Switch from letsencrypt to certbot about deploy HOT 6 CLOSED

To find Ubuntu 16 servers, see https://ocdsdeploy.readthedocs.io/en/latest/how-to/maintain.html#upgrade-ubuntu

from deploy.

For now, we can actually use grains, so that when the Ubuntu 16 servers go, we can just delete one side of an if-else-statement.

from deploy.

Switched to mod_md in 73b12a7 Very clean now!

from deploy.

To deploy to servers, need to:

• cron.absent: identifier: letsencrypt-renew
• ./run.py '*' cmd.run 'ls -AR /var/www/html/.well-known'
• ./run.py '*' pkg.remove letsencrypt
• ./run.py '*' file.remove /var/www/html/.well-known

from deploy.

For existing servers, also had to do

# Run pkgrepo.managed
./run.py -L 'cove-oc4ids,cove-ocds,docs,kingfisher-process,prometheus,redash,toucan' state.sls_id apache2 apache
# Re-install apache2
./run.py -L 'cove-oc4ids,cove-ocds,docs,kingfisher-process,prometheus,redash,toucan' pkg.install apache2 refresh=True

then deploy.

Update: There were errors in /var/log/apache2/error.log:

AH01882: Init: this version of mod_ssl was compiled against a newer library (OpenSSL 1.1.1g 21 Apr 2020, version currently loaded is OpenSSL 1.1.1 11 Sep 2018) - may result in undefined or erroneous behavior

I tried:

# `openssl version` reports 1.1.1g
./run.py -L 'cove-oc4ids,cove-ocds,docs,kingfisher-process,prometheus,redash,toucan' pkg.install openssl refresh=True
# This was the trick!
./run.py -L 'cove-oc4ids,cove-ocds,docs,kingfisher-process,prometheus,redash,toucan' pkg.install libssl1.1 refresh=True
# Not sure if this was necessary.
./run.py -L 'cove-oc4ids,cove-ocds,docs,kingfisher-process,prometheus,redash,toucan' pkg.install apache2 reinstall=True
# To see if message persists.
./run.py -L 'cove-oc4ids,cove-ocds,docs,kingfisher-process,prometheus,redash,toucan' service.restart apache2

from deploy.

Also, HTTP doesn't seem to be redirecting to HTTPS.

Update: Apparently, MDRequireHttps requires a virtual host on port 80.

from deploy.