From 3c436bb9f1335c74a4ec0ad1cc28d5ac6c1668f0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Tue, 6 May 2025 19:41:54 +0400 Subject: [PATCH] Configure LDAP for akkounts, add more Rails credentials --- data_bags/credentials/akkounts.json | 90 ++++++++++++------- .../kosmos-akkounts/recipes/default.rb | 16 +++- 2 files changed, 74 insertions(+), 32 deletions(-) diff --git a/data_bags/credentials/akkounts.json b/data_bags/credentials/akkounts.json index 28e79f3..a2b57ab 100644 --- a/data_bags/credentials/akkounts.json +++ b/data_bags/credentials/akkounts.json @@ -1,65 +1,93 @@ { "id": "akkounts", + "rails_master_key": { + "encrypted_data": "q/0BtGuFZJQhw+iG4ZmFG12DPaWQDGTb/nCmRoxOnsACkANqMv/zZ39CoNFe\nLPtZiItY\n", + "iv": "JV8R0iu6TrqcZRxL\n", + "auth_tag": "YxZIhEUnrd3XrwR6f9wO4A==\n", + "version": 3, + "cipher": "aes-256-gcm" + }, + "rails_secret_key_base": { + "encrypted_data": "JmDQew3+OR6+yJ1xErwXeTn6jw8N2HwTc9yvAVJ3G+7w1s3N7rKDM6+M50ez\n2zP4Lm/eXzH4WTsTZlQcodlyNpi66pvUCGAkNM36rwTN5yvnhqPUmuSQi7AG\nDTBronBwr9ENvwA/gRuugyyhrRB1iuStpzpYKCMhZ2ae9Mrxdux0+ezfSLn4\nuP22uUrEqdQ/BWsW\n", + "iv": "U/+YncCk13U6bYMz\n", + "auth_tag": "2wPYJ/uVPv4jLKpAW/x6sw==\n", + "version": 3, + "cipher": "aes-256-gcm" + }, + "rails_encryption_primary_key": { + "encrypted_data": "u/7z91Og/2eM7PWi2JWYAQMhYX4S5+bMMeVpkFPu778Gqj6Td9pagsWIak/d\nb7AU1zjF\n", + "iv": "wYhrJWcuWbY8yo8S\n", + "auth_tag": "WEoEdNy6VBvB2d5gb8DTXw==\n", + "version": 3, + "cipher": "aes-256-gcm" + }, + "rails_encryption_key_derivation_salt": { + "encrypted_data": "noOwTZuxfhsH94bjOT9rWCKS9rb3wAoXELGrc4nJZeNrb/B9XnOLTuK/wen8\nfmtoym0P\n", + "iv": "jiFWs3VXhJdQBNqk\n", + "auth_tag": "XDpJFgadYp7LyRqU7SO+Fg==\n", + "version": 3, + "cipher": "aes-256-gcm" + }, "postgresql": { - "encrypted_data": "QniE89zGMyQ+ujKrs1cUfAZYbqysS2cl6gvNohloQttlrEzcwcbbSgNk7+Em\nVQZNk8oddiZWFhKx2rS/6w2xN6/S\n", - "iv": "TS8cu5wPd8Cq9qyK\n", - "auth_tag": "sJAfzoh3w5+KO+YrJDxV3Q==\n", + "encrypted_data": "Xorg8R8COxE/Swivu8MqZiwstD6rD+8FmgDx70pFscZ/CTb6WQRpyqGSrGZt\nZ7oL9WrqZs+mQgBb30odU+Sgdr6x\n", + "iv": "6QWZc3+MY0hBCc/s\n", + "auth_tag": "ZM+7OYyx5E9PciNG2OILhg==\n", + "version": 3, + "cipher": "aes-256-gcm" + }, + "ldap": { + "encrypted_data": "mr2Z7hXF1GOn8RmqeZMMdaUcmiVP4ZeKtTX6RYW1cR+FQiUwoITwTPBE9XUx\n2cqZ9Mcd8uJicmf9vd+PfwPtRtoZFwqHQ4LDRFLW64hBZyiEkZWxWW+HzgPr\n", + "iv": "k1AkyEplnJ4IZO1Z\n", + "auth_tag": "zAOcrPex3VLDfRFq38n7fA==\n", "version": 3, "cipher": "aes-256-gcm" }, "sentry_dsn": { - "encrypted_data": "thN8SHTqR+uE54M78F4m67mJLbK2xI3lm6Hyj3L0xCEDkCXAOU88y5w1SjPd\nt5Erlqyy97AK2KXCoGUcx/GE0JUFBcvkrhLODshDyNI4Jno=\n", - "iv": "+XOBOMwL+GLUjXrg\n", - "auth_tag": "xoUbiuwu215y+F7MkUQWxg==\n", - "version": 3, - "cipher": "aes-256-gcm" - }, - "rails_master_key": { - "encrypted_data": "W1U4LBiEVU3WI3o5aCEjHPCb/u3GcPZYOK0CtLU/yNrY0BTafevpF8xXTllx\nkd/MvxwB\n", - "iv": "DcdHIgy66hwxmBmt\n", - "auth_tag": "9fGhoduUHerBvU64LyqjQA==\n", + "encrypted_data": "51cAERaRBCRg/sMb5c13EcnJzsz6VEf7jx6X3ooUSzm9wHoEfC5Hs/qakr/D\nqm9x3s3aGURRzyLUIEoe9jCohGguh6ehrXYVrun0B6pghVU=\n", + "iv": "hJsiiW6dFQMEQ+2p\n", + "auth_tag": "TOIahNrUhhsdQGlzp6UV5g==\n", "version": 3, "cipher": "aes-256-gcm" }, "discourse_connect_secret": { - "encrypted_data": "YEKQbAY3ZBVIUUrVe6R7phDPiFsCSGSicJy1Gv/G+IseGmqbuefCWvvRvhBW\nFxxEMg==\n", - "iv": "kF/DYeO5neO470Xa\n", - "auth_tag": "309Lt0QUzY8obqre2sKPhQ==\n", + "encrypted_data": "pvKcwuZgUJsAvClQ4V0BwhwEg09EUEWVxoSx+mFlfG1KpvZE4Cu3u3PalPSD\nldyKsw==\n", + "iv": "ED85d6PKyaKB3Wlv\n", + "auth_tag": "XVCU/WigC97tNe0bUK6okQ==\n", "version": 3, "cipher": "aes-256-gcm" }, "lndhub_admin_token": { - "encrypted_data": "qa1W/w/IbUcEoqRBTKfGRXMaba7RIke3YthFaoNQej6h\n", - "iv": "4rN6s8FKHG2S0frS\n", - "auth_tag": "1P1+o05gYLSRIhEK0MwDYg==\n", + "encrypted_data": "LvCgahQblsKOxK9iNbwDd31atBfemVppHqV7s3K/sR4j\n", + "iv": "zObzh2jEsqXk2vD2\n", + "auth_tag": "n9m/sBYBfzggwQLWrGpR2Q==\n", "version": 3, "cipher": "aes-256-gcm" }, "btcpay_auth_token": { - "encrypted_data": "bOQTsV4H66oUfTbfAJLXGnF4bNns5qyaHDxKRwRc29OCc3Ou2te2WV0nNnai\nXbe6om0yfOSeDe4V4zg=\n", - "iv": "Cd27/sNY+EY/+AbZ\n", - "auth_tag": "sTpATXSPMGpXvIZrhlTZmA==\n", + "encrypted_data": "M4kGd6+jresm90nWrJG25mX6rfhaU+VlJlIVd/IjOAUsDABryyulJul3GZFh\nFPSI4uEhgIWtn56I0bA=\n", + "iv": "hvqHm7A/YfUOJwRJ\n", + "auth_tag": "DhtT6IeixD1MSRX+D7JxZA==\n", "version": 3, "cipher": "aes-256-gcm" }, "s3_access_key": { - "encrypted_data": "53aBDio/eb8zBj4TJGMbKvhBS+Nzjt5WBORu1jKYy5rOL7l/57QYqhj3o4DV\n", - "iv": "QEgqL8J+r2rnEXt/\n", - "auth_tag": "eehuZfMGocNtEsdY4IH7Nw==\n", + "encrypted_data": "FPRpLZoIbLcVWPJhOlX7ZeXGv6TZIWYAD+BKTsJOyOHxDG3eRULqQc89cGWi\n", + "iv": "f9WiiGLmDxtygp60\n", + "auth_tag": "lGnq4itmByuF/Yp20/6coQ==\n", "version": 3, "cipher": "aes-256-gcm" }, "s3_secret_key": { - "encrypted_data": "cjEbyKKN5bZyG6yy6ovh38dTNmZI9iciEpJ8pfw3jaD2cW/SXYHOenhnhAId\n1daUMHvWfIx82cDsnxZstCW0wmYML70+xU0TVMadsIPJMdIC5Fc=\n", - "iv": "fDCPTxINTEmxX2kz\n", - "auth_tag": "S7TDJnU7Ms8D4WUnw5a7dA==\n", + "encrypted_data": "JnnwISbHJ+d7JZB/C0NH0fb8p+bDSwoq5t5knSi+bSTltSxKcq6PRX9K6bov\nEbo0GTdWePbuc5NCsyYxfrkzCtpLXTIxeCROtinRmFIgMFNwaOA=\n", + "iv": "pKPCaANDqGtbFV3V\n", + "auth_tag": "S//hn2HOhuZH8+UfCNBWDg==\n", "version": 3, "cipher": "aes-256-gcm" }, "nostr_private_key": { - "encrypted_data": "BwWnS0xQn/EsZPF6ohjsQuFnAnUmJxGasUNpFUN6+ZE31t5XtGDjnzU1doTy\n1ToBCnJkNVCrUxg3j6YKTH6sFinrZrDT4WAn501Y0Swz95VRrvc=\n", - "iv": "huVql9m/qhHTm/0c\n", - "auth_tag": "2GWcyZ6bgFQEeWjbyJbW7g==\n", + "encrypted_data": "AKfFiLow+veDyEWBwmCDuLerT3l+o2aJUCeHg2mZZIyoH4oeo/9crZwIdjBn\n70reouqnHNG9mBHuO/+IPGfj53mHLo+oGHh+6LkL3ImI4MFBofY=\n", + "iv": "bPlOKk2qkJAzdKf+\n", + "auth_tag": "VIp1IOjBGatn2MN5LHVymg==\n", "version": 3, "cipher": "aes-256-gcm" } diff --git a/site-cookbooks/kosmos-akkounts/recipes/default.rb b/site-cookbooks/kosmos-akkounts/recipes/default.rb index cdf7858..0f9f6d9 100644 --- a/site-cookbooks/kosmos-akkounts/recipes/default.rb +++ b/site-cookbooks/kosmos-akkounts/recipes/default.rb @@ -29,7 +29,7 @@ node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_20.x" include_recipe 'kosmos-nodejs' npm_package "bun" -ruby_version = "3.3.0" +ruby_version = "3.3.8" ruby_path = "/opt/ruby_build/builds/#{ruby_version}" bundle_path = "#{ruby_path}/bin/bundle" rails_env = node.chef_environment == "development" ? "development" : "production" @@ -48,6 +48,9 @@ env = { primary_domain: node['akkounts']['primary_domain'], akkounts_domain: node['akkounts']['domain'], rails_serve_static_files: true, + secret_key_base: credentials["rails_secret_key_base"], + encryption_primary_key: credentials["rails_encryption_primary_key"], + encryption_key_derivation_salt: credentials["rails_encryption_key_derivation_salt"], db_adapter: "postgresql", pg_host: "pg.kosmos.local", pg_port: 5432, @@ -57,6 +60,17 @@ env = { pg_password: credentials["postgresql"]["password"] } +env[:ldap] = { + host: "ldap.kosmos.local", + port: 389, + use_tls: false, + uid_attr: "cn", + base: "ou=kosmos.org,cn=users,dc=kosmos,dc=org", + admin_user: credentials["ldap"]["admin_user"], + admin_password: credentials["ldap"]["admin_password"], + suffix: "dc=kosmos,dc=org" +} + smtp_server, smtp_port = smtp_credentials[:relayhost].split(":") env[:smtp] = { server: smtp_server,