Configure LDAP for akkounts, add more Rails credentials

data_bags/credentials/akkounts.json

@@ -1,65 +1,93 @@
 {
   "id": "akkounts",
+  "rails_master_key": {
+    "encrypted_data": "q/0BtGuFZJQhw+iG4ZmFG12DPaWQDGTb/nCmRoxOnsACkANqMv/zZ39CoNFe\nLPtZiItY\n",
+    "iv": "JV8R0iu6TrqcZRxL\n",
+    "auth_tag": "YxZIhEUnrd3XrwR6f9wO4A==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "rails_secret_key_base": {
+    "encrypted_data": "JmDQew3+OR6+yJ1xErwXeTn6jw8N2HwTc9yvAVJ3G+7w1s3N7rKDM6+M50ez\n2zP4Lm/eXzH4WTsTZlQcodlyNpi66pvUCGAkNM36rwTN5yvnhqPUmuSQi7AG\nDTBronBwr9ENvwA/gRuugyyhrRB1iuStpzpYKCMhZ2ae9Mrxdux0+ezfSLn4\nuP22uUrEqdQ/BWsW\n",
+    "iv": "U/+YncCk13U6bYMz\n",
+    "auth_tag": "2wPYJ/uVPv4jLKpAW/x6sw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "rails_encryption_primary_key": {
+    "encrypted_data": "u/7z91Og/2eM7PWi2JWYAQMhYX4S5+bMMeVpkFPu778Gqj6Td9pagsWIak/d\nb7AU1zjF\n",
+    "iv": "wYhrJWcuWbY8yo8S\n",
+    "auth_tag": "WEoEdNy6VBvB2d5gb8DTXw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "rails_encryption_key_derivation_salt": {
+    "encrypted_data": "noOwTZuxfhsH94bjOT9rWCKS9rb3wAoXELGrc4nJZeNrb/B9XnOLTuK/wen8\nfmtoym0P\n",
+    "iv": "jiFWs3VXhJdQBNqk\n",
+    "auth_tag": "XDpJFgadYp7LyRqU7SO+Fg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
   "postgresql": {
-    "encrypted_data": "QniE89zGMyQ+ujKrs1cUfAZYbqysS2cl6gvNohloQttlrEzcwcbbSgNk7+Em\nVQZNk8oddiZWFhKx2rS/6w2xN6/S\n",
-    "iv": "TS8cu5wPd8Cq9qyK\n",
-    "auth_tag": "sJAfzoh3w5+KO+YrJDxV3Q==\n",
+    "encrypted_data": "Xorg8R8COxE/Swivu8MqZiwstD6rD+8FmgDx70pFscZ/CTb6WQRpyqGSrGZt\nZ7oL9WrqZs+mQgBb30odU+Sgdr6x\n",
+    "iv": "6QWZc3+MY0hBCc/s\n",
+    "auth_tag": "ZM+7OYyx5E9PciNG2OILhg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "ldap": {
+    "encrypted_data": "mr2Z7hXF1GOn8RmqeZMMdaUcmiVP4ZeKtTX6RYW1cR+FQiUwoITwTPBE9XUx\n2cqZ9Mcd8uJicmf9vd+PfwPtRtoZFwqHQ4LDRFLW64hBZyiEkZWxWW+HzgPr\n",
+    "iv": "k1AkyEplnJ4IZO1Z\n",
+    "auth_tag": "zAOcrPex3VLDfRFq38n7fA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "sentry_dsn": {
-    "encrypted_data": "thN8SHTqR+uE54M78F4m67mJLbK2xI3lm6Hyj3L0xCEDkCXAOU88y5w1SjPd\nt5Erlqyy97AK2KXCoGUcx/GE0JUFBcvkrhLODshDyNI4Jno=\n",
-    "iv": "+XOBOMwL+GLUjXrg\n",
-    "auth_tag": "xoUbiuwu215y+F7MkUQWxg==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "rails_master_key": {
-    "encrypted_data": "W1U4LBiEVU3WI3o5aCEjHPCb/u3GcPZYOK0CtLU/yNrY0BTafevpF8xXTllx\nkd/MvxwB\n",
-    "iv": "DcdHIgy66hwxmBmt\n",
-    "auth_tag": "9fGhoduUHerBvU64LyqjQA==\n",
+    "encrypted_data": "51cAERaRBCRg/sMb5c13EcnJzsz6VEf7jx6X3ooUSzm9wHoEfC5Hs/qakr/D\nqm9x3s3aGURRzyLUIEoe9jCohGguh6ehrXYVrun0B6pghVU=\n",
+    "iv": "hJsiiW6dFQMEQ+2p\n",
+    "auth_tag": "TOIahNrUhhsdQGlzp6UV5g==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "discourse_connect_secret": {
-    "encrypted_data": "YEKQbAY3ZBVIUUrVe6R7phDPiFsCSGSicJy1Gv/G+IseGmqbuefCWvvRvhBW\nFxxEMg==\n",
-    "iv": "kF/DYeO5neO470Xa\n",
-    "auth_tag": "309Lt0QUzY8obqre2sKPhQ==\n",
+    "encrypted_data": "pvKcwuZgUJsAvClQ4V0BwhwEg09EUEWVxoSx+mFlfG1KpvZE4Cu3u3PalPSD\nldyKsw==\n",
+    "iv": "ED85d6PKyaKB3Wlv\n",
+    "auth_tag": "XVCU/WigC97tNe0bUK6okQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "lndhub_admin_token": {
-    "encrypted_data": "qa1W/w/IbUcEoqRBTKfGRXMaba7RIke3YthFaoNQej6h\n",
-    "iv": "4rN6s8FKHG2S0frS\n",
-    "auth_tag": "1P1+o05gYLSRIhEK0MwDYg==\n",
+    "encrypted_data": "LvCgahQblsKOxK9iNbwDd31atBfemVppHqV7s3K/sR4j\n",
+    "iv": "zObzh2jEsqXk2vD2\n",
+    "auth_tag": "n9m/sBYBfzggwQLWrGpR2Q==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "btcpay_auth_token": {
-    "encrypted_data": "bOQTsV4H66oUfTbfAJLXGnF4bNns5qyaHDxKRwRc29OCc3Ou2te2WV0nNnai\nXbe6om0yfOSeDe4V4zg=\n",
-    "iv": "Cd27/sNY+EY/+AbZ\n",
-    "auth_tag": "sTpATXSPMGpXvIZrhlTZmA==\n",
+    "encrypted_data": "M4kGd6+jresm90nWrJG25mX6rfhaU+VlJlIVd/IjOAUsDABryyulJul3GZFh\nFPSI4uEhgIWtn56I0bA=\n",
+    "iv": "hvqHm7A/YfUOJwRJ\n",
+    "auth_tag": "DhtT6IeixD1MSRX+D7JxZA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "s3_access_key": {
-    "encrypted_data": "53aBDio/eb8zBj4TJGMbKvhBS+Nzjt5WBORu1jKYy5rOL7l/57QYqhj3o4DV\n",
-    "iv": "QEgqL8J+r2rnEXt/\n",
-    "auth_tag": "eehuZfMGocNtEsdY4IH7Nw==\n",
+    "encrypted_data": "FPRpLZoIbLcVWPJhOlX7ZeXGv6TZIWYAD+BKTsJOyOHxDG3eRULqQc89cGWi\n",
+    "iv": "f9WiiGLmDxtygp60\n",
+    "auth_tag": "lGnq4itmByuF/Yp20/6coQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "s3_secret_key": {
-    "encrypted_data": "cjEbyKKN5bZyG6yy6ovh38dTNmZI9iciEpJ8pfw3jaD2cW/SXYHOenhnhAId\n1daUMHvWfIx82cDsnxZstCW0wmYML70+xU0TVMadsIPJMdIC5Fc=\n",
-    "iv": "fDCPTxINTEmxX2kz\n",
-    "auth_tag": "S7TDJnU7Ms8D4WUnw5a7dA==\n",
+    "encrypted_data": "JnnwISbHJ+d7JZB/C0NH0fb8p+bDSwoq5t5knSi+bSTltSxKcq6PRX9K6bov\nEbo0GTdWePbuc5NCsyYxfrkzCtpLXTIxeCROtinRmFIgMFNwaOA=\n",
+    "iv": "pKPCaANDqGtbFV3V\n",
+    "auth_tag": "S//hn2HOhuZH8+UfCNBWDg==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "nostr_private_key": {
-    "encrypted_data": "BwWnS0xQn/EsZPF6ohjsQuFnAnUmJxGasUNpFUN6+ZE31t5XtGDjnzU1doTy\n1ToBCnJkNVCrUxg3j6YKTH6sFinrZrDT4WAn501Y0Swz95VRrvc=\n",
-    "iv": "huVql9m/qhHTm/0c\n",
-    "auth_tag": "2GWcyZ6bgFQEeWjbyJbW7g==\n",
+    "encrypted_data": "AKfFiLow+veDyEWBwmCDuLerT3l+o2aJUCeHg2mZZIyoH4oeo/9crZwIdjBn\n70reouqnHNG9mBHuO/+IPGfj53mHLo+oGHh+6LkL3ImI4MFBofY=\n",
+    "iv": "bPlOKk2qkJAzdKf+\n",
+    "auth_tag": "VIp1IOjBGatn2MN5LHVymg==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }

site-cookbooks/kosmos-akkounts/recipes/default.rb

@@ -29,7 +29,7 @@ node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_20.x"
 include_recipe 'kosmos-nodejs'
 npm_package "bun"
 
-ruby_version = "3.3.0"
+ruby_version = "3.3.8"
 ruby_path = "/opt/ruby_build/builds/#{ruby_version}"
 bundle_path = "#{ruby_path}/bin/bundle"
 rails_env = node.chef_environment == "development" ? "development" : "production"
@@ -48,6 +48,9 @@ env = {
   primary_domain: node['akkounts']['primary_domain'],
   akkounts_domain: node['akkounts']['domain'],
   rails_serve_static_files: true,
+  secret_key_base: credentials["rails_secret_key_base"],
+  encryption_primary_key: credentials["rails_encryption_primary_key"],
+  encryption_key_derivation_salt: credentials["rails_encryption_key_derivation_salt"],
   db_adapter: "postgresql",
   pg_host: "pg.kosmos.local",
   pg_port: 5432,
@@ -57,6 +60,17 @@ env = {
   pg_password: credentials["postgresql"]["password"]
 }
 
+env[:ldap] = {
+  host: "ldap.kosmos.local",
+  port: 389,
+  use_tls: false,
+  uid_attr: "cn",
+  base: "ou=kosmos.org,cn=users,dc=kosmos,dc=org",
+  admin_user: credentials["ldap"]["admin_user"],
+  admin_password: credentials["ldap"]["admin_password"],
+  suffix: "dc=kosmos,dc=org"
+}
+
 smtp_server, smtp_port = smtp_credentials[:relayhost].split(":")
 env[:smtp] = {
   server: smtp_server,