kosmos-hubot: declare bot firewall rules at the recipe top level

The per-bot firewall_rule declared inside the kosmos_hubot_bot custom
resource was not collected by the ufw provider when it rebuilt the rules
file, so the bots' HTTP ports were never opened. Declare the rules in the
default recipe instead, matching the pattern used by the other cookbooks,
and drop the now-unused firewall property from the resource.

site-cookbooks/kosmos-hubot/recipes/default.rb

@@ -9,6 +9,21 @@ include_recipe 'kosmos-base::firewall'
 include_recipe 'kosmos-hubot::_user'
 include_recipe 'kosmos-hubot::_nodejs'
 
+# Expose each bot's HTTP port (webhooks, health) to the proxy network. Declared
+# at recipe top level so the ufw provider collects them when it rebuilds the
+# firewall rules file.
+node['kosmos-hubot']['bots'].each do |app_name, config|
+  firewall = config['firewall'] || {}
+  next if firewall.empty?
+
+  firewall_rule "hubot_#{app_name}" do
+    port     firewall['port']
+    source   firewall['source']
+    protocol firewall.fetch('protocol', :tcp)
+    command  :allow
+  end
+end
+
 # A local Redis provides the brain store for the bots. It is only reachable from
 # the node itself, and the bots connect without auth.
 node.override['kosmos_redis']['requirepass'] = false
@@ -27,7 +42,6 @@ node['kosmos-hubot']['bots'].each do |app_name, config|
     robot_name       bot['robot_name']
     http_port        bot['http_port']
     redis            bot['redis'] || false
-    firewall         bot['firewall'] || {}
     external_scripts bot['external_scripts'] || []
     env              bot['env'] || {}
     secret_env       bot['secret_env'] || {}

site-cookbooks/kosmos-hubot/resources/bot.rb

@@ -19,7 +19,6 @@ property :external_scripts, Array, default: []
 property :env, Hash, default: {}
 property :secret_env, Hash, default: {}
 property :redis, [true, false], default: false
-property :firewall, Hash, default: {}
 property :extra_files, Array, default: []
 
 default_action :create
@@ -44,6 +43,12 @@ action :create do
     service_env[env_key] = secrets[bag_key]
   end
 
+  directory app_path do
+    owner app_user
+    group app_group
+    mode  '0755'
+  end
+
   git app_path do
     user       app_user
     group      app_group
@@ -53,6 +58,7 @@ action :create do
   end
 
   execute "npm install (#{app_name})" do
+    command 'npm install'
     cwd app_path
     user app_user
     group app_group
@@ -119,13 +125,4 @@ action :create do
     triggers_reload true
     action [:create, :enable, :start]
   end
-
-  if new_resource.firewall && !new_resource.firewall.empty?
-    firewall_rule app_name do
-      port     new_resource.firewall['port']
-      source   new_resource.firewall['source']
-      protocol new_resource.firewall.fetch('protocol', :tcp)
-      command  :allow
-    end
-  end
 end