certbot.yml

# https://medium.com/@jameshamann/ssl-certificates-with-rails-aws-elastic-beanstalk-and-lets-encrypt-8b047d527a60
# See article above for explanation - essentially this automatically requests an SSL cert from LetsEncrypt and auto-renews
# Specific to a single-instance EB deployment - differnt for Elastic Load Balanced EB environments

Resources:
  sslSecurityGroupIngress:
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: { "Fn::GetAtt": ["AWSEBSecurityGroup", "GroupId"] }
      IpProtocol: tcp
      ToPort: 443
      FromPort: 443
      CidrIp: 0.0.0.0/0
files:
  /etc/nginx/conf.d/https_custom.pre:
    mode: "000644"
    owner: root
    group: root
    content: |
      server {
        listen      443;
        server_name localhost;
        ssl_certificate      /etc/letsencrypt/live/ebcert/fullchain.pem;
        ssl_certificate_key  /etc/letsencrypt/live/ebcert/privkey.pem;
        ssl                  on;
        ssl_session_timeout  5m;
        ssl_protocols  TLSv1.1 TLSv1.2;
        ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
        ssl_prefer_server_ciphers   on;
        if ($ssl_protocol = "") {
          rewrite ^ https://$host$request_uri? permanent;
        }
        location / {
                proxy_pass  http://my_app;
                proxy_set_header        Host            $host;
                proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header        X-Forwarded-Proto https;
                }
        location /assets {
                alias /var/app/current/public/assets;
                gzip_static on;
                gzip on;
                expires max;
                add_header Cache-Control public;
                }
        location /public {
                alias /var/app/current/public;
                gzip_static on;
                gzip on;
                expires max;
                add_header Cache-Control public;
                }
      }
packages:
  yum:
    epel-release: []
container_commands:
  10_installcertbot:
    command: "wget https://dl.eff.org/certbot-auto;chmod a+x certbot-auto"
  20_getcert:
    command: 'sudo ./certbot-auto certonly --debug --non-interactive --email ${ADMIN_EMAIL} --agree-tos --standalone --domains ${CERTDOMAIN} --keep-until-expiring --pre-hook "service nginx stop"'
  30_link:
    command: "ln -sf /etc/letsencrypt/live/${CERTDOMAIN} /etc/letsencrypt/live/ebcert"
  40_config:
    command: "mv /etc/nginx/conf.d/https_custom.pre /etc/nginx/conf.d/https_custom.conf"