From 44f86d3f07ed54684693776c80d10fe2ee44cd46 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Sat, 24 Oct 2026 15:55:36 +0200 Subject: [PATCH] Serve kredits-github via openresty, on Node 22 Move kredits-github onto Node 22.23.4 and behind the openresty reverse proxy on the proxy hosts, replacing its own nginx + the custom haproxy entry. - pin Node 22.23.4; run the app with HOST=0.0.0.0 / NODE_ENV=production and open port 3000 to 10.1.1.0/24 so the proxy can reach it over ZeroTier - create /opt/kredits-github owned by the deploy user before cloning - add kredits-github::nginx_proxy (tls_cert_for + openresty_site, upstream from role:kredits_github) and register it in the openresty_proxy run list - drop the app-node nginx recipe/template and its role entry --- roles/kredits_github.rb | 1 - roles/openresty_proxy.rb | 1 + site-cookbooks/kredits-github/metadata.rb | 4 +- .../kredits-github/recipes/default.rb | 28 +++++++++-- .../kredits-github/recipes/nginx.rb | 46 ------------------- .../kredits-github/recipes/nginx_proxy.rb | 30 ++++++++++++ .../templates/default/nginx_conf.erb | 27 ----------- .../nginx_conf_kredits_github_proxy.erb | 24 ++++++++++ 8 files changed, 82 insertions(+), 79 deletions(-) delete mode 100644 site-cookbooks/kredits-github/recipes/nginx.rb create mode 100644 site-cookbooks/kredits-github/recipes/nginx_proxy.rb delete mode 100644 site-cookbooks/kredits-github/templates/default/nginx_conf.erb create mode 100644 site-cookbooks/kredits-github/templates/default/nginx_conf_kredits_github_proxy.erb diff --git a/roles/kredits_github.rb b/roles/kredits_github.rb index 57f3d88..0c8b7c0 100644 --- a/roles/kredits_github.rb +++ b/roles/kredits_github.rb @@ -2,5 +2,4 @@ name "kredits_github" run_list %w( kredits-github::default - kredits-github::nginx ) diff --git a/roles/openresty_proxy.rb b/roles/openresty_proxy.rb index b6b8eaf..c13bbfd 100644 --- a/roles/openresty_proxy.rb +++ b/roles/openresty_proxy.rb @@ -38,6 +38,7 @@ production_run_list = %w( kosmos-hubot::nginx_botka_irc-libera-chat kosmos-hubot::nginx_hal8000_xmpp kosmos-ipfs::nginx_public_gateway + kredits-github::nginx_proxy kosmos-mastodon::nginx remotestorage_discourse::nginx sockethub::nginx diff --git a/site-cookbooks/kredits-github/metadata.rb b/site-cookbooks/kredits-github/metadata.rb index 12d54b6..b208064 100644 --- a/site-cookbooks/kredits-github/metadata.rb +++ b/site-cookbooks/kredits-github/metadata.rb @@ -6,5 +6,7 @@ description 'Installs/Configures kredits-github' long_description IO.read(File.join(File.dirname(__FILE__), 'README.md')) version '0.1.0' +depends 'firewall' +depends 'kosmos-base' depends 'kosmos-nodejs' -depends 'kosmos-nginx' +depends 'kosmos_openresty' diff --git a/site-cookbooks/kredits-github/recipes/default.rb b/site-cookbooks/kredits-github/recipes/default.rb index d37ba9e..5316e44 100644 --- a/site-cookbooks/kredits-github/recipes/default.rb +++ b/site-cookbooks/kredits-github/recipes/default.rb @@ -2,6 +2,7 @@ # Cookbook Name:: kredits-github # Recipe:: default +node.override["kosmos_nodejs"]["version"] = "22.23.4" include_recipe 'kosmos-nodejs' app_name = "kredits-github" @@ -19,6 +20,13 @@ user deploy_user do end app_path = "/opt/#{app_name}" + +directory app_path do + owner deploy_user + group deploy_group + mode "0755" +end + git app_path do user deploy_user group deploy_group @@ -42,12 +50,13 @@ end service_env = { "LOG_LEVEL" => 'info', + "NODE_ENV" => 'production', + # Bind on all interfaces so the openresty reverse proxy (draco/fornax) can + # reach the app over ZeroTier; port 3000 is firewalled to 10.1.1.0/24 below. + "HOST" => '0.0.0.0', "APP_ID" => credentials["app_id"], "PRIVATE_KEY_PATH" => "#{app_path}/github_app_key.pem", - "WEBHOOK_SECRET" => credentials["webhook_secret"], - # Node 16 bundles its own CA store, which still trusts the compromised - # eMudhra intermediate's root; use the (patched) system trust store instead. - "NODE_OPTIONS" => "--use-openssl-ca" + "WEBHOOK_SECRET" => credentials["webhook_secret"] } systemd_unit "#{app_name}.service" do @@ -73,3 +82,14 @@ systemd_unit "#{app_name}.service" do triggers_reload true action [:create, :enable, :start] end + +unless node.chef_environment == "development" + include_recipe "kosmos-base::firewall" + + firewall_rule 'kredits-github' do + port node['kredits-github']['port'].to_i + source '10.1.1.0/24' + protocol :tcp + command :allow + end +end diff --git a/site-cookbooks/kredits-github/recipes/nginx.rb b/site-cookbooks/kredits-github/recipes/nginx.rb deleted file mode 100644 index 54b576a..0000000 --- a/site-cookbooks/kredits-github/recipes/nginx.rb +++ /dev/null @@ -1,46 +0,0 @@ -# -# Cookbook Name:: kredits-github -# Recipe:: nginx -# -# The MIT License (MIT) -# -# Copyright:: 2019, Kosmos Developers -# -# Permission is hereby granted, free of charge, to any person obtaining a copy -# of this software and associated documentation files (the "Software"), to deal -# in the Software without restriction, including without limitation the rights -# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell -# copies of the Software, and to permit persons to whom the Software is -# furnished to do so, subject to the following conditions: -# -# The above copyright notice and this permission notice shall be included in -# all copies or substantial portions of the Software. -# -# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR -# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, -# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE -# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER -# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, -# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN -# THE SOFTWARE. - -include_recipe 'kosmos-nginx' -server_name = node['kredits-github']['domain'] - -template "#{node['nginx']['dir']}/sites-available/#{server_name}" do - source 'nginx_conf.erb' - owner 'www-data' - mode 0640 - variables app_name: "kredits-github", - nodejs_port: node['kredits-github']['port'], - server_name: server_name, - ssl_cert: "/etc/letsencrypt/live/#{server_name}/fullchain.pem", - ssl_key: "/etc/letsencrypt/live/#{server_name}/privkey.pem" - notifies :reload, 'service[nginx]', :delayed -end - -nginx_site server_name do - action :enable -end - -nginx_certbot_site server_name diff --git a/site-cookbooks/kredits-github/recipes/nginx_proxy.rb b/site-cookbooks/kredits-github/recipes/nginx_proxy.rb new file mode 100644 index 0000000..5b3dcfb --- /dev/null +++ b/site-cookbooks/kredits-github/recipes/nginx_proxy.rb @@ -0,0 +1,30 @@ +# +# Cookbook Name:: kredits-github +# Recipe:: nginx_proxy +# +# Terminates TLS and proxies kredits-github.kosmos.org to the app node +# (role:kredits_github) over the ZeroTier network. Runs on the proxy hosts. +# + +domain = node['kredits-github']['domain'] + +kredits_node = search(:node, 'role:kredits_github').first + +if kredits_node.nil? + Chef::Log.warn("No node found with 'kredits_github' role. Not configuring openresty site.") + return +end + +tls_cert_for domain do + auth 'gandi_dns' + action :create +end + +openresty_site domain do + template 'nginx_conf_kredits_github_proxy.erb' + variables domain: domain, + upstream_host: kredits_node['knife_zero']['host'], + upstream_port: node['kredits-github']['port'], + ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem", + ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem" +end diff --git a/site-cookbooks/kredits-github/templates/default/nginx_conf.erb b/site-cookbooks/kredits-github/templates/default/nginx_conf.erb deleted file mode 100644 index 5d8d496..0000000 --- a/site-cookbooks/kredits-github/templates/default/nginx_conf.erb +++ /dev/null @@ -1,27 +0,0 @@ -# Generated by Chef -upstream _<%= @app_name %> { - server localhost:<%= @nodejs_port %>; -} - -<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%> -server { - listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; - listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2; - server_name <%= @server_name %>; - - access_log <%= node[:nginx][:log_dir] %>/<%= @app_name %>.access.log json; - error_log <%= node[:nginx][:log_dir] %>/<%= @app_name %>.error.log warn; - - gzip on; - - add_header Strict-Transport-Security "max-age=15768000"; - - location / { - proxy_buffers 1024 8k; # Increase number of buffers. Default is 8 - proxy_pass http://_<%= @app_name %>; - } - - ssl_certificate <%= @ssl_cert %>; - ssl_certificate_key <%= @ssl_key %>; -} -<% end -%> diff --git a/site-cookbooks/kredits-github/templates/default/nginx_conf_kredits_github_proxy.erb b/site-cookbooks/kredits-github/templates/default/nginx_conf_kredits_github_proxy.erb new file mode 100644 index 0000000..08e48b3 --- /dev/null +++ b/site-cookbooks/kredits-github/templates/default/nginx_conf_kredits_github_proxy.erb @@ -0,0 +1,24 @@ +upstream _kredits_github { + server <%= @upstream_host %>:<%= @upstream_port %>; +} + +server { + server_name <%= @domain %>; + listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2; + listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2; + + access_log "<%= node['openresty']['log_dir'] %>/<%= @domain %>.access.log" json; + error_log "<%= node['openresty']['log_dir'] %>/<%= @domain %>.error.log"; + + ssl_certificate <%= @ssl_cert %>; + ssl_certificate_key <%= @ssl_key %>; + + location / { + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_pass http://_kredits_github; + proxy_http_version 1.1; + } +}