Upgrade Liquor Cabinet to 2.0.0-rc.2 and enable hashed access tokens

site-cookbooks/liquor_cabinet/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 This file is used to list changes made in each version of the liquor_cabinet cookbook.
 
+## 0.3.0
+
+- Pin Liquor Cabinet to the 2.0.0-rc.2 release.
+- Enable hashed remoteStorage access token lookup (`hashed_access_tokens`),
+  so authorizations are read by the SHA256 digest of the bearer token, with
+  the plaintext key kept as a fallback.
+
 ## 0.2.0
 
 - Add Redis password support.

site-cookbooks/liquor_cabinet/attributes/default.rb

@@ -2,7 +2,7 @@ node.default['liquor-cabinet']['app_name'] = "liquor-cabinet"
 node.default['liquor-cabinet']['user'] = "deploy"
 node.default['liquor-cabinet']['group'] = "deploy"
 node.default['liquor-cabinet']['repo'] = 'https://gitea.kosmos.org/5apps/liquor-cabinet.git'
-node.default['liquor-cabinet']['revision'] = 'master'
+node.default['liquor-cabinet']['revision'] = '2.0.0-rc.2'
 node.default['liquor-cabinet']['deploy_path'] = "/opt/#{node['liquor-cabinet']['app_name']}"
 node.default['liquor-cabinet']['redis_server_role'] = 'redis_server'
 node.default['liquor-cabinet']['redis_port'] = 6379
@@ -12,6 +12,7 @@ node.default['liquor-cabinet']['s3_region'] = nil
 node.default['liquor-cabinet']['s3_bucket'] = nil
 node.default['liquor-cabinet']['ufw_source_allowed'] = nil
 node.default['liquor-cabinet']['maintenance_mode_enabled'] = false
+node.default['liquor-cabinet']['hashed_access_tokens'] = true
 node.default['liquor-cabinet']['ruby']['version'] = "3.1.4"
 node.default['liquor-cabinet']['rainbows'] = {
   'port' => 3000,

site-cookbooks/liquor_cabinet/metadata.rb

@@ -3,7 +3,7 @@ maintainer 'Kosmos Developers'
 maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures the Liquor Cabinet remoteStorage API server'
-version '0.2.0'
+version '0.3.0'
 chef_version '>= 18.2'
 issues_url 'https://gitea.kosmos.org/kosmos/chef/issues'
 # source_url 'https://gitea.kosmos.org/kosmos/chef'

site-cookbooks/liquor_cabinet/recipes/default.rb

@@ -79,7 +79,8 @@ template "#{deploy_path}/config.yml.erb" do
             s3_bucket: node[app_name]['s3_bucket'],
             s3_access_key: credentials['s3_access_key'],
             s3_secret_key: credentials['s3_secret_key'],
-            maintenance_mode_enabled: node[app_name]['maintenance_mode_enabled']
+            maintenance_mode_enabled: node[app_name]['maintenance_mode_enabled'],
+            hashed_access_tokens: node[app_name]['hashed_access_tokens']
             # TODO sentry_dsn: credentials['sentry_dsn']
   notifies :restart, "service[#{app_name}]", :delayed
 end

site-cookbooks/liquor_cabinet/templates/config.yml.erb

@@ -1,5 +1,6 @@
 <%= @environment %>:
   maintenance: <%= @maintenance_mode_enabled %>
+  hashed_access_tokens: <%= @hashed_access_tokens %>
   redis:
     host: <%= @redis_host %>
     port: <%= @redis_port %>