From 931a3a196f62589affbdf057f1771bfd5dc99439 Mon Sep 17 00:00:00 2001
From: Sebastian Kippe <sebastian@kip.pe>
Date: Sun, 21 Nov 2021 13:22:40 -0600
Subject: [PATCH] Add public HTTP reverse proxy for LndHub

---
 nodes/bitcoin-2.json                          |  4 +--
 .../kosmos-bitcoin/attributes/default.rb      |  3 ++-
 .../kosmos-bitcoin/recipes/lndhub.rb          | 22 ++++++++++++++++
 .../templates/nginx_conf_lndhub.erb           | 25 +++++++++++++++++++
 4 files changed, 51 insertions(+), 3 deletions(-)
 create mode 100644 site-cookbooks/kosmos-bitcoin/templates/nginx_conf_lndhub.erb

diff --git a/nodes/bitcoin-2.json b/nodes/bitcoin-2.json
index b4b3a04..0554152 100644
--- a/nodes/bitcoin-2.json
+++ b/nodes/bitcoin-2.json
@@ -58,6 +58,7 @@
       "redisio::disable_os_default",
       "redisio::configure",
       "redisio::enable",
+      "kosmos-base::letsencrypt",
       "kosmos-nginx::default",
       "nginx::default",
       "nginx::package",
@@ -67,8 +68,7 @@
       "nginx::commons_dir",
       "nginx::commons_script",
       "nginx::commons_conf",
-      "kosmos-nginx::firewall",
-      "kosmos-base::letsencrypt"
+      "kosmos-nginx::firewall"
     ],
     "platform": "ubuntu",
     "platform_version": "20.04",
diff --git a/site-cookbooks/kosmos-bitcoin/attributes/default.rb b/site-cookbooks/kosmos-bitcoin/attributes/default.rb
index 624c146..b727aa9 100644
--- a/site-cookbooks/kosmos-bitcoin/attributes/default.rb
+++ b/site-cookbooks/kosmos-bitcoin/attributes/default.rb
@@ -57,9 +57,10 @@ node.default['rtl']['revision'] = 'v0.11.0'
 node.default['rtl']['host'] = '10.1.1.163'
 node.default['rtl']['port'] = '3000'
 
-node.default['lndhub']['repo'] = 'https://github.com/BlueWallet/LndHub.git'
+node.default['lndhub']['repo'] = 'https://github.com/bumi/LndHub.git'
 node.default['lndhub']['revision'] = 'master'
 node.default['lndhub']['port'] = '3023'
+node.default['lndhub']['domain'] = 'lndhub.kosmos.org'
 
 node.default['dotnet']['ms_packages_src_url'] = "https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb"
 node.default['dotnet']['ms_packages_src_checksum'] = "4df5811c41fdded83eb9e2da9336a8dfa5594a79dc8a80133bd815f4f85b9991"
diff --git a/site-cookbooks/kosmos-bitcoin/recipes/lndhub.rb b/site-cookbooks/kosmos-bitcoin/recipes/lndhub.rb
index 3140ee5..e63fd47 100644
--- a/site-cookbooks/kosmos-bitcoin/recipes/lndhub.rb
+++ b/site-cookbooks/kosmos-bitcoin/recipes/lndhub.rb
@@ -93,3 +93,25 @@ firewall_rule 'lndhub_private' do
   protocol :tcp
   command  :allow
 end
+
+unless node.chef_environment == "development"
+  include_recipe "kosmos-base::letsencrypt"
+  include_recipe "kosmos-nginx"
+
+  nginx_certbot_site node[app_name]['domain']
+
+  template "#{node['nginx']['dir']}/sites-available/#{node[app_name]['domain']}" do
+    source 'nginx_conf_lndhub.erb'
+    owner node["nginx"]["user"]
+    mode 0640
+    variables port: node[app_name]['port'],
+              server_name:  node[app_name]['domain'],
+              ssl_cert:     "/etc/letsencrypt/live/#{node[app_name]['domain']}/fullchain.pem",
+              ssl_key:      "/etc/letsencrypt/live/#{node[app_name]['domain']}/privkey.pem"
+    notifies :reload, 'service[nginx]', :delayed
+  end
+
+  nginx_site node[app_name]['domain'] do
+    action :enable
+  end
+end
diff --git a/site-cookbooks/kosmos-bitcoin/templates/nginx_conf_lndhub.erb b/site-cookbooks/kosmos-bitcoin/templates/nginx_conf_lndhub.erb
new file mode 100644
index 0000000..cd8b3e4
--- /dev/null
+++ b/site-cookbooks/kosmos-bitcoin/templates/nginx_conf_lndhub.erb
@@ -0,0 +1,25 @@
+#
+# Generated by Chef
+#
+upstream _lndhub {
+  server localhost:<%= @port %>;
+}
+
+<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
+server {
+  listen 443 ssl http2;
+  server_name <%= @server_name %>;
+
+  add_header Strict-Transport-Security "max-age=15768000";
+
+  access_log <%= node[:nginx][:log_dir] %>/<%= @server_name %>.access.log json;
+  error_log <%= node[:nginx][:log_dir] %>/<%= @server_name %>.error.log warn;
+
+  location / {
+    proxy_pass http://_lndhub;
+   }
+
+  ssl_certificate <%= @ssl_cert %>;
+  ssl_certificate_key <%= @ssl_key %>;
+}
+<% end -%>