Move Node services onto patched releases for the eMudhra CA incident

Bump Node to patched releases (mastodon/sockethub 24.22.1, RTL 22.23.4).
Force the pinned major's latest patch in kosmos-nodejs: nodejs_install only
selects the repo major and a bare `package nodejs` never upgrades an already
installed package.

For hosts stuck on Node 16 (no patched 16.x), run the services with
NODE_OPTIONS=--use-openssl-ca so they use the patched system trust store:
ipfs-pinner, kredits-github, hubot botka/hal8000, sockethub.

site-cookbooks/kosmos-bitcoin/recipes/rtl.rb

@@ -3,7 +3,7 @@
 # Recipe:: rtl
 #
 
-node.override["kosmos_nodejs"]["version"] = "22.23.1"
+node.override["kosmos_nodejs"]["version"] = "22.23.4"
 include_recipe 'kosmos-nodejs'
 
 app_name      = "rtl"

site-cookbooks/kosmos-hubot/recipes/botka_irc-libera-chat.rb

@@ -48,6 +48,9 @@ end
 
 service_env = {
   "HUBOT_LOG_LEVEL"             => node.chef_environment == "development" ? "debug" : "info",
+  # Node 16 bundles its own CA store, which still trusts the compromised
+  # eMudhra intermediate's root; use the (patched) system trust store instead.
+  "NODE_OPTIONS"                => "--use-openssl-ca",
   "HUBOT_IRC_USESSL"            => "true",
   "HUBOT_IRC_SERVER"            => credentials["znc_host"],
   "HUBOT_IRC_PORT"              => credentials["znc_port"],

site-cookbooks/kosmos-hubot/recipes/hal8000_xmpp.rb

@@ -69,6 +69,9 @@ end
 
 service_env = {
   "HUBOT_LOG_LEVEL"                => node.chef_environment == "development" ? "debug" : "info",
+  # Node 16 bundles its own CA store, which still trusts the compromised
+  # eMudhra intermediate's root; use the (patched) system trust store instead.
+  "NODE_OPTIONS"                   => "--use-openssl-ca",
   "HUBOT_XMPP_USERNAME"            => "hal8000@kosmos.org/hubot",
   "HUBOT_XMPP_PASSWORD"            => data_bag['xmpp_password'],
   "HUBOT_XMPP_HOST"                => "xmpp.kosmos.org",

site-cookbooks/kosmos-ipfs/recipes/kredits_pinner.rb

@@ -32,7 +32,10 @@ execute "npm install" do
 end
 
 service_env = {
-  'DEBUG' => 'ipfs-pinner'
+  'DEBUG' => 'ipfs-pinner',
+  # Node 16 bundles its own CA store, which still trusts the compromised
+  # eMudhra intermediate's root; use the (patched) system trust store instead.
+  'NODE_OPTIONS' => '--use-openssl-ca'
 }
 
 systemd_unit "#{app_name}.service" do

site-cookbooks/kosmos-mastodon/attributes/default.rb

@@ -18,7 +18,7 @@ node.default["kosmos-mastodon"]["deploy"] = true
 node.default["kosmos-mastodon"]["build"] = true
 
 # Runtime versions
-node.default["kosmos-mastodon"]["nodejs_version"]      = "24.21.0"
+node.default["kosmos-mastodon"]["nodejs_version"]      = "24.22.1"
 node.default["kosmos-mastodon"]["ruby_version"]        = "4.0.7"
 node.default["kosmos-mastodon"]["ruby_build_version"]  = "v20260924"
 

site-cookbooks/kosmos-nodejs/recipes/default.rb

@@ -7,3 +7,11 @@ nodejs_install 'nodejs' do
   install_method 'package'
   version node["kosmos_nodejs"]["version"]
 end
+
+# nodejs_install only uses the version to select the Nodesource repo major, then
+# runs a bare `package nodejs`, which Chef considers up to date for an already
+# installed package. Force an upgrade so a newer patch of the same major (e.g.
+# 22.23.1 -> 22.23.4) is actually installed.
+package 'nodejs' do
+  action :upgrade
+end

site-cookbooks/kredits-github/recipes/default.rb

@@ -44,7 +44,10 @@ service_env = {
   "LOG_LEVEL" => 'info',
   "APP_ID" => credentials["app_id"],
   "PRIVATE_KEY_PATH" => "#{app_path}/github_app_key.pem",
-  "WEBHOOK_SECRET" => credentials["webhook_secret"]
+  "WEBHOOK_SECRET" => credentials["webhook_secret"],
+  # Node 16 bundles its own CA store, which still trusts the compromised
+  # eMudhra intermediate's root; use the (patched) system trust store instead.
+  "NODE_OPTIONS" => "--use-openssl-ca"
 }
 
 systemd_unit "#{app_name}.service" do

site-cookbooks/sockethub/recipes/default.rb

@@ -3,7 +3,7 @@
 # Recipe:: default
 #
 
-node.override["kosmos_nodejs"]["version"] = "24.21.0"
+node.override["kosmos_nodejs"]["version"] = "24.22.1"
 include_recipe 'kosmos-nodejs'
 
 user  = "sockethub"
@@ -63,6 +63,7 @@ ExecStart=#{entry}
 User=#{user}
 Group=#{group}
 Environment=SOCKETHUB_CONFIG=/etc/sockethub/sockethub.config.json
+Environment=NODE_OPTIONS=--use-openssl-ca
 Restart=always
 
 [Install]