From 086b31a387350c70e364f2e73ca9a7c017cb87a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A2u=20Cao?= <raucao@kosmos.org>
Date: Wed, 28 Oct 2026 17:07:03 +0400
Subject: [PATCH] kosmos-hubot: declare bot firewall rules at the recipe top
 level

The per-bot firewall_rule declared inside the kosmos_hubot_bot custom
resource was not collected by the ufw provider when it rebuilt the rules
file, so the bots' HTTP ports were never opened. Declare the rules in the
default recipe instead, matching the pattern used by the other cookbooks,
and drop the now-unused firewall property from the resource.
---
 site-cookbooks/kosmos-hubot/recipes/default.rb | 16 +++++++++++++++-
 site-cookbooks/kosmos-hubot/resources/bot.rb   | 17 +++++++----------
 2 files changed, 22 insertions(+), 11 deletions(-)

diff --git a/site-cookbooks/kosmos-hubot/recipes/default.rb b/site-cookbooks/kosmos-hubot/recipes/default.rb
index afc986f..1562c91 100644
--- a/site-cookbooks/kosmos-hubot/recipes/default.rb
+++ b/site-cookbooks/kosmos-hubot/recipes/default.rb
@@ -9,6 +9,21 @@ include_recipe 'kosmos-base::firewall'
 include_recipe 'kosmos-hubot::_user'
 include_recipe 'kosmos-hubot::_nodejs'
 
+# Expose each bot's HTTP port (webhooks, health) to the proxy network. Declared
+# at recipe top level so the ufw provider collects them when it rebuilds the
+# firewall rules file.
+node['kosmos-hubot']['bots'].each do |app_name, config|
+  firewall = config['firewall'] || {}
+  next if firewall.empty?
+
+  firewall_rule "hubot_#{app_name}" do
+    port     firewall['port']
+    source   firewall['source']
+    protocol firewall.fetch('protocol', :tcp)
+    command  :allow
+  end
+end
+
 # A local Redis provides the brain store for the bots. It is only reachable from
 # the node itself, and the bots connect without auth.
 node.override['kosmos_redis']['requirepass'] = false
@@ -27,7 +42,6 @@ node['kosmos-hubot']['bots'].each do |app_name, config|
     robot_name       bot['robot_name']
     http_port        bot['http_port']
     redis            bot['redis'] || false
-    firewall         bot['firewall'] || {}
     external_scripts bot['external_scripts'] || []
     env              bot['env'] || {}
     secret_env       bot['secret_env'] || {}
diff --git a/site-cookbooks/kosmos-hubot/resources/bot.rb b/site-cookbooks/kosmos-hubot/resources/bot.rb
index b1318db..ca665b3 100644
--- a/site-cookbooks/kosmos-hubot/resources/bot.rb
+++ b/site-cookbooks/kosmos-hubot/resources/bot.rb
@@ -19,7 +19,6 @@ property :external_scripts, Array, default: []
 property :env, Hash, default: {}
 property :secret_env, Hash, default: {}
 property :redis, [true, false], default: false
-property :firewall, Hash, default: {}
 property :extra_files, Array, default: []
 
 default_action :create
@@ -44,6 +43,12 @@ action :create do
     service_env[env_key] = secrets[bag_key]
   end
 
+  directory app_path do
+    owner app_user
+    group app_group
+    mode  '0755'
+  end
+
   git app_path do
     user       app_user
     group      app_group
@@ -53,6 +58,7 @@ action :create do
   end
 
   execute "npm install (#{app_name})" do
+    command 'npm install'
     cwd app_path
     user app_user
     group app_group
@@ -119,13 +125,4 @@ action :create do
     triggers_reload true
     action [:create, :enable, :start]
   end
-
-  if new_resource.firewall && !new_resource.firewall.empty?
-    firewall_rule app_name do
-      port     new_resource.firewall['port']
-      source   new_resource.firewall['source']
-      protocol new_resource.firewall.fetch('protocol', :tcp)
-      command  :allow
-    end
-  end
 end