Add public HTTP reverse proxy for LndHub

nodes/bitcoin-2.json

@@ -58,6 +58,7 @@
       "redisio::disable_os_default",
       "redisio::configure",
       "redisio::enable",
+      "kosmos-base::letsencrypt",
       "kosmos-nginx::default",
       "nginx::default",
       "nginx::package",
@@ -67,8 +68,7 @@
       "nginx::commons_dir",
       "nginx::commons_script",
       "nginx::commons_conf",
-      "kosmos-nginx::firewall",
-      "kosmos-base::letsencrypt"
+      "kosmos-nginx::firewall"
     ],
     "platform": "ubuntu",
     "platform_version": "20.04",

site-cookbooks/kosmos-bitcoin/attributes/default.rb

@@ -57,9 +57,10 @@ node.default['rtl']['revision'] = 'v0.11.0'
 node.default['rtl']['host'] = '10.1.1.163'
 node.default['rtl']['port'] = '3000'
 
-node.default['lndhub']['repo'] = 'https://github.com/BlueWallet/LndHub.git'
+node.default['lndhub']['repo'] = 'https://github.com/bumi/LndHub.git'
 node.default['lndhub']['revision'] = 'master'
 node.default['lndhub']['port'] = '3023'
+node.default['lndhub']['domain'] = 'lndhub.kosmos.org'
 
 node.default['dotnet']['ms_packages_src_url'] = "https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb"
 node.default['dotnet']['ms_packages_src_checksum'] = "4df5811c41fdded83eb9e2da9336a8dfa5594a79dc8a80133bd815f4f85b9991"

site-cookbooks/kosmos-bitcoin/recipes/lndhub.rb

@@ -93,3 +93,25 @@ firewall_rule 'lndhub_private' do
   protocol :tcp
   command  :allow
 end
+
+unless node.chef_environment == "development"
+  include_recipe "kosmos-base::letsencrypt"
+  include_recipe "kosmos-nginx"
+
+  nginx_certbot_site node[app_name]['domain']
+
+  template "#{node['nginx']['dir']}/sites-available/#{node[app_name]['domain']}" do
+    source 'nginx_conf_lndhub.erb'
+    owner node["nginx"]["user"]
+    mode 0640
+    variables port: node[app_name]['port'],
+              server_name:  node[app_name]['domain'],
+              ssl_cert:     "/etc/letsencrypt/live/#{node[app_name]['domain']}/fullchain.pem",
+              ssl_key:      "/etc/letsencrypt/live/#{node[app_name]['domain']}/privkey.pem"
+    notifies :reload, 'service[nginx]', :delayed
+  end
+
+  nginx_site node[app_name]['domain'] do
+    action :enable
+  end
+end

site-cookbooks/kosmos-bitcoin/templates/nginx_conf_lndhub.erb

@@ -0,0 +1,25 @@
+#
+# Generated by Chef
+#
+upstream _lndhub {
+  server localhost:<%= @port %>;
+}
+
+<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
+server {
+  listen 443 ssl http2;
+  server_name <%= @server_name %>;
+
+  add_header Strict-Transport-Security "max-age=15768000";
+
+  access_log <%= node[:nginx][:log_dir] %>/<%= @server_name %>.access.log json;
+  error_log <%= node[:nginx][:log_dir] %>/<%= @server_name %>.error.log warn;
+
+  location / {
+    proxy_pass http://_lndhub;
+   }
+
+  ssl_certificate <%= @ssl_cert %>;
+  ssl_certificate_key <%= @ssl_key %>;
+}
+<% end -%>