kosmos/chef
8
3
Fork 0
Code Issues 34 Pull Requests 3 Projects 2 Activity

Merge branch 'master' into feature/rskj_public_endpoint

Browse Source
This commit is contained in:
Basti
2021-11-28 10:02:06 -06:00
parent 3817284566 7e49dfd520
commit 35115b7391
33 changed files with 509 additions and 169 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
site-cookbooks/kosmos-hubot/attributes/default.rb
View File

@@ -1,7 +1,6 @@
node.default['hal8000']['http_port'] = 8080
node.default['botka_freenode']['http_port'] = 8081
node.default['botka_freenode']['domain'] = "freenode.botka.kosmos.org"
node.default['botka_irc-libera-chat']['http_port'] = 8081
node.default['hal8000_xmpp']['http_port'] = 8082
node.default['hal8000_xmpp']['domain'] = "hal8000.chat.kosmos.org"

122
site-cookbooks/kosmos-hubot/recipes/botka_irc-libera-chat.rb Normal file
View File

@@ -0,0 +1,122 @@
#
# Cookbook Name:: kosmos-hubot
# Recipe:: botka_irc-libera-chat
#
app_name = "botka_irc-libera-chat"
app_path = "/opt/#{app_name}"
app_user = "hubot"
app_group = "hubot"
domain = "irc-libera-chat.botka.kosmos.chat"
build_essential app_name do
compile_time true
end
include_recipe "kosmos-nodejs"
include_recipe "kosmos-redis"
application app_path do
data_bag = Chef::EncryptedDataBagItem.load('credentials', app_name)
owner app_user
group app_group
git do
user app_user
group app_group
repository "https://gitea.kosmos.org/kosmos/botka.git"
revision "master"
end
file "#{app_path}/external-scripts.json" do
mode "0640"
owner app_user
group app_group
content [
"hubot-help",
"hubot-redis-brain",
"hubot-remotestorage-logger",
"hubot-web-push-notifications",
].to_json
end
npm_install do
user app_user
end
execute "systemctl daemon-reload" do
command "systemctl daemon-reload"
action :nothing
end
template "/lib/systemd/system/#{app_name}.service" do
source 'nodejs.systemd.service.erb'
owner 'root'
group 'root'
mode '0644'
variables(
user: app_user,
group: app_group,
app_dir: app_path,
entry: "#{app_path}/bin/hubot -a irc",
environment: {
"HUBOT_LOG_LEVEL" => node.chef_environment == "development" ? "debug" : "info",
"HUBOT_IRC_USESSL" => "true",
"HUBOT_IRC_SERVER" => "irc.libera.chat",
"HUBOT_IRC_PORT" => "6697",
"HUBOT_IRC_NICK" => "botka",
"HUBOT_IRC_NICKSERV_USERNAME" => "botka",
"HUBOT_IRC_NICKSERV_PASSWORD" => data_bag['nickserv_password'],
"HUBOT_IRC_ROOMS" => "#kosmos,#kosmos-dev,#kosmos-random,#remotestorage,#hackerbeach,#unhosted,#sockethub,#mastodon",
"HUBOT_IRC_UNFLOOD" => "100",
"HUBOT_RSS_PRINTSUMMARY" => "false",
"HUBOT_RSS_PRINTERROR" => "false",
"HUBOT_RSS_IRCCOLORS" => "true",
"REDIS_URL" => "redis://localhost:6379/botka",
"EXPRESS_PORT" => node[app_name]['http_port'],
"HUBOT_AUTH_ADMIN" => "bkero,raucao",
"HUBOT_HELP_REPLY_IN_PRIVATE" => "true",
"RS_LOGGER_USER" => "kosmos@5apps.com",
"RS_LOGGER_TOKEN" => data_bag['rs_logger_token'],
"RS_LOGGER_SERVER_NAME" => "freenode",
"RS_LOGGER_PUBLIC" => "true",
"GCM_API_KEY" => data_bag['gcm_api_key'],
"VAPID_SUBJECT" => "https://kosmos.org",
"VAPID_PUBLIC_KEY" => data_bag['vapid_public_key'],
"VAPID_PRIVATE_KEY" => data_bag['vapid_private_key']
}
)
notifies :run, "execute[systemctl daemon-reload]", :delayed
notifies :restart, "service[#{app_name}]", :delayed
end
service app_name do
action [:enable, :start]
end
end
#
# Nginx reverse proxy
#
unless node.chef_environment == "development"
include_recipe "kosmos-base::letsencrypt"
include_recipe "kosmos-nginx"
template "#{node['nginx']['dir']}/sites-available/#{domain}" do
source 'nginx_conf_hubot.erb'
owner node["nginx"]["user"]
mode 0640
variables express_port: node[app_name]['http_port'],
server_name: domain,
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
notifies :reload, 'service[nginx]', :delayed
end
nginx_site domain do
action :enable
end
nginx_certbot_site domain
end

21
site-cookbooks/kosmos_drone/recipes/default.rb
View File

@@ -2,27 +2,6 @@
# Cookbook:: kosmos_drone
# Recipe:: default
#
# The MIT License (MIT)
#
# Copyright:: 2020, Kosmos Developers
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
package "docker-compose"
domain = "drone.kosmos.org"

4
site-cookbooks/kosmos_drone/templates/docker-compose.yml.erb
View File

@@ -2,7 +2,7 @@ version: '3'
services:
drone-server:
image: drone/drone:1
image: drone/drone:2.5
ports:
- "<%= @upstream_port %>:80"
@@ -19,7 +19,7 @@ services:
- DRONE_RPC_SECRET=<%= @rpc_secret %>
drone-runner:
image: drone/drone-runner-docker:1
image: drone/drone-runner-docker:1.8
command: agent
restart: always

4
site-cookbooks/kosmos_gitea/attributes/default.rb
View File

@@ -1,6 +1,6 @@
gitea_version = "1.14.6"
gitea_version = "1.15.6"
node.default["kosmos_gitea"]["version"] = gitea_version
node.default["kosmos_gitea"]["binary_url"] = "https://dl.gitea.io/gitea/#{gitea_version}/gitea-#{gitea_version}-linux-amd64"
node.default["kosmos_gitea"]["binary_checksum"] = "20cc0a89421695320b077c9fe4f16996f03aaf9d24f661f8d2255794551c849b"
node.default["kosmos_gitea"]["binary_checksum"] = "1b7473b5993e07b33fec58edbc1a90f15f040759ca4647e97317c33d5dfe58be"
node.default["kosmos_gitea"]["nginx"]["domain"] = "gitea.kosmos.org"
node.default["kosmos_gitea"]["working_directory"] = "/var/lib/gitea"

2
site-cookbooks/kosmos_gitea/recipes/default.rb
View File

@@ -76,7 +76,7 @@ template "#{config_directory}/app.ini" do
source "app.ini.erb"
owner "git"
group "git"
mode "0640"
mode "0600"
sensitive true
variables working_directory: working_directory,
git_home_directory: git_home_directory,

1
site-cookbooks/kosmos_gitea/templates/default/app.ini.erb
View File

@@ -46,6 +46,7 @@ PASSWD = <%= @smtp_password %>
[oauth2]
JWT_SECRET = <%= @jwt_secret %>
JWT_SIGNING_ALGORITHM = HS256
[security]
INTERNAL_TOKEN = <%= @internal_token %>

2
site-cookbooks/kosmos_rsk/attributes/default.rb
View File

@@ -1,2 +1,2 @@
node.default['rskj']['version'] = '2.2.0~focal'
node.default['rskj']['version'] = '3.0.1~focal'
node.default['rskj']['network'] = 'testnet'

7
site-cookbooks/kosmos_rsk/recipes/firewall.rb Normal file
View File

@@ -0,0 +1,7 @@
include_recipe 'firewall'
firewall_rule 'rskj' do
port [4444,50505]
protocol :tcp
command :allow
end

8
site-cookbooks/kosmos_rsk/recipes/rskj.rb
View File

@@ -30,10 +30,4 @@ service "rsk" do
action [:enable, :start]
end
include_recipe 'firewall'
firewall_rule 'rskj' do
port [4444,50505]
protocol :tcp
command :allow
end
include_recipe 'kosmos_rsk::firewall'

3
site-cookbooks/sockethub/attributes/default.rb
View File

@@ -1,4 +1,5 @@
node.default['sockethub']['port'] = '10551'
node.default['sockethub']['external_port'] = '10550'
node.default['sockethub']['revision'] = 'v3.0.1'
node.default['sockethub']['version'] = '4.1.0'
node.default['sockethub']['nginx']['server_name'] = 'sockethub.kosmos.org'
node.default['sockethub']['debug_logs'] = 'sockethub*'

3
site-cookbooks/sockethub/metadata.rb
View File

@@ -4,9 +4,8 @@ maintainer_email 'mail@kosmos.org'
license 'MIT'
description 'Installs/Configures sockethub'
long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
version '0.1.1'
version '0.2.0'
depends 'application_javascript'
depends 'kosmos-redis'
depends 'kosmos-nodejs'
depends 'kosmos-nginx'

90
site-cookbooks/sockethub/recipes/default.rb
View File

@@ -27,11 +27,15 @@
include_recipe 'kosmos-nodejs'
include_recipe 'kosmos-redis'
group "sockethub" do
user = "sockethub"
group = "sockethub"
entry = "/usr/bin/sockethub"
group group do
gid 7625
end
user "sockethub" do
user user do
comment "sockethub user"
uid 7625
gid 7625
@@ -39,47 +43,43 @@ user "sockethub" do
shell "/bin/bash"
end
path_to_deploy = "/opt/sockethub"
application path_to_deploy do
owner "sockethub"
group "sockethub"
git do
user "sockethub"
group "sockethub"
repository 'https://github.com/sockethub/sockethub.git'
revision node['sockethub']['revision']
end
npm_install do
user "sockethub"
end
execute "systemctl daemon-reload" do
command "systemctl daemon-reload"
action :nothing
end
template "/lib/systemd/system/sockethub_nodejs.service" do
source 'nodejs.systemd.service.erb'
owner 'root'
group 'root'
mode '0644'
variables(
user: "sockethub",
group: "sockethub",
app_dir: path_to_deploy,
entry: "/usr/bin/node /usr/bin/npm start",
environment: { 'DEBUG' => '*',
'PORT' => node['sockethub']['port'],
# Use the second database (index starts at 0)
'REDIS_URL' => "redis://localhost:6379/1" }
)
notifies :run, "execute[systemctl daemon-reload]", :delayed
notifies :restart, "service[sockethub_nodejs]", :delayed
end
service "sockethub_nodejs" do
action [:enable, :start]
end
npm_package "sockethub" do
version node['sockethub']['version']
end
execute "systemctl daemon-reload" do
command "systemctl daemon-reload"
action :nothing
end
environment_variables = {
'PORT' => node['sockethub']['port'],
# Use the second database (index starts at 0)
'REDIS_URL' => "redis://localhost:6379/1"
}
unless node['sockethub']['debug_logs'].nil?
environment_variables['DEBUG'] = node['sockethub']['debug_logs']
end
environment = environment_variables.map{|k, v| "'#{k}=#{v}'"}.join(' ')
systemd_unit "sockethub_nodejs.service" do
content <<-EOF
[Unit]
Description=Start sockethub
Requires=redis-server.service
After=redis-server.service
[Service]
ExecStart=#{entry}
User=#{user}
Group=#{group}
Environment=#{environment}
Restart=always
[Install]
WantedBy=multi-user.target
EOF
triggers_reload true
action [:create, :enable, :start]
end

39
site-cookbooks/sockethub/recipes/proxy.rb
View File

@@ -26,8 +26,41 @@
include_recipe 'sockethub::_firewall'
include_recipe 'kosmos-nginx'
include_recipe "kosmos-base::letsencrypt"
server_name = node['sockethub']['nginx']['server_name']
nginx_post_hook = <<-EOF
#!/usr/bin/env bash
set -e
systemctl reload nginx
EOF
file "/etc/letsencrypt/renewal-hooks/post/nginx" do
content nginx_post_hook
mode 0755
owner "root"
group "root"
end
gandi_api_data_bag_item = data_bag_item('credentials', 'gandi_api_5apps')
template "/root/gandi_dns_certbot_hook.sh" do
variables gandi_api_key: gandi_api_data_bag_item["key"]
mode 0770
end
# Generate a Let's Encrypt cert (only if no cert has been generated before).
# The systemd timer will take care of renewing
execute "letsencrypt cert for sockethub" do
command "certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/nginx\" --email ops@kosmos.org -d #{server_name} -n"
not_if do
File.exist?("/etc/letsencrypt/live/#{server_name}/fullchain.pem")
end
end
template "#{node['nginx']['dir']}/sites-available/#{server_name}" do
source 'nginx_conf_sockethub.erb'
owner 'www-data'
@@ -40,13 +73,7 @@ template "#{node['nginx']['dir']}/sites-available/#{server_name}" do
notifies :reload, 'service[nginx]', :delayed
end
# Legacy vhost
nginx_site "sockethub" do
action :disable
end
nginx_site server_name do
action :enable
end
nginx_certbot_site server_name

8
site-cookbooks/sockethub/templates/default/nginx_conf_sockethub.erb
View File

@@ -8,10 +8,13 @@ map $http_upgrade $connection_upgrade {
'' close;
}
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
server {
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
listen <%= @sockethub_external_port %> ssl http2;
add_header Strict-Transport-Security "max-age=15768000";
<% else -%>
listen <%= @sockethub_external_port %>;
<% end -%>
server_name <%= @server_name %>;
@@ -32,7 +35,8 @@ server {
proxy_set_header Connection $connection_upgrade;
}
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>;
<% end -%>
}
<% end -%>

17
site-cookbooks/sockethub/templates/default/nodejs.systemd.service.erb
View File

@@ -1,17 +0,0 @@
[Unit]
Description=Start nodejs app
Requires=redis-server.service
After=redis-server.service
[Service]
ExecStart=<%= @entry %>
WorkingDirectory=<%= @app_dir %>
User=<%= @user %>
Group=<%= @group %>
<% unless @environment.empty? -%>
Environment=<% @environment.each do |key, value| -%>'<%= key %>=<%= value %>' <% end %>
<% end -%>
Restart=always
[Install]
WantedBy=multi-user.target

63
site-cookbooks/sockethub/templates/gandi_dns_certbot_hook.sh.erb Executable file
View File

@@ -0,0 +1,63 @@
#!/usr/bin/env bash
#
set -euf -o pipefail
# ************** USAGE **************
#
# Example usage (with this hook file saved in /root/):
#
# sudo su -
# certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos -d "5apps.com" -d muc.5apps.com -d "xmpp.5apps.com" \
# --manual-auth-hook "/root/letsencrypt_hook.sh auth" --manual-cleanup-hook "/root/letsencrypt_hook.sh cleanup"
#
# This hook requires configuration, continue reading.
#
# ************** CONFIGURATION **************
#
# GANDI_API_KEY: Your Gandi Live API key
#
# PROVIDER_UPDATE_DELAY:
# How many seconds to wait after updating your DNS records. This may be required,
# depending on how slow your DNS host is to begin serving new DNS records after updating
# them via the API. 30 seconds is a safe default, but some providers can be very slow
# (e.g. Linode).
#
# Defaults to 30 seconds.
#
GANDI_API_KEY="<%= @gandi_api_key %>"
PROVIDER_UPDATE_DELAY=30
regex='.*\.(.*\..*)'
if [[ $CERTBOT_DOMAIN =~ $regex ]]
then
DOMAIN="${BASH_REMATCH[1]}"
else
DOMAIN="${CERTBOT_DOMAIN}"
fi
# To be invoked via Certbot's --manual-auth-hook
function auth {
curl -s -D- -H "Content-Type: application/json" \
-H "X-Api-Key: ${GANDI_API_KEY}" \
-d "{\"rrset_name\": \"_acme-challenge.${CERTBOT_DOMAIN}.\",
\"rrset_type\": \"TXT\",
\"rrset_ttl\": 3600,
\"rrset_values\": [\"${CERTBOT_VALIDATION}\"]}" \
"https://dns.api.gandi.net/api/v5/domains/${DOMAIN}/records"
sleep ${PROVIDER_UPDATE_DELAY}
}
# To be invoked via Certbot's --manual-cleanup-hook
function cleanup {
curl -s -X DELETE -H "Content-Type: application/json" \
-H "X-Api-Key: ${GANDI_API_KEY}" \
https://dns.api.gandi.net/api/v5/domains/${DOMAIN}/records/_acme-challenge.${CERTBOT_DOMAIN}./TXT
}
HANDLER=$1; shift;
if [ -n "$(type -t $HANDLER)" ] && [ "$(type -t $HANDLER)" = function ]; then
$HANDLER "$@"
fi