Infrastructure configs and automation for Kosmos servers
Go to file
Râu Cao 6e4cc48068
Upgrade Gitea to 1.21.5
2024-02-05 14:39:12 +02:00
.chef Use the new way of setting attribute whitelists 2023-07-17 18:06:23 +02:00
clients Add new garage nodes 2024-01-11 18:38:22 +03:00
cookbooks Set up SpamAssassin 2023-12-06 12:22:24 +01:00
data_bags Add S3/Garage config for akkounts 2024-01-26 10:40:36 +03:00
doc Add basic Garage doc 2022-11-25 10:56:22 +00:00
environments Merge pull request 'Add Liquor Cabinet cookbooks and configs, deploy to production' (#541) from feature/535-liquor_cabinet into master 2024-02-04 13:47:05 +00:00
nodes Update node info 2024-02-05 10:14:27 +02:00
roles Merge pull request 'Add Liquor Cabinet cookbooks and configs, deploy to production' (#541) from feature/535-liquor_cabinet into master 2024-02-04 13:47:05 +00:00
scripts Improve script for switching postgres primary 2023-07-21 14:55:43 +02:00
site-cookbooks Upgrade Gitea to 1.21.5 2024-02-05 14:39:12 +02:00
.gitignore WIP RSK cookbook 2021-06-13 16:58:53 +02:00
.gitmodules Add openresty cookbook fork as a submodule 2023-07-05 15:50:46 +02:00
.ruby-version Use chef-workstation Ruby with rbenv 2021-05-28 14:40:02 +02:00
Berksfile Set up SpamAssassin 2023-12-06 12:22:24 +01:00
Berksfile.lock Set up SpamAssassin 2023-12-06 12:22:24 +01:00
Gemfile Upgrade knife-zero for Ruby 3.0 2022-02-02 17:31:13 -06:00
Gemfile.lock Add new architecture to Gemfile.lock 2023-07-17 18:09:55 +02:00
README.md Update README 2023-01-05 17:14:46 +08:00
Vagrantfile Add openresty Vagrant box 2023-07-15 17:20:06 +02:00

README.md

This repository contains all infrastructure automation code that we use to set up and configure servers, virtual machines, and applications for Kosmos hosted services.

Chef cookbooks are written in Ruby, and based on Chef Infra resources. Some cookbooks contain integration test suites based on Test Kitchen.

Note: Manual configuration of servers and applications is highly discouraged, and can be overwritten or lost without notice!

Setup

Install Chef Workstation

rbenv

If you use rbenv to manage Ruby versions on your system, install the rbenv-chef-workstation plugin.

Install gem dependencies

Clone this repository, cd into it, and run:

bundle install

Common tasks

Bootstrap a new host server

knife zero bootstrap root@server-name.kosmos.org --run-list "role[base],role[kvm_host]" --secret-file .chef/encrypted_data_bag_secret

Bootstrap a new VM

knife zero bootstrap ubuntu@zerotier-ip-address -x ubuntu --sudo --run-list "role[base],role[kvm_guest]" --secret-file .chef/encrypted_data_bag_secret

Run Chef Zero on a host server

knife zero converge -p2222 name:server-name.kosmos.org

Run Chef Zero on a VM

knife zero converge -a knife_zero.host name:vm-name-23

Update Chef Client on a server:

knife zero converge name:dev.kosmos.org --client-version 15.3.14

Managing cookbooks

Cookbooks are managed via Berkshelf. Run berks --help for command help.

Install cookbooks listed in Berksfile:

berks install

Vendor installed cookbooks to the cookbooks/ dir:

berks vendor cookbooks/ --delete

"Expired" TLS certificates

If you encounter expired TLS certificates during a Chef run (e.g. for remote files), the issue is likely that the certificate has been issued by Let's Encrypt and Chef is still using its own, outdated CA cert store (see here for example).

As a hotfix, you can manually remove the "DST Root CA X3" cert from /opt/chef/embedded/ssl/cert.pem on the machine you're trying to converge.