Refactor kosmos-hubot to a data-driven model
Replace the per-bot and per-vhost recipes with a single data-driven setup. - resources/bot.rb (kosmos_hubot_bot): git checkout, npm install, generated external-scripts.json, extra files, and one hardened systemd unit for every hubot (Type=simple, Restart=always, RestartSec=2, TimeoutSec=10, PrivateTmp, ProtectSystem=full, NoNewPrivileges, PrivateDevices) - recipes/default.rb: shared setup + loop over node['kosmos-hubot']['bots']; recipes/nginx.rb: loop over node['kosmos-hubot']['vhosts']; recipes/hal8000_extras.rb: augments the hal8000 bot (searched IPFS/RSK hosts, kredits .env, wallet) and declares no resources itself - bot config and vhosts now live in attributes; secrets come from the encrypted credentials/hubot bag via secret_env - Node 22.23.4; kosmos_redis replaces redisio; REDIS_URL uses ?<prefix>; the adapter is passed as -a <module>; botka gains hubot-incoming-webhook - roles/hubot, nginx_proxy, openresty_proxy and the chef-nodes pointer updated
This commit is contained in:
16 files changed
+373
-330
No files matched your search
+1
-1
Submodule nodes updated: e37d92dd6c...afffa40031.
+1
-2
@@ -1,8 +1,7 @@
|
||||
name "hubot"
|
||||
|
||||
default_run_list = %w(
|
||||
kosmos-hubot::botka_irc-libera-chat
|
||||
kosmos-hubot::hal8000_xmpp
|
||||
kosmos-hubot::default
|
||||
)
|
||||
|
||||
env_run_lists(
|
||||
|
||||
@@ -29,8 +29,7 @@ default_run_list = %w(
|
||||
kosmos-akkounts::nginx_api
|
||||
kosmos-bitcoin::nginx_lndhub
|
||||
kosmos-ejabberd::nginx
|
||||
kosmos-hubot::nginx_botka_irc-libera-chat
|
||||
kosmos-hubot::nginx_hal8000_xmpp
|
||||
kosmos-hubot::nginx
|
||||
kosmos-ipfs::nginx_public_gateway
|
||||
kosmos-mastodon::nginx
|
||||
remotestorage_discourse::nginx
|
||||
|
||||
@@ -35,8 +35,7 @@ production_run_list = %w(
|
||||
kosmos-akkounts::nginx
|
||||
kosmos-akkounts::nginx_api
|
||||
kosmos-bitcoin::nginx_lndhub
|
||||
kosmos-hubot::nginx_botka_irc-libera-chat
|
||||
kosmos-hubot::nginx_hal8000_xmpp
|
||||
kosmos-hubot::nginx
|
||||
kosmos-ipfs::nginx_public_gateway
|
||||
kredits-github::nginx_proxy
|
||||
kosmos-mastodon::nginx
|
||||
|
||||
@@ -1,4 +1,31 @@
|
||||
kosmos-hubot Cookbook
|
||||
=====================
|
||||
|
||||
This cookbook sets up our hubots
|
||||
Sets up our [hubot](https://hubot.github.com/) bots.
|
||||
|
||||
## Layout
|
||||
|
||||
- `attributes/default.rb` — declares every bot in
|
||||
`node['kosmos-hubot']['bots']` (keyed by `app_name`) and the openresty
|
||||
vhosts in `node['kosmos-hubot']['vhosts']`.
|
||||
- `resources/bot.rb` — the `kosmos_hubot_bot` resource: git checkout,
|
||||
`npm install`, generated `external-scripts.json`, extra files, a hardened
|
||||
systemd unit, and an optional firewall rule.
|
||||
- `recipes/default.rb` — shared setup (`build_essential`, git, the `hubot`
|
||||
user, Node, Redis, firewall) and a loop over the bots.
|
||||
- `recipes/nginx.rb` — creates the vhosts on the proxy nodes.
|
||||
- `recipes/hal8000_extras.rb` — augments the hal8000 bot's config (searched
|
||||
IPFS/RSK hosts, kredits `.env`, wallet); included by `recipes/default.rb`
|
||||
before the bot is declared.
|
||||
|
||||
## Adding a bot
|
||||
|
||||
Add an entry to `node['kosmos-hubot']['bots']` (repository, adapter,
|
||||
robot_name, http_port, external_scripts, env/secret_env, …) and, if it exposes
|
||||
an HTTP endpoint, a vhost entry. No recipe, role or node changes required.
|
||||
|
||||
## Secrets
|
||||
|
||||
Service environment secrets come from the encrypted `credentials/hubot` data
|
||||
bag, keyed by `app_name`. `secret_env` maps a service env var to a key within
|
||||
that bot's hash.
|
||||
@@ -1,36 +1,102 @@
|
||||
node.default['hal8000']['http_port'] = 8080
|
||||
# Per-bot configuration for the hubot role.
|
||||
#
|
||||
# Each entry is keyed by app_name and consumed by the `kosmos_hubot_bot`
|
||||
# resource. Secrets are resolved from the encrypted `credentials/hubot` data
|
||||
# bag, keyed by app_name; `secret_env` maps a service env var to a key within
|
||||
# that bot's hash. `adapter` is passed to hubot as `-a` (the adapter module
|
||||
# name, e.g. "@hubot-friends/hubot-irc" or "hubot-xmpp").
|
||||
|
||||
node.default['botka_irc-libera-chat']['http_port'] = 8081
|
||||
default['kosmos-hubot']['bots'] = {
|
||||
'botka_irc-libera-chat' => {
|
||||
'repository' => 'https://gitea.kosmos.org/kosmos/botka.git',
|
||||
'revision' => 'master',
|
||||
'adapter' => '@hubot-friends/hubot-irc',
|
||||
'robot_name' => 'botka',
|
||||
'http_port' => 8081,
|
||||
'redis' => true,
|
||||
'firewall' => { 'port' => 8081, 'source' => '10.1.1.0/24' },
|
||||
'external_scripts' => %w[
|
||||
hubot-help hubot-incoming-webhook hubot-redis-brain
|
||||
hubot-remotestorage-logger
|
||||
],
|
||||
'secret_env' => {
|
||||
'HUBOT_IRC_SERVER' => 'znc_host',
|
||||
'HUBOT_IRC_PORT' => 'znc_port',
|
||||
'HUBOT_IRC_USERNAME' => 'znc_user',
|
||||
'HUBOT_IRC_PASSWORD' => 'znc_password',
|
||||
'WEBHOOK_TOKEN' => 'webhook_token',
|
||||
'RS_LOGGER_TOKEN' => 'rs_logger_token'
|
||||
},
|
||||
'env' => {
|
||||
'HUBOT_IRC_USESSL' => 'true',
|
||||
'HUBOT_IRC_NICK' => 'botka',
|
||||
'HUBOT_IRC_REALNAME' => 'botka (kosmos)',
|
||||
'HUBOT_IRC_ROOMS' => '#kosmos,#kosmos-dev,#kosmos-random,#remotestorage,#hackerbeach,#unhosted,#sockethub,#mastodon',
|
||||
'HUBOT_IRC_UNFLOOD' => '100',
|
||||
'HUBOT_AUTH_ADMIN' => 'bkero,raucao',
|
||||
'HUBOT_HELP_REPLY_IN_PRIVATE' => 'true',
|
||||
'REDIS_URL' => 'redis://localhost:6379?botka',
|
||||
'RS_LOGGER_USER' => 'kosmos@5apps.com',
|
||||
'RS_LOGGER_SERVER_NAME' => 'irc.libera.chat',
|
||||
'RS_LOGGER_PUBLIC' => 'true'
|
||||
}
|
||||
},
|
||||
|
||||
node.default['hal8000_xmpp']['http_port'] = 8082
|
||||
node.default['hal8000_xmpp']['domain'] = "hal8000.kosmos.chat"
|
||||
'hal8000_xmpp' => {
|
||||
'repository' => 'https://gitea.kosmos.org/kosmos/hal8000.git',
|
||||
'revision' => 'master',
|
||||
'extras' => 'hal8000_extras',
|
||||
'adapter' => 'hubot-xmpp',
|
||||
'robot_name' => 'hal8000',
|
||||
'http_port' => 8082,
|
||||
'redis' => true,
|
||||
'firewall' => { 'port' => 8082, 'source' => '10.1.1.0/24' },
|
||||
'external_scripts' => %w[
|
||||
hubot-help hubot-redis-brain hubot-rules hubot-incoming-webhook
|
||||
hubot-auth @kredits/hubot-kredits
|
||||
],
|
||||
'secret_env' => {
|
||||
'HUBOT_XMPP_PASSWORD' => 'xmpp_password',
|
||||
'WEBHOOK_TOKEN' => 'webhook_token',
|
||||
'KREDITS_WEBHOOK_TOKEN' => 'kredits_webhook_token',
|
||||
'KREDITS_WALLET_PASSWORD' => 'kredits_wallet_password',
|
||||
'KREDITS_SESSION_SECRET' => 'kredits_session_secret',
|
||||
'KREDITS_GITHUB_KEY' => 'kredits_github_key',
|
||||
'KREDITS_GITHUB_SECRET' => 'kredits_github_secret',
|
||||
'KREDITS_ZOOM_JWT' => 'kredits_zoom_jwt'
|
||||
},
|
||||
'env' => {
|
||||
'HUBOT_XMPP_USERNAME' => 'hal8000@kosmos.org/hubot',
|
||||
'HUBOT_XMPP_ROOMS' => 'kosmos@kosmos.chat,kosmos-dev@kosmos.chat,kredits@kosmos.chat,info@kosmos.chat,ops@kosmos.chat',
|
||||
'HUBOT_AUTH_ADMIN' => '',
|
||||
'HUBOT_HELP_REPLY_IN_PRIVATE' => 'true',
|
||||
'HUBOT_RSS_PRINTSUMMARY' => 'false',
|
||||
'HUBOT_RSS_PRINTERROR' => 'false',
|
||||
'HUBOT_RSS_IRCCOLORS' => 'true',
|
||||
'HUBOT_RSS_HEADER' => 'Update:',
|
||||
'HUBOT_PLUSPLUS_POINTS_TERM' => 'karma,karma',
|
||||
'REDIS_URL' => 'redis://localhost:6379?hal8000_xmpp',
|
||||
# IPFS_API_HOST and KREDITS_PROVIDER_URL are resolved by the default
|
||||
# recipe from node searches (ipfs_gateway / rskj_testnet).
|
||||
'IPFS_API_HOST' => 'localhost',
|
||||
'IPFS_API_PORT' => '5001',
|
||||
'IPFS_API_PROTOCOL' => 'http',
|
||||
'KREDITS_PROVIDER_URL' => 'https://rsk-testnet.kosmos.org',
|
||||
'KREDITS_WEB_URL' => 'https://kredits.kosmos.org',
|
||||
'KREDITS_ROOM' => 'kredits@kosmos.chat',
|
||||
'KREDITS_WALLET_PATH' => 'wallet.json',
|
||||
'KREDITS_MEDIAWIKI_URL' => 'https://wiki.kosmos.org/',
|
||||
'KREDITS_GITHUB_REPO_BLACKLIST' => '67P/test-one-two',
|
||||
'KREDITS_GITEA_REPO_BLACKLIST' => 'kosmos/test-one-two',
|
||||
'KREDITS_GRANT_HOST' => 'hal8000.kosmos.chat',
|
||||
'KREDITS_GRANT_PROTOCOL' => 'https',
|
||||
'KREDITS_ZOOM_MEETING_WHITELIST' => '414901303,82557072771'
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
node.default['wormhole']['http_port'] = 8083
|
||||
|
||||
node.default['hal8000_xmpp']['hubot_scripts'] = [
|
||||
"hubot-help", "hubot-redis-brain", "hubot-rules", "hubot-shipit",
|
||||
"hubot-tell", "hubot-seen", "hubot-incoming-webhook",
|
||||
"hubot-auth", "hubot-schedule", "@kredits/hubot-kredits"
|
||||
# nginx/openresty vhosts that front the bots' HTTP endpoints (webhooks, health).
|
||||
default['kosmos-hubot']['vhosts'] = [
|
||||
{ 'domain' => 'irc-libera-chat.botka.kosmos.chat', 'port' => 8081 },
|
||||
{ 'domain' => 'hal8000.kosmos.chat', 'port' => 8082 }
|
||||
]
|
||||
|
||||
node.default['hal8000_xmpp']['rooms'] = [
|
||||
'kosmos@kosmos.chat',
|
||||
'kosmos-dev@kosmos.chat',
|
||||
'kredits@kosmos.chat',
|
||||
'info@kosmos.chat',
|
||||
'ops@kosmos.chat',
|
||||
]
|
||||
|
||||
node.default['hal8000_xmpp']['auth_admins'] = []
|
||||
|
||||
node.default['hal8000_xmpp']['kredits']['ipfs_host'] = 'localhost'
|
||||
node.default['hal8000_xmpp']['kredits']['ipfs_port'] = '5001'
|
||||
node.default['hal8000_xmpp']['kredits']['ipfs_protocol'] = 'http'
|
||||
node.default['hal8000_xmpp']['kredits']['room'] = 'kredits@kosmos.chat'
|
||||
node.default['hal8000_xmpp']['kredits']['provider_url'] = 'https://rsk-testnet.kosmos.org'
|
||||
node.default['hal8000_xmpp']['kredits']['network_id'] = '31'
|
||||
node.default['hal8000_xmpp']['kredits']['wallet_path'] = 'wallet.json'
|
||||
node.default['hal8000_xmpp']['kredits']['mediawiki_url'] = 'https://wiki.kosmos.org/'
|
||||
node.default['hal8000_xmpp']['kredits']['github_repo_blacklist'] = '67P/test-one-two'
|
||||
node.default['hal8000_xmpp']['kredits']['gitea_repo_blacklist'] = 'kosmos/test-one-two'
|
||||
node.default['hal8000_xmpp']['kredits']['web_url'] = 'https://kredits.kosmos.org'
|
||||
@@ -12,4 +12,4 @@ depends 'kosmos-ipfs'
|
||||
depends 'kosmos_openresty'
|
||||
depends 'firewall'
|
||||
depends 'git'
|
||||
depends 'redisio'
|
||||
depends 'kosmos_redis'
|
||||
@@ -3,5 +3,5 @@
|
||||
# Recipe:: _nodejs
|
||||
#
|
||||
|
||||
node.override["kosmos_nodejs"]["version"] = "16.20.2"
|
||||
node.override["kosmos_nodejs"]["version"] = "22.23.4"
|
||||
include_recipe "kosmos-nodejs"
|
||||
@@ -1,111 +0,0 @@
|
||||
#
|
||||
# Cookbook Name:: kosmos-hubot
|
||||
# Recipe:: botka_irc-libera-chat
|
||||
#
|
||||
|
||||
app_name = "botka_irc-libera-chat"
|
||||
app_path = "/opt/#{app_name}"
|
||||
app_user = "hubot"
|
||||
app_group = "hubot"
|
||||
|
||||
build_essential app_name do
|
||||
compile_time true
|
||||
end
|
||||
|
||||
include_recipe 'redisio::default'
|
||||
include_recipe 'redisio::enable'
|
||||
include_recipe "kosmos-hubot::_user"
|
||||
include_recipe "kosmos-hubot::_nodejs"
|
||||
include_recipe "kosmos-base::firewall"
|
||||
|
||||
credentials = Chef::EncryptedDataBagItem.load('credentials', app_name)
|
||||
|
||||
git app_path do
|
||||
user app_user
|
||||
group app_group
|
||||
repository "https://gitea.kosmos.org/kosmos/botka.git"
|
||||
revision "master"
|
||||
notifies :restart, "systemd_unit[#{app_name}.service]", :delayed
|
||||
end
|
||||
|
||||
file "#{app_path}/external-scripts.json" do
|
||||
mode "0640"
|
||||
owner app_user
|
||||
group app_group
|
||||
content [
|
||||
"hubot-help",
|
||||
"hubot-redis-brain",
|
||||
"hubot-remotestorage-logger",
|
||||
"hubot-web-push-notifications",
|
||||
].to_json
|
||||
end
|
||||
|
||||
execute "npm install" do
|
||||
cwd app_path
|
||||
environment "HOME" => app_path
|
||||
user app_user
|
||||
end
|
||||
|
||||
service_env = {
|
||||
"HUBOT_LOG_LEVEL" => node.chef_environment == "development" ? "debug" : "info",
|
||||
# Node 16 bundles its own CA store, which still trusts the compromised
|
||||
# eMudhra intermediate's root; use the (patched) system trust store instead.
|
||||
"NODE_OPTIONS" => "--use-openssl-ca",
|
||||
"HUBOT_IRC_USESSL" => "true",
|
||||
"HUBOT_IRC_SERVER" => credentials["znc_host"],
|
||||
"HUBOT_IRC_PORT" => credentials["znc_port"],
|
||||
"HUBOT_IRC_NICK" => "botka",
|
||||
"HUBOT_IRC_USERNAME" => credentials['znc_user'],
|
||||
"HUBOT_IRC_PASSWORD" => credentials['znc_password'],
|
||||
"HUBOT_IRC_REALNAME" => "botka (kosmos)",
|
||||
"HUBOT_IRC_ROOMS" => "#kosmos,#kosmos-dev,#kosmos-random,#remotestorage,#hackerbeach,#unhosted,#sockethub,#mastodon",
|
||||
"HUBOT_IRC_UNFLOOD" => "100",
|
||||
"HUBOT_RSS_PRINTSUMMARY" => "false",
|
||||
"HUBOT_RSS_PRINTERROR" => "false",
|
||||
"HUBOT_RSS_IRCCOLORS" => "true",
|
||||
"REDIS_URL" => "redis://localhost:6379/botka",
|
||||
"EXPRESS_PORT" => node[app_name]['http_port'],
|
||||
"HUBOT_AUTH_ADMIN" => "bkero,raucao",
|
||||
"HUBOT_HELP_REPLY_IN_PRIVATE" => "true",
|
||||
"RS_LOGGER_USER" => "kosmos@5apps.com",
|
||||
"RS_LOGGER_TOKEN" => credentials['rs_logger_token'],
|
||||
"RS_LOGGER_SERVER_NAME" => "irc.libera.chat",
|
||||
"RS_LOGGER_PUBLIC" => "true",
|
||||
"GCM_API_KEY" => credentials['gcm_api_key'],
|
||||
"VAPID_SUBJECT" => "https://kosmos.org",
|
||||
"VAPID_PUBLIC_KEY" => credentials['vapid_public_key'],
|
||||
"VAPID_PRIVATE_KEY" => credentials['vapid_private_key']
|
||||
}
|
||||
|
||||
systemd_unit "#{app_name}.service" do
|
||||
content({
|
||||
Unit: {
|
||||
Description: app_name,
|
||||
Requires: "redis@6379.service",
|
||||
After: "redis@6379.service"
|
||||
},
|
||||
|
||||
Service: {
|
||||
ExecStart: "#{app_path}/bin/hubot -a irc",
|
||||
WorkingDirectory: app_path,
|
||||
User: app_user,
|
||||
Group: app_group,
|
||||
Environment: service_env.map { |k, v| "'#{k}=#{v}'" },
|
||||
Restart: 'always'
|
||||
},
|
||||
|
||||
Install: {
|
||||
WantedBy: 'multi-user.target'
|
||||
}
|
||||
})
|
||||
verify false
|
||||
triggers_reload true
|
||||
action [:create, :enable, :start]
|
||||
end
|
||||
|
||||
firewall_rule app_name do
|
||||
port node[app_name]['http_port']
|
||||
source "10.1.1.0/24"
|
||||
protocol :tcp
|
||||
command :allow
|
||||
end
|
||||
@@ -0,0 +1,36 @@
|
||||
#
|
||||
# Cookbook:: kosmos-hubot
|
||||
# Recipe:: default
|
||||
#
|
||||
|
||||
build_essential 'hubot'
|
||||
include_recipe 'git'
|
||||
include_recipe 'kosmos-base::firewall'
|
||||
include_recipe 'kosmos-hubot::_user'
|
||||
include_recipe 'kosmos-hubot::_nodejs'
|
||||
|
||||
# A local Redis provides the brain store for the bots. It is only reachable from
|
||||
# the node itself, and the bots connect without auth.
|
||||
node.override['kosmos_redis']['requirepass'] = false
|
||||
include_recipe 'kosmos_redis::default'
|
||||
|
||||
node['kosmos-hubot']['bots'].each do |app_name, config|
|
||||
# A bot's extras recipe (if any) augments its config before it is declared.
|
||||
include_recipe "kosmos-hubot::#{config['extras']}" if config['extras']
|
||||
|
||||
bot = node['kosmos-hubot']['bots'][app_name]
|
||||
|
||||
kosmos_hubot_bot app_name do
|
||||
repository bot['repository']
|
||||
revision bot['revision'] || 'master'
|
||||
adapter bot['adapter']
|
||||
robot_name bot['robot_name']
|
||||
http_port bot['http_port']
|
||||
redis bot['redis'] || false
|
||||
firewall bot['firewall'] || {}
|
||||
external_scripts bot['external_scripts'] || []
|
||||
env bot['env'] || {}
|
||||
secret_env bot['secret_env'] || {}
|
||||
extra_files bot['extra_files'] || []
|
||||
end
|
||||
end
|
||||
@@ -0,0 +1,48 @@
|
||||
#
|
||||
# Cookbook:: kosmos-hubot
|
||||
# Recipe:: hal8000_extras
|
||||
#
|
||||
# Augments the hal8000 bot with its kredits-specific configuration. Included by
|
||||
# the default recipe before the bot is declared; it only sets node overrides
|
||||
# (no resources of its own).
|
||||
#
|
||||
|
||||
app_name = 'hal8000_xmpp'
|
||||
secrets = data_bag_item('credentials', 'hubot')[app_name]
|
||||
|
||||
# The kredits integration targets the current IPFS gateway and RSK testnet node.
|
||||
ipfs_host = search(:node, 'role:ipfs_gateway').first&.dig('knife_zero', 'host')
|
||||
rsk_host = search(:node, 'role:rskj_testnet').first&.dig('knife_zero', 'host')
|
||||
|
||||
if ipfs_host
|
||||
node.override['kosmos-hubot']['bots'][app_name]['env']['IPFS_API_HOST'] = ipfs_host
|
||||
end
|
||||
if rsk_host
|
||||
node.override['kosmos-hubot']['bots'][app_name]['env']['KREDITS_PROVIDER_URL'] = "http://#{rsk_host}:4444"
|
||||
end
|
||||
|
||||
env = node['kosmos-hubot']['bots'][app_name]['env']
|
||||
|
||||
# @kredits/hubot-kredits reads these from a .env file in its package directory;
|
||||
# it and the Ethereum wallet are written by the bot resource after npm install.
|
||||
node.override['kosmos-hubot']['bots'][app_name]['extra_files'] = [
|
||||
{
|
||||
'path' => 'node_modules/@kredits/hubot-kredits/.env',
|
||||
'mode' => '0600',
|
||||
'content' => <<-EOF
|
||||
GITEA_TOKEN=#{secrets['gitea_token']}
|
||||
GITHUB_TOKEN=#{secrets['github_token']}
|
||||
KREDITS_PROVIDER_URL=#{env['KREDITS_PROVIDER_URL']}
|
||||
IPFS_API_HOST=#{env['IPFS_API_HOST']}
|
||||
IPFS_API_PORT=#{env['IPFS_API_PORT']}
|
||||
IPFS_API_PROTOCOL=#{env['IPFS_API_PROTOCOL']}
|
||||
KREDITS_WALLET_PATH=../../#{env['KREDITS_WALLET_PATH']}
|
||||
KREDITS_WALLET_PASSWORD=#{secrets['kredits_wallet_password']}
|
||||
EOF
|
||||
},
|
||||
{
|
||||
'path' => 'wallet.json',
|
||||
'source' => 'wallet.json',
|
||||
'mode' => '0644'
|
||||
}
|
||||
]
|
||||
@@ -1,140 +0,0 @@
|
||||
#
|
||||
# Cookbook Name:: kosmos-hubot
|
||||
# Recipe:: hal8000_xmpp
|
||||
#
|
||||
|
||||
app_name = "hal8000_xmpp"
|
||||
app_path = "/opt/#{app_name}"
|
||||
app_user = "hubot"
|
||||
app_group = "hubot"
|
||||
|
||||
build_essential app_name do
|
||||
compile_time true
|
||||
end
|
||||
|
||||
include_recipe 'redisio::default'
|
||||
include_recipe 'redisio::enable'
|
||||
include_recipe "kosmos-hubot::_user"
|
||||
include_recipe "kosmos-hubot::_nodejs"
|
||||
include_recipe "kosmos-base::firewall"
|
||||
|
||||
data_bag = Chef::EncryptedDataBagItem.load('credentials', app_name)
|
||||
|
||||
git app_path do
|
||||
user app_user
|
||||
group app_group
|
||||
repository "https://gitea.kosmos.org/kosmos/hal8000.git"
|
||||
revision "master"
|
||||
notifies :restart, "systemd_unit[#{app_name}.service]", :delayed
|
||||
end
|
||||
|
||||
file "#{app_path}/external-scripts.json" do
|
||||
mode "0640"
|
||||
owner app_user
|
||||
group app_group
|
||||
content node[app_name]['hubot_scripts'].to_json
|
||||
end
|
||||
|
||||
execute "npm install" do
|
||||
cwd app_path
|
||||
environment "HOME" => app_path
|
||||
user app_user
|
||||
end
|
||||
|
||||
ipfs_host = search(:node, "role:ipfs_gateway").first["knife_zero"]["host"]
|
||||
node.override[app_name]['kredits']['ipfs_host'] = ipfs_host
|
||||
|
||||
rsk_node_ip = search(:node, "role:rskj_testnet").first["knife_zero"]["host"]
|
||||
node.override[app_name]['kredits']['provider_url'] = "http://#{rsk_node_ip}:4444"
|
||||
|
||||
file "#{app_path}/node_modules/@kredits/hubot-kredits/.env" do
|
||||
mode "0600"
|
||||
owner app_user
|
||||
group app_group
|
||||
content <<-EOF
|
||||
GITEA_TOKEN=#{data_bag['gitea_token']}
|
||||
GITHUB_TOKEN=#{data_bag['github_token']}
|
||||
KREDITS_PROVIDER_URL=#{node[app_name]['kredits']['provider_url']}
|
||||
IPFS_API_HOST=#{node[app_name]['kredits']['ipfs_host']}
|
||||
IPFS_API_PORT=#{node[app_name]['kredits']['ipfs_port']}
|
||||
IPFS_API_PROTOCOL=#{node[app_name]['kredits']['ipfs_protocol']}
|
||||
KREDITS_WALLET_PATH=../../#{node[app_name]['kredits']['wallet_path']}
|
||||
KREDITS_WALLET_PASSWORD=#{data_bag['kredits_wallet_password']}
|
||||
EOF
|
||||
end
|
||||
|
||||
cookbook_file "#{app_path}/wallet.json" do
|
||||
source "wallet.json"
|
||||
end
|
||||
|
||||
service_env = {
|
||||
"HUBOT_LOG_LEVEL" => node.chef_environment == "development" ? "debug" : "info",
|
||||
# Node 16 bundles its own CA store, which still trusts the compromised
|
||||
# eMudhra intermediate's root; use the (patched) system trust store instead.
|
||||
"NODE_OPTIONS" => "--use-openssl-ca",
|
||||
"HUBOT_XMPP_USERNAME" => "hal8000@kosmos.org/hubot",
|
||||
"HUBOT_XMPP_PASSWORD" => data_bag['xmpp_password'],
|
||||
"HUBOT_XMPP_ROOMS" => node[app_name]['rooms'].join(','),
|
||||
"HUBOT_AUTH_ADMIN" => node[app_name]['auth_admins'].join(','),
|
||||
"HUBOT_RSS_PRINTSUMMARY" => "false",
|
||||
"HUBOT_RSS_PRINTERROR" => "false",
|
||||
"HUBOT_RSS_IRCCOLORS" => "true",
|
||||
"HUBOT_PLUSPLUS_POINTS_TERM" => "karma,karma",
|
||||
"HUBOT_RSS_HEADER" => "Update:",
|
||||
"HUBOT_HELP_REPLY_IN_PRIVATE" => "true",
|
||||
"REDIS_URL" => "redis://localhost:6379/#{app_name}",
|
||||
"EXPRESS_PORT" => node[app_name]['http_port'],
|
||||
"WEBHOOK_TOKEN" => data_bag['webhook_token'],
|
||||
"IPFS_API_HOST" => node[app_name]['kredits']['ipfs_host'],
|
||||
"IPFS_API_PORT" => node[app_name]['kredits']['ipfs_port'],
|
||||
"IPFS_API_PROTOCOL" => node[app_name]['kredits']['ipfs_protocol'],
|
||||
"KREDITS_WEB_URL" => node[app_name]['kredits']['web_url'],
|
||||
"KREDITS_ROOM" => node[app_name]['kredits']['room'],
|
||||
"KREDITS_WEBHOOK_TOKEN" => data_bag['kredits_webhook_token'],
|
||||
"KREDITS_PROVIDER_URL" => node[app_name]['kredits']['provider_url'],
|
||||
"KREDITS_WALLET_PATH" => node[app_name]['kredits']['wallet_path'],
|
||||
"KREDITS_WALLET_PASSWORD" => data_bag['kredits_wallet_password'],
|
||||
"KREDITS_MEDIAWIKI_URL" => node[app_name]['kredits']['mediawiki_url'],
|
||||
"KREDITS_GITHUB_REPO_BLACKLIST" => node[app_name]['kredits']['github_repo_blacklist'],
|
||||
"KREDITS_GITEA_REPO_BLACKLIST" => node[app_name]['kredits']['gitea_repo_blacklist'],
|
||||
"KREDITS_GRANT_HOST" => node[app_name]['domain'],
|
||||
"KREDITS_GRANT_PROTOCOL" => "https",
|
||||
"KREDITS_SESSION_SECRET" => data_bag['kredits_session_secret'],
|
||||
"KREDITS_GITHUB_KEY" => data_bag['kredits_github_key'],
|
||||
"KREDITS_GITHUB_SECRET" => data_bag['kredits_github_secret'],
|
||||
"KREDITS_ZOOM_JWT" => data_bag['kredits_zoom_jwt'],
|
||||
"KREDITS_ZOOM_MEETING_WHITELIST" => "414901303,82557072771"
|
||||
}
|
||||
|
||||
systemd_unit "#{app_name}.service" do
|
||||
content({
|
||||
Unit: {
|
||||
Description: app_name,
|
||||
Requires: "redis@6379.service",
|
||||
After: "redis@6379.service"
|
||||
},
|
||||
|
||||
Service: {
|
||||
ExecStart: "#{app_path}/bin/hubot -a xmpp --name hal8000",
|
||||
WorkingDirectory: app_path,
|
||||
User: app_user,
|
||||
Group: app_group,
|
||||
Environment: service_env.map { |k, v| "'#{k}=#{v}'" },
|
||||
Restart: 'always'
|
||||
},
|
||||
|
||||
Install: {
|
||||
WantedBy: 'multi-user.target'
|
||||
}
|
||||
})
|
||||
verify false
|
||||
triggers_reload true
|
||||
action [:create, :enable, :start]
|
||||
end
|
||||
|
||||
firewall_rule app_name do
|
||||
port node[app_name]['http_port']
|
||||
source "10.1.1.0/24"
|
||||
protocol :tcp
|
||||
command :allow
|
||||
end
|
||||
@@ -0,0 +1,26 @@
|
||||
#
|
||||
# Cookbook:: kosmos-hubot
|
||||
# Recipe:: nginx
|
||||
#
|
||||
# Fronts the bots' HTTP endpoints (webhooks, health) via openresty.
|
||||
#
|
||||
|
||||
node['kosmos-hubot']['vhosts'].each do |vhost|
|
||||
domain = vhost['domain']
|
||||
upstream_host = search(:node, 'role:hubot').first['knife_zero']['host']
|
||||
|
||||
tls_cert_for domain do
|
||||
auth 'gandi_dns'
|
||||
acme_domain 'letsencrypt.kosmos.org'
|
||||
action :create
|
||||
end
|
||||
|
||||
openresty_site domain do
|
||||
template 'nginx_conf_hubot.erb'
|
||||
variables express_port: vhost['port'],
|
||||
server_name: domain,
|
||||
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem",
|
||||
upstream_host: upstream_host
|
||||
end
|
||||
end
|
||||
@@ -1,18 +0,0 @@
|
||||
domain = "irc-libera-chat.botka.kosmos.chat"
|
||||
|
||||
upstream_host = search(:node, "role:hubot").first["knife_zero"]["host"]
|
||||
|
||||
tls_cert_for domain do
|
||||
auth "gandi_dns"
|
||||
acme_domain "letsencrypt.kosmos.org"
|
||||
action :create
|
||||
end
|
||||
|
||||
openresty_site domain do
|
||||
template 'nginx_conf_hubot.erb'
|
||||
variables express_port: node['botka_irc-libera-chat']['http_port'],
|
||||
server_name: domain,
|
||||
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem",
|
||||
upstream_host: upstream_host
|
||||
end
|
||||
@@ -1,19 +0,0 @@
|
||||
app_name = "hal8000_xmpp"
|
||||
domain = node[app_name]['domain']
|
||||
|
||||
upstream_host = search(:node, "role:hubot").first["knife_zero"]["host"]
|
||||
|
||||
tls_cert_for domain do
|
||||
auth "gandi_dns"
|
||||
acme_domain "letsencrypt.kosmos.org"
|
||||
action :create
|
||||
end
|
||||
|
||||
openresty_site domain do
|
||||
template 'nginx_conf_hubot.erb'
|
||||
variables express_port: node[app_name]['http_port'],
|
||||
server_name: node[app_name]['domain'],
|
||||
ssl_cert: "/etc/letsencrypt/live/#{node[app_name]['domain']}/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/#{node[app_name]['domain']}/privkey.pem",
|
||||
upstream_host: upstream_host
|
||||
end
|
||||
@@ -0,0 +1,131 @@
|
||||
#
|
||||
# Cookbook:: kosmos-hubot
|
||||
# Resource:: bot
|
||||
#
|
||||
# Sets up a single hubot: git checkout, dependencies, generated
|
||||
# external-scripts.json, and a hardened systemd unit.
|
||||
#
|
||||
|
||||
resource_name :kosmos_hubot_bot
|
||||
provides :kosmos_hubot_bot
|
||||
|
||||
property :app_name, String, name_property: true
|
||||
property :repository, String, required: true
|
||||
property :revision, String, default: 'master'
|
||||
property :adapter, String, required: true
|
||||
property :robot_name, String, required: true
|
||||
property :http_port, Integer
|
||||
property :external_scripts, Array, default: []
|
||||
property :env, Hash, default: {}
|
||||
property :secret_env, Hash, default: {}
|
||||
property :redis, [true, false], default: false
|
||||
property :firewall, Hash, default: {}
|
||||
property :extra_files, Array, default: []
|
||||
|
||||
default_action :create
|
||||
|
||||
action :create do
|
||||
app_name = new_resource.app_name
|
||||
app_path = "/opt/#{app_name}"
|
||||
app_user = 'hubot'
|
||||
app_group = 'hubot'
|
||||
|
||||
secrets = data_bag_item('credentials', 'hubot')[app_name] || {}
|
||||
|
||||
service_env = {
|
||||
'HUBOT_LOG_LEVEL' => node.chef_environment == 'development' ? 'debug' : 'info',
|
||||
# Node bundles its own CA store, which still trusts the compromised eMudhra
|
||||
# intermediate's root; use the (patched) system trust store instead.
|
||||
'NODE_OPTIONS' => '--use-openssl-ca'
|
||||
}
|
||||
service_env['EXPRESS_PORT'] = new_resource.http_port.to_s if new_resource.http_port
|
||||
service_env.merge!(new_resource.env)
|
||||
new_resource.secret_env.each do |env_key, bag_key|
|
||||
service_env[env_key] = secrets[bag_key]
|
||||
end
|
||||
|
||||
git app_path do
|
||||
user app_user
|
||||
group app_group
|
||||
repository new_resource.repository
|
||||
revision new_resource.revision
|
||||
notifies :restart, "systemd_unit[#{app_name}.service]", :delayed
|
||||
end
|
||||
|
||||
execute "npm install (#{app_name})" do
|
||||
cwd app_path
|
||||
user app_user
|
||||
group app_group
|
||||
environment 'HOME' => app_path
|
||||
end
|
||||
|
||||
file "#{app_path}/external-scripts.json" do
|
||||
mode '0640'
|
||||
owner app_user
|
||||
group app_group
|
||||
content new_resource.external_scripts.to_json
|
||||
end
|
||||
|
||||
new_resource.extra_files.each do |f|
|
||||
if f['source']
|
||||
cookbook_file "#{app_path}/#{f['path']}" do
|
||||
source f['source']
|
||||
mode f['mode'] || '0644'
|
||||
owner app_user
|
||||
group app_group
|
||||
end
|
||||
else
|
||||
file "#{app_path}/#{f['path']}" do
|
||||
content f['content']
|
||||
mode f['mode'] || '0644'
|
||||
owner app_user
|
||||
group app_group
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
unit = {
|
||||
Unit: {
|
||||
Description: app_name
|
||||
},
|
||||
Service: {
|
||||
Type: 'simple',
|
||||
User: app_user,
|
||||
Group: app_group,
|
||||
WorkingDirectory: app_path,
|
||||
ExecStart: "#{app_path}/bin/hubot -a #{new_resource.adapter} --name #{new_resource.robot_name}",
|
||||
Environment: service_env.map { |k, v| "'#{k}=#{v}'" },
|
||||
Restart: 'always',
|
||||
RestartSec: '2',
|
||||
TimeoutSec: '10',
|
||||
PrivateTmp: true,
|
||||
ProtectSystem: 'full',
|
||||
NoNewPrivileges: true,
|
||||
PrivateDevices: true
|
||||
},
|
||||
Install: {
|
||||
WantedBy: 'multi-user.target'
|
||||
}
|
||||
}
|
||||
|
||||
if new_resource.redis
|
||||
unit[:Unit][:Requires] = 'redis@6379.service'
|
||||
unit[:Unit][:After] = 'redis@6379.service'
|
||||
end
|
||||
|
||||
systemd_unit "#{app_name}.service" do
|
||||
content unit
|
||||
verify false
|
||||
triggers_reload true
|
||||
action [:create, :enable, :start]
|
||||
end
|
||||
|
||||
if new_resource.firewall && !new_resource.firewall.empty?
|
||||
firewall_rule app_name do
|
||||
port new_resource.firewall['port']
|
||||
source new_resource.firewall['source']
|
||||
protocol new_resource.firewall.fetch('protocol', :tcp)
|
||||
command :allow
|
||||
end
|
||||
end
|
||||
end
|
||||
Reference in new issue
Block a user