Serve kredits-github via openresty, on Node 22

Move kredits-github onto Node 22.23.4 and behind the openresty reverse proxy
on the proxy hosts, replacing its own nginx + the custom haproxy entry.

- pin Node 22.23.4; run the app with HOST=0.0.0.0 / NODE_ENV=production and
  open port 3000 to 10.1.1.0/24 so the proxy can reach it over ZeroTier
- create /opt/kredits-github owned by the deploy user before cloning
- add kredits-github::nginx_proxy (tls_cert_for + openresty_site, upstream
  from role:kredits_github) and register it in the openresty_proxy run list
- drop the app-node nginx recipe/template and its role entry

roles/kredits_github.rb

@@ -2,5 +2,4 @@ name "kredits_github"
 
 run_list %w(
   kredits-github::default
-  kredits-github::nginx
 )

roles/openresty_proxy.rb

@@ -38,6 +38,7 @@ production_run_list = %w(
   kosmos-hubot::nginx_botka_irc-libera-chat
   kosmos-hubot::nginx_hal8000_xmpp
   kosmos-ipfs::nginx_public_gateway
+  kredits-github::nginx_proxy
   kosmos-mastodon::nginx
   remotestorage_discourse::nginx
   sockethub::nginx

site-cookbooks/kredits-github/metadata.rb

@@ -6,5 +6,7 @@ description      'Installs/Configures kredits-github'
 long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
 version          '0.1.0'
 
+depends 'firewall'
+depends 'kosmos-base'
 depends 'kosmos-nodejs'
-depends 'kosmos-nginx'
+depends 'kosmos_openresty'

site-cookbooks/kredits-github/recipes/default.rb

@@ -2,6 +2,7 @@
 # Cookbook Name:: kredits-github
 # Recipe:: default
 
+node.override["kosmos_nodejs"]["version"] = "22.23.4"
 include_recipe 'kosmos-nodejs'
 
 app_name     = "kredits-github"
@@ -19,6 +20,13 @@ user deploy_user do
 end
 
 app_path = "/opt/#{app_name}"
+
+directory app_path do
+  owner deploy_user
+  group deploy_group
+  mode  "0755"
+end
+
 git app_path do
   user  deploy_user
   group deploy_group
@@ -42,12 +50,13 @@ end
 
 service_env = {
   "LOG_LEVEL" => 'info',
+  "NODE_ENV" => 'production',
+  # Bind on all interfaces so the openresty reverse proxy (draco/fornax) can
+  # reach the app over ZeroTier; port 3000 is firewalled to 10.1.1.0/24 below.
+  "HOST" => '0.0.0.0',
   "APP_ID" => credentials["app_id"],
   "PRIVATE_KEY_PATH" => "#{app_path}/github_app_key.pem",
-  "WEBHOOK_SECRET" => credentials["webhook_secret"],
-  # Node 16 bundles its own CA store, which still trusts the compromised
-  # eMudhra intermediate's root; use the (patched) system trust store instead.
-  "NODE_OPTIONS" => "--use-openssl-ca"
+  "WEBHOOK_SECRET" => credentials["webhook_secret"]
 }
 
 systemd_unit "#{app_name}.service" do
@@ -73,3 +82,14 @@ systemd_unit "#{app_name}.service" do
   triggers_reload true
   action [:create, :enable, :start]
 end
+
+unless node.chef_environment == "development"
+  include_recipe "kosmos-base::firewall"
+
+  firewall_rule 'kredits-github' do
+    port     node['kredits-github']['port'].to_i
+    source   '10.1.1.0/24'
+    protocol :tcp
+    command  :allow
+  end
+end

site-cookbooks/kredits-github/recipes/nginx.rb

@@ -1,46 +0,0 @@
-#
-# Cookbook Name:: kredits-github
-# Recipe:: nginx
-#
-# The MIT License (MIT)
-#
-# Copyright:: 2019, Kosmos Developers
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-# THE SOFTWARE.
-
-include_recipe 'kosmos-nginx'
-server_name = node['kredits-github']['domain']
-
-template "#{node['nginx']['dir']}/sites-available/#{server_name}" do
-  source 'nginx_conf.erb'
-  owner 'www-data'
-  mode 0640
-  variables app_name:    "kredits-github",
-            nodejs_port: node['kredits-github']['port'],
-            server_name: server_name,
-            ssl_cert:    "/etc/letsencrypt/live/#{server_name}/fullchain.pem",
-            ssl_key:     "/etc/letsencrypt/live/#{server_name}/privkey.pem"
-  notifies :reload, 'service[nginx]', :delayed
-end
-
-nginx_site server_name do
-  action :enable
-end
-
-nginx_certbot_site server_name

site-cookbooks/kredits-github/recipes/nginx_proxy.rb

@@ -0,0 +1,30 @@
+#
+# Cookbook Name:: kredits-github
+# Recipe:: nginx_proxy
+#
+# Terminates TLS and proxies kredits-github.kosmos.org to the app node
+# (role:kredits_github) over the ZeroTier network. Runs on the proxy hosts.
+#
+
+domain = node['kredits-github']['domain']
+
+kredits_node = search(:node, 'role:kredits_github').first
+
+if kredits_node.nil?
+  Chef::Log.warn("No node found with 'kredits_github' role. Not configuring openresty site.")
+  return
+end
+
+tls_cert_for domain do
+  auth 'gandi_dns'
+  action :create
+end
+
+openresty_site domain do
+  template 'nginx_conf_kredits_github_proxy.erb'
+  variables domain:        domain,
+            upstream_host: kredits_node['knife_zero']['host'],
+            upstream_port: node['kredits-github']['port'],
+            ssl_cert:      "/etc/letsencrypt/live/#{domain}/fullchain.pem",
+            ssl_key:       "/etc/letsencrypt/live/#{domain}/privkey.pem"
+end

site-cookbooks/kredits-github/templates/default/nginx_conf.erb

@@ -1,27 +0,0 @@
-# Generated by Chef
-upstream _<%= @app_name %> {
-  server   localhost:<%= @nodejs_port %>;
-}
-
-<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
-server {
-  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
-  listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
-  server_name <%= @server_name %>;
-
-  access_log <%= node[:nginx][:log_dir] %>/<%= @app_name %>.access.log json;
-  error_log <%= node[:nginx][:log_dir] %>/<%= @app_name %>.error.log warn;
-
-  gzip on;
-
-  add_header Strict-Transport-Security "max-age=15768000";
-
-  location / {
-    proxy_buffers 1024 8k; # Increase number of buffers. Default is 8
-    proxy_pass http://_<%= @app_name %>;
-  }
-
-  ssl_certificate <%= @ssl_cert %>;
-  ssl_certificate_key <%= @ssl_key %>;
-}
-<% end -%>

site-cookbooks/kredits-github/templates/default/nginx_conf_kredits_github_proxy.erb

@@ -0,0 +1,24 @@
+upstream _kredits_github {
+  server <%= @upstream_host %>:<%= @upstream_port %>;
+}
+
+server {
+  server_name <%= @domain %>;
+  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
+  listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
+
+  access_log "<%= node['openresty']['log_dir'] %>/<%= @domain %>.access.log" json;
+  error_log "<%= node['openresty']['log_dir'] %>/<%= @domain %>.error.log";
+
+  ssl_certificate     <%= @ssl_cert %>;
+  ssl_certificate_key <%= @ssl_key %>;
+
+  location / {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_pass http://_kredits_github;
+    proxy_http_version 1.1;
+  }
+}