kosmos/chef
kosmos/chef
8
3
Fork 0
Code Issues 30 Pull Requests 3 Projects 2 Activity

Migrate accounts API proxy to openresty

Browse Source
This commit is contained in:
Râu Cao 2023-07-26 14:52:37 +02:00
parent 7b5d46c813
commit 1bad2939de
Signed by: raucao
GPG Key ID: 15E65F399D084BA9
4 changed files with 13 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
nodes/draco.kosmos.org.json
View File

@ -38,7 +38,6 @@
"kosmos_openresty::default", "kosmos_openresty::default",
"kosmos_openresty::firewall", "kosmos_openresty::firewall",
"kosmos_assets::nginx_site", "kosmos_assets::nginx_site",
"kosmos-akkounts::nginx",
"kosmos_discourse::nginx", "kosmos_discourse::nginx",
"kosmos_drone::nginx", "kosmos_drone::nginx",
"kosmos_gitea::nginx", "kosmos_gitea::nginx",
@ -46,6 +45,8 @@
"kosmos_rsk::nginx_mainnet", "kosmos_rsk::nginx_mainnet",
"kosmos_website", "kosmos_website",
"kosmos_website::default", "kosmos_website::default",
"kosmos-akkounts::nginx",
"kosmos-akkounts::nginx_api",
"kosmos_encfs", "kosmos_encfs",
"kosmos_encfs::default", "kosmos_encfs::default",
"kosmos-ejabberd::firewall", "kosmos-ejabberd::firewall",
@ -69,6 +70,7 @@
"hostname::default", "hostname::default",
"openresty::apt_package", "openresty::apt_package",
"openresty::ohai_plugin", "openresty::ohai_plugin",
"openresty::commons_cleanup",
"openresty::commons_user", "openresty::commons_user",
"openresty::commons_dir", "openresty::commons_dir",
"openresty::commons_script", "openresty::commons_script",

4
roles/openresty_proxy.rb
View File

@ -25,7 +25,6 @@ default_run_list = %w(
kosmos_garage::firewall_rpc kosmos_garage::firewall_rpc
kosmos_garage::nginx_web kosmos_garage::nginx_web
kosmos-akkounts::nginx_api
kosmos-bitcoin::nginx_lndhub kosmos-bitcoin::nginx_lndhub
kosmos-ejabberd::nginx kosmos-ejabberd::nginx
kosmos-hubot::nginx_botka_irc-libera-chat kosmos-hubot::nginx_botka_irc-libera-chat
@ -38,13 +37,14 @@ default_run_list = %w(
production_run_list = %w( production_run_list = %w(
role[openresty] role[openresty]
kosmos_assets::nginx_site kosmos_assets::nginx_site
kosmos-akkounts::nginx
kosmos_discourse::nginx kosmos_discourse::nginx
kosmos_drone::nginx kosmos_drone::nginx
kosmos_gitea::nginx kosmos_gitea::nginx
kosmos_rsk::nginx_testnet kosmos_rsk::nginx_testnet
kosmos_rsk::nginx_mainnet kosmos_rsk::nginx_mainnet
kosmos_website::default kosmos_website::default
kosmos-akkounts::nginx
kosmos-akkounts::nginx_api
) )
env_run_lists( env_run_lists(

19
site-cookbooks/kosmos-akkounts/recipes/nginx_api.rb
View File

@ -3,29 +3,24 @@
# Recipe:: nginx_api # Recipe:: nginx_api
# #
include_recipe "kosmos-nginx"
domain = node["akkounts_api"]["domain"] domain = node["akkounts_api"]["domain"]
nginx_certbot_site domain
upstream_hosts = [] upstream_hosts = []
search(:node, "role:akkounts").each do |node| search(:node, "role:akkounts").each do |node|
upstream_hosts << node["knife_zero"]["host"] upstream_hosts << node["knife_zero"]["host"]
end end
upstream_hosts.push("localhost") if upstream_hosts.empty? upstream_hosts.push("localhost") if upstream_hosts.empty?
template "#{node["nginx"]["dir"]}/sites-available/#{domain}" do tls_cert_for domain do
source "nginx_conf_akkounts_api.erb" auth "gandi_dns"
owner "www-data" action :create
mode 0640 end
openresty_site domain do
template "nginx_conf_akkounts_api.erb"
variables domain: domain, variables domain: domain,
upstream_port: node["akkounts"]["port"], upstream_port: node["akkounts"]["port"],
upstream_hosts: upstream_hosts, upstream_hosts: upstream_hosts,
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem", ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem" ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
notifies :reload, "service[nginx]", :delayed
end
nginx_site domain do
action :enable
end end

2
site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts_api.erb
View File

@ -6,7 +6,7 @@ upstream _akkounts_api {
} }
server { server {
listen 443 ssl http2; listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2; listen [::]:443 ssl http2;
server_name <%= @domain %>; server_name <%= @domain %>;