Infrastructure automation code for Kosmos servers
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 
 
 
Go to file
raucao 86d7514739
Merge pull request 'Upgrade bitcoind, NBXplorer, BTCPayServer' (#467) from chore/upgrade_btcpay into master
3 days ago
.chef Whitelist Chef attributes for newer client versions 4 months ago
clients Deploy second dirsrv supplier 2 months ago
cookbooks Set up fail2ban for nginx, move IPFS gateway to proxy role 2 months ago
data_bags Finish up Garage S3 config for kosmos.social 3 weeks ago
doc Add basic Garage doc 2 months ago
environments Set up libretranslate for kosmos.social 3 weeks ago
nodes Fix up lndhub hook config, converge all relevant nodes 2 weeks ago
roles Set up libretranslate for kosmos.social 3 weeks ago
scripts Merge pull request 'Add script for notifying Kosmos channels from Ruby' (#279) from feature/notify_xmpp_from_ruby into master 2 years ago
site-cookbooks Upgrade bitcoind, NBXplorer, BTCPayServer 3 days ago
.gitignore WIP RSK cookbook 2 years ago
.gitmodules Use our own fork of the postgresql cookbook 3 years ago
.ruby-version Use chef-workstation Ruby with rbenv 2 years ago
Berksfile Set up fail2ban for nginx, move IPFS gateway to proxy role 2 months ago
Berksfile.lock Set up fail2ban for nginx, move IPFS gateway to proxy role 2 months ago
Gemfile Upgrade knife-zero for Ruby 3.0 1 year ago
Gemfile.lock Upgrade knife-zero for Ruby 3.0 1 year ago
README.md Update README 1 month ago
Vagrantfile Finish multi-VM config 9 months ago

README.md

This repository contains all infrastructure automation code that we use to set up and configure servers, virtual machines, and applications for Kosmos hosted services.

Chef cookbooks are written in Ruby, and based on Chef Infra resources. Some cookbooks contain integration test suites based on Test Kitchen.

Note: Manual configuration of servers and applications is highly discouraged, and can be overwritten or lost without notice!

Setup

Install Chef Workstation

rbenv

If you use rbenv to manage Ruby versions on your system, install the rbenv-chef-workstation plugin.

Install gem dependencies

Clone this repository, cd into it, and run:

bundle install

Common tasks

Bootstrap a new host server

knife zero bootstrap root@server-name.kosmos.org --run-list "role[base],role[kvm_host]" --secret-file .chef/encrypted_data_bag_secret

Bootstrap a new VM

knife zero bootstrap ubuntu@zerotier-ip-address -x ubuntu --sudo --run-list "role[base],role[kvm_guest]" --secret-file .chef/encrypted_data_bag_secret

Run Chef Zero on a host server

knife zero converge -p2222 name:server-name.kosmos.org

Run Chef Zero on a VM

knife zero converge -a knife_zero.host name:vm-name-23

Update Chef Client on a server:

knife zero converge name:dev.kosmos.org --client-version 15.3.14

Managing cookbooks

Cookbooks are managed via Berkshelf. Run berks --help for command help.

Install cookbooks listed in Berksfile:

berks install

Vendor installed cookbooks to the cookbooks/ dir:

berks vendor cookbooks/ --delete

"Expired" TLS certificates

If you encounter expired TLS certificates during a Chef run (e.g. for remote files), the issue is likely that the certificate has been issued by Let's Encrypt and Chef is still using its own, outdated CA cert store (see here for example).

As a hotfix, you can manually remove the "DST Root CA X3" cert from /opt/chef/embedded/ssl/cert.pem on the machine you're trying to converge.