs to do that too).

There are less intrusive clients, that possibly do not need to run as root. I'm going to try this one: https://github.com/hlandau/acme

I successfully tested a manual installation on redmine-d.d4science.org. Now trying via provisioning on ldap-liferay-d.d4science.org to try the listener mode, where the command directly listens on the http port.

Closing this one. letsencrypt is a viable solution, the related task is tracking the progress on the services configurations.