wip

REFERENCE.md

@@ -70,19 +70,19 @@ The path to the letsencrypt installation.
 
 Default value: '/opt/letsencrypt'
 
-##### `venv_path`
+##### `environment`
 
-Data type: `Any`
+Data type: `Array`
 
-virtualenv path for vcs-installed Certbot
+An optional array of environment variables.
 
-Default value: '/opt/letsencrypt/.venv'
+Default value: []
 
-##### `environment`
+##### `vcs_dependencies`
 
 Data type: `Array`
 
-An optional array of environment variables (in addition to VENV_PATH)
+An array of packages on which the VCS installation method depends.
 
 Default value: []
 
@@ -100,7 +100,7 @@ Data type: `String`
 
 The Git ref (tag, sha, branch) to check out when installing the client with the `vcs` method.
 
-Default value: 'v0.39.0'
+Default value: 'v1.7.0'
 
 ##### `package_name`
 
@@ -381,6 +381,14 @@ Name of package to use when installing the client with the `package` method.
 
 Default value: $letsencrypt::package_name
 
+##### `vcs_dependencies`
+
+Data type: `Array`
+
+An array of packages on which the VCS installation method depends.
+
+Default value: []
+
 ### letsencrypt::plugin::dns_rfc2136
 
 This class installs and configures the Let's Encrypt dns-rfc2136 plugin.
@@ -613,7 +621,7 @@ Default value: []
 
 Data type: `Array[String[1]]`
 
-An optional array of environment variables (in addition to VENV_PATH).
+An optional array of environment variables.
 
 Default value: []
 

data/Debian-family.yaml

@@ -0,0 +1,5 @@
+---
+letsencrypt::vcs_dependencies:
+  - 'git'
+  - 'python3'
+  - 'python3-venv'

data/RedHat-family.yaml

@@ -2,3 +2,7 @@
 letsencrypt::configure_epel: true
 letsencrypt::plugin::dns_rfc2136::package_name: 'python2-certbot-dns-rfc2136'
 letsencrypt::plugin::dns_route53::package_name: 'python2-certbot-dns-route53'
+letsencrypt::vcs_dependencies:
+  - 'git'
+  - 'python3'
+  - 'python3-virtualenv'

manifests/certonly.pp

@@ -17,7 +17,7 @@
 #   element will be used for all subsequent domains.
 # @param letsencrypt_command Command to run letsencrypt
 # @param additional_args An array of additional command line arguments to pass to the `letsencrypt-auto` command.
-# @param environment  An optional array of environment variables (in addition to VENV_PATH).
+# @param environment  An optional array of environment variables.
 # @param key_size Size for the RSA public key
 # @param manage_cron
 #   Indicating whether or not to schedule cron job for renewal.
@@ -157,7 +157,6 @@
   ]).filter | $arg | { $arg =~ NotUndef and $arg != [] }
   $command = join($_command, ' ')
 
-  $execution_environment = ["VENV_PATH=${letsencrypt::venv_path}",] + $environment
   $verify_domains = join(unique($domains), '\' \'')
 
   if $ensure == 'present' {
@@ -170,7 +169,7 @@
     command     => $command,
     *           => $exec_ensure,
     path        => $facts['path'],
-    environment => $execution_environment,
+    environment => $environment,
     provider    => 'shell',
     require     => [
       Class['letsencrypt'],

manifests/init.pp

@@ -14,8 +14,7 @@
 #   The email address to use to register with Let's Encrypt. This takes
 #   precedence over an 'email' setting defined in $config.
 # @param path The path to the letsencrypt installation.
-# @param venv_path virtualenv path for vcs-installed Certbot
-# @param environment An optional array of environment variables (in addition to VENV_PATH)
+# @param environment An optional array of environment variables.
 # @param repo A Git URL to install the Let's encrypt client from.
 # @param version The Git ref (tag, sha, branch) to check out when installing the client with the `vcs` method.
 # @param package_name Name of package and command to use when installing the client with the `package` method.
@@ -28,6 +27,7 @@
 # @param manage_config A feature flag to toggle the management of the letsencrypt configuration file.
 # @param manage_install A feature flag to toggle the management of the letsencrypt client installation.
 # @param manage_dependencies A feature flag to toggle the management of the letsencrypt dependencies.
+# @param vcs_dependencies Array of packages to install before executing vcs installation.
 # @param configure_epel A feature flag to include the 'epel' class and depend on it for package installation.
 # @param install_method Method to install the letsencrypt client, either package or vcs.
 # @param agree_tos A flag to agree to the Let's Encrypt Terms of Service.
@@ -60,10 +60,9 @@
   Boolean $configure_epel,
   Optional[String] $email                = undef,
   String $path                           = '/opt/letsencrypt',
-  $venv_path                             = '/opt/letsencrypt/.venv',
   Array $environment                     = [],
   String $repo                           = 'https://github.com/certbot/certbot.git',
-  String $version                        = 'v0.39.0',
+  String $version                        = 'v1.7.0',
   String $package_name                   = 'certbot',
   $package_ensure                        = 'installed',
   String $package_command                = 'certbot',
@@ -75,6 +74,7 @@
   Boolean $manage_config                 = true,
   Boolean $manage_install                = true,
   Boolean $manage_dependencies           = true,
+  Array[String[1]] $vcs_dependencies     = [],
   Enum['package', 'vcs'] $install_method = 'package',
   Boolean $agree_tos                     = true,
   Boolean $unsafe_registration           = false,
@@ -91,33 +91,36 @@
 ) {
   if $manage_install {
     contain letsencrypt::install # lint:ignore:relative_classname_inclusion
-    Class['letsencrypt::install'] ~> Exec['initialize letsencrypt']
     Class['letsencrypt::install'] -> Class['letsencrypt::renew']
-  }
 
-  $command = $install_method ? {
-    'package' => $package_command,
-    'vcs'     => "${venv_path}/bin/letsencrypt",
+    if $install_method == 'vcs' {
+      Class['letsencrypt::install'] ~> Exec['initialize letsencrypt']
+    }
   }
 
-  $command_init = $install_method ? {
+  $command = $install_method ? {
     'package' => $package_command,
-    'vcs'     => "${path}/letsencrypt-auto",
+    'vcs'     => "${path}/venv3/bin/certbot",
   }
 
   if $manage_config {
     contain letsencrypt::config # lint:ignore:relative_classname_inclusion
-    Class['letsencrypt::config'] -> Exec['initialize letsencrypt']
+
+    if $install_method == 'vcs' {
+      Class['letsencrypt::config'] -> Exec['initialize letsencrypt']
+    }
   }
 
   contain letsencrypt::renew
 
-  # TODO: do we need this command when installing from package?
-  exec { 'initialize letsencrypt':
-    command     => "${command_init} -h",
-    path        => $facts['path'],
-    environment => concat(["VENV_PATH=${venv_path}"], $environment),
-    refreshonly => true,
+  if $install_method == 'vcs' {
+    exec { 'initialize letsencrypt':
+      command     => 'python3 tools/venv3.py',
+      cwd         => $path,
+      path        => $facts['path'],
+      environment => $environment,
+      refreshonly => true,
+    }
   }
 
   # Used in letsencrypt::certonly Exec["letsencrypt certonly ${title}"]

manifests/install.pp

@@ -7,6 +7,7 @@
 # @param path The path to the letsencrypt installation.
 # @param repo A Git URL to install the Let's encrypt client from.
 # @param version The Git ref (tag, sha, branch) to check out when installing the client with the `vcs` method.
+# @param vcs_dependencies Array of packages to install before executing vcs installation.
 # @param package_ensure The value passed to `ensure` when installing the client with the `package` method.
 # @param package_name Name of package to use when installing the client with the `package` method.
 #
@@ -20,12 +21,12 @@
   String $path                           = $letsencrypt::path,
   String $repo                           = $letsencrypt::repo,
   String $version                        = $letsencrypt::version,
+  Array[String[1]] $vcs_dependencies     = $letsencrypt::vcs_dependencies,
 ) {
   if $install_method == 'vcs' {
     if $manage_dependencies {
-      $dependencies = ['python', 'git']
-      ensure_packages($dependencies)
-      Package[$dependencies] -> Vcsrepo[$path]
+      ensure_packages($vcs_dependencies)
+      Package[$vcs_dependencies] -> Vcsrepo[$path]
     }
 
     vcsrepo { $path:

spec/acceptance/letsencrypt_spec.rb

@@ -55,7 +55,7 @@ class { 'letsencrypt' :
       its(:content) { is_expected.to match %r{email = letsregister@example.com} }
     end
 
-    describe file('/opt/letsencrypt/.venv/bin/certbot') do
+    describe file('/opt/letsencrypt/venv3/bin/certbot') do
       it { is_expected.to be_file }
       it { is_expected.to be_owned_by 'root' }
       it { is_expected.to be_grouped_into 'root' }

spec/classes/letsencrypt_install_spec.rb

@@ -11,8 +11,9 @@
         manage_dependencies: true,
         path: '/opt/letsencrypt',
         repo: 'https://github.com/certbot/certbot.git',
-        version: 'v0.30.2',
-        package_name: 'letsencrypt'
+        version: 'v1.7.0',
+        package_name: 'letsencrypt',
+        vcs_dependencies: vcs_dependencies,
       }
     end
     let(:additional_params) { {} }
@@ -21,6 +22,14 @@
       let :facts do
         facts
       end
+      let(:vcs_dependencies) do
+        case facts[:osfamily]
+        when 'Debian'
+          ['git', 'python3', 'python3-venv']
+        when 'RedHat', 'OpenBSD', 'FreeBSD'
+          ['git', 'python3', 'python3-virtualenv']
+        end
+      end
 
       describe 'with install_method => package' do
         let(:additional_params) { { install_method: 'package' } }
@@ -29,8 +38,9 @@
 
         it 'contains the correct resources' do
           is_expected.not_to contain_vcsrepo('/opt/letsencrypt')
-          is_expected.not_to contain_package('python')
-          is_expected.not_to contain_package('git')
+          vcs_dependencies.each do |package|
+            is_expected.not_to contain_package(package)
+          end
 
           is_expected.to contain_package('letsencrypt').with_ensure('installed')
         end
@@ -64,9 +74,10 @@
 
         it 'contains the correct resources' do
           is_expected.to contain_vcsrepo('/opt/letsencrypt').with(source: 'https://github.com/certbot/certbot.git',
-                                                                  revision: 'v0.30.2')
-          is_expected.to contain_package('python')
-          is_expected.to contain_package('git')
+                                                                  revision: 'v1.7.0')
+          vcs_dependencies.each do |package|
+            is_expected.to contain_package(package)
+          end
 
           is_expected.not_to contain_package('letsencrypt')
         end
@@ -93,8 +104,9 @@
           let(:additional_params) { { install_method: 'vcs', manage_dependencies: false } }
 
           it 'does not contain the dependencies' do
-            is_expected.not_to contain_package('git')
-            is_expected.not_to contain_package('python')
+            vcs_dependencies.each do |package|
+              is_expected.not_to contain_package(package)
+            end
           end
         end
       end

spec/classes/letsencrypt_spec.rb

@@ -32,11 +32,9 @@
                    manage_install: true,
                    manage_dependencies: true,
                    repo: 'https://github.com/certbot/certbot.git',
-                   version: 'v0.39.0').
-              that_notifies('Exec[initialize letsencrypt]').
+                   version: 'v1.7.0').
               that_comes_before('Class[letsencrypt::renew]')
-            is_expected.to contain_exec('initialize letsencrypt')
-            is_expected.to contain_class('letsencrypt::config').that_comes_before('Exec[initialize letsencrypt]')
+            is_expected.to contain_class('letsencrypt::config')
             is_expected.to contain_class('letsencrypt::renew').
               with(pre_hook_commands: [],
                    post_hook_commands: [],
@@ -92,7 +90,11 @@
               is_expected.to contain_package('letsencrypt').with(name: 'py27-certbot')
               is_expected.to contain_file('/usr/local/etc/letsencrypt').with(ensure: 'directory')
             else
-              is_expected.to contain_class('letsencrypt::install').with(install_method: 'vcs')
+              is_expected.to contain_class('letsencrypt::install').with(install_method: 'vcs').
+                that_notifies('Exec[initialize letsencrypt]').
+                that_comes_before('Class[letsencrypt::renew]')
+              is_expected.to contain_exec('initialize letsencrypt')
+              is_expected.to contain_class('letsencrypt::config').that_comes_before('Exec[initialize letsencrypt]')
               is_expected.to contain_file('/etc/letsencrypt').with(ensure: 'directory')
             end
           end
@@ -102,13 +104,13 @@
           let(:additional_params) { { path: '/usr/lib/letsencrypt', install_method: 'vcs' } }
 
           it { is_expected.to contain_class('letsencrypt::install').with_path('/usr/lib/letsencrypt') }
-          it { is_expected.to contain_exec('initialize letsencrypt').with_command('/usr/lib/letsencrypt/letsencrypt-auto -h') }
+          it { is_expected.to contain_exec('initialize letsencrypt').with_command('python3 tools/venv3.py') }
         end
 
         describe 'with custom environment variables' do
-          let(:additional_params) { { environment: ['FOO=bar', 'FIZZ=buzz'] } }
+          let(:additional_params) { { install_method: 'vcs', environment: ['FOO=bar', 'FIZZ=buzz'] } }
 
-          it { is_expected.to contain_exec('initialize letsencrypt').with_environment(['VENV_PATH=/opt/letsencrypt/.venv', 'FOO=bar', 'FIZZ=buzz']) }
+          it { is_expected.to contain_exec('initialize letsencrypt').with_environment(['FOO=bar', 'FIZZ=buzz']) }
         end
 
         describe 'with custom repo' do
@@ -162,14 +164,13 @@
           let(:additional_params) { { install_method: 'package', package_command: 'letsencrypt' } }
 
           it { is_expected.to contain_class('letsencrypt::install').with_install_method('package') }
-          it { is_expected.to contain_exec('initialize letsencrypt').with_command('letsencrypt -h') }
         end
 
         describe 'with install_method => vcs' do
           let(:additional_params) { { install_method: 'vcs' } }
 
           it { is_expected.to contain_class('letsencrypt::install').with_install_method('vcs') }
-          it { is_expected.to contain_exec('initialize letsencrypt').with_command('/opt/letsencrypt/letsencrypt-auto -h') }
+          it { is_expected.to contain_exec('initialize letsencrypt').with_command('python3 tools/venv3.py') }
         end
 
         describe 'with custom config directory' do