diff --git a/nodes b/nodes index e37d92d..afffa40 160000 --- a/nodes +++ b/nodes @@ -1 +1 @@ -Subproject commit e37d92dd6cfac5bf6fb8635fef95c1568b15bef5 +Subproject commit afffa4003116baee16fe86539d372c5c63d62e4f diff --git a/roles/hubot.rb b/roles/hubot.rb index f13d5b0..b11b538 100644 --- a/roles/hubot.rb +++ b/roles/hubot.rb @@ -1,8 +1,7 @@ name "hubot" default_run_list = %w( - kosmos-hubot::botka_irc-libera-chat - kosmos-hubot::hal8000_xmpp + kosmos-hubot::default ) env_run_lists( diff --git a/roles/nginx_proxy.rb b/roles/nginx_proxy.rb index bc6cc58..81ef352 100644 --- a/roles/nginx_proxy.rb +++ b/roles/nginx_proxy.rb @@ -29,8 +29,7 @@ default_run_list = %w( kosmos-akkounts::nginx_api kosmos-bitcoin::nginx_lndhub kosmos-ejabberd::nginx - kosmos-hubot::nginx_botka_irc-libera-chat - kosmos-hubot::nginx_hal8000_xmpp + kosmos-hubot::nginx kosmos-ipfs::nginx_public_gateway kosmos-mastodon::nginx remotestorage_discourse::nginx diff --git a/roles/openresty_proxy.rb b/roles/openresty_proxy.rb index c13bbfd..cb41bc5 100644 --- a/roles/openresty_proxy.rb +++ b/roles/openresty_proxy.rb @@ -35,8 +35,7 @@ production_run_list = %w( kosmos-akkounts::nginx kosmos-akkounts::nginx_api kosmos-bitcoin::nginx_lndhub - kosmos-hubot::nginx_botka_irc-libera-chat - kosmos-hubot::nginx_hal8000_xmpp + kosmos-hubot::nginx kosmos-ipfs::nginx_public_gateway kredits-github::nginx_proxy kosmos-mastodon::nginx diff --git a/site-cookbooks/kosmos-hubot/README.md b/site-cookbooks/kosmos-hubot/README.md index 7781499..630613b 100644 --- a/site-cookbooks/kosmos-hubot/README.md +++ b/site-cookbooks/kosmos-hubot/README.md @@ -1,4 +1,31 @@ kosmos-hubot Cookbook ===================== -This cookbook sets up our hubots +Sets up our [hubot](https://hubot.github.com/) bots. + +## Layout + +- `attributes/default.rb` — declares every bot in + `node['kosmos-hubot']['bots']` (keyed by `app_name`) and the openresty + vhosts in `node['kosmos-hubot']['vhosts']`. +- `resources/bot.rb` — the `kosmos_hubot_bot` resource: git checkout, + `npm install`, generated `external-scripts.json`, extra files, a hardened + systemd unit, and an optional firewall rule. +- `recipes/default.rb` — shared setup (`build_essential`, git, the `hubot` + user, Node, Redis, firewall) and a loop over the bots. +- `recipes/nginx.rb` — creates the vhosts on the proxy nodes. +- `recipes/hal8000_extras.rb` — augments the hal8000 bot's config (searched + IPFS/RSK hosts, kredits `.env`, wallet); included by `recipes/default.rb` + before the bot is declared. + +## Adding a bot + +Add an entry to `node['kosmos-hubot']['bots']` (repository, adapter, +robot_name, http_port, external_scripts, env/secret_env, …) and, if it exposes +an HTTP endpoint, a vhost entry. No recipe, role or node changes required. + +## Secrets + +Service environment secrets come from the encrypted `credentials/hubot` data +bag, keyed by `app_name`. `secret_env` maps a service env var to a key within +that bot's hash. diff --git a/site-cookbooks/kosmos-hubot/attributes/default.rb b/site-cookbooks/kosmos-hubot/attributes/default.rb index bfac99f..5f696be 100644 --- a/site-cookbooks/kosmos-hubot/attributes/default.rb +++ b/site-cookbooks/kosmos-hubot/attributes/default.rb @@ -1,36 +1,102 @@ -node.default['hal8000']['http_port'] = 8080 +# Per-bot configuration for the hubot role. +# +# Each entry is keyed by app_name and consumed by the `kosmos_hubot_bot` +# resource. Secrets are resolved from the encrypted `credentials/hubot` data +# bag, keyed by app_name; `secret_env` maps a service env var to a key within +# that bot's hash. `adapter` is passed to hubot as `-a` (the adapter module +# name, e.g. "@hubot-friends/hubot-irc" or "hubot-xmpp"). -node.default['botka_irc-libera-chat']['http_port'] = 8081 +default['kosmos-hubot']['bots'] = { + 'botka_irc-libera-chat' => { + 'repository' => 'https://gitea.kosmos.org/kosmos/botka.git', + 'revision' => 'master', + 'adapter' => '@hubot-friends/hubot-irc', + 'robot_name' => 'botka', + 'http_port' => 8081, + 'redis' => true, + 'firewall' => { 'port' => 8081, 'source' => '10.1.1.0/24' }, + 'external_scripts' => %w[ + hubot-help hubot-incoming-webhook hubot-redis-brain + hubot-remotestorage-logger + ], + 'secret_env' => { + 'HUBOT_IRC_SERVER' => 'znc_host', + 'HUBOT_IRC_PORT' => 'znc_port', + 'HUBOT_IRC_USERNAME' => 'znc_user', + 'HUBOT_IRC_PASSWORD' => 'znc_password', + 'WEBHOOK_TOKEN' => 'webhook_token', + 'RS_LOGGER_TOKEN' => 'rs_logger_token' + }, + 'env' => { + 'HUBOT_IRC_USESSL' => 'true', + 'HUBOT_IRC_NICK' => 'botka', + 'HUBOT_IRC_REALNAME' => 'botka (kosmos)', + 'HUBOT_IRC_ROOMS' => '#kosmos,#kosmos-dev,#kosmos-random,#remotestorage,#hackerbeach,#unhosted,#sockethub,#mastodon', + 'HUBOT_IRC_UNFLOOD' => '100', + 'HUBOT_AUTH_ADMIN' => 'bkero,raucao', + 'HUBOT_HELP_REPLY_IN_PRIVATE' => 'true', + 'REDIS_URL' => 'redis://localhost:6379?botka', + 'RS_LOGGER_USER' => 'kosmos@5apps.com', + 'RS_LOGGER_SERVER_NAME' => 'irc.libera.chat', + 'RS_LOGGER_PUBLIC' => 'true' + } + }, -node.default['hal8000_xmpp']['http_port'] = 8082 -node.default['hal8000_xmpp']['domain'] = "hal8000.kosmos.chat" + 'hal8000_xmpp' => { + 'repository' => 'https://gitea.kosmos.org/kosmos/hal8000.git', + 'revision' => 'master', + 'extras' => 'hal8000_extras', + 'adapter' => 'hubot-xmpp', + 'robot_name' => 'hal8000', + 'http_port' => 8082, + 'redis' => true, + 'firewall' => { 'port' => 8082, 'source' => '10.1.1.0/24' }, + 'external_scripts' => %w[ + hubot-help hubot-redis-brain hubot-rules hubot-incoming-webhook + hubot-auth @kredits/hubot-kredits + ], + 'secret_env' => { + 'HUBOT_XMPP_PASSWORD' => 'xmpp_password', + 'WEBHOOK_TOKEN' => 'webhook_token', + 'KREDITS_WEBHOOK_TOKEN' => 'kredits_webhook_token', + 'KREDITS_WALLET_PASSWORD' => 'kredits_wallet_password', + 'KREDITS_SESSION_SECRET' => 'kredits_session_secret', + 'KREDITS_GITHUB_KEY' => 'kredits_github_key', + 'KREDITS_GITHUB_SECRET' => 'kredits_github_secret', + 'KREDITS_ZOOM_JWT' => 'kredits_zoom_jwt' + }, + 'env' => { + 'HUBOT_XMPP_USERNAME' => 'hal8000@kosmos.org/hubot', + 'HUBOT_XMPP_ROOMS' => 'kosmos@kosmos.chat,kosmos-dev@kosmos.chat,kredits@kosmos.chat,info@kosmos.chat,ops@kosmos.chat', + 'HUBOT_AUTH_ADMIN' => '', + 'HUBOT_HELP_REPLY_IN_PRIVATE' => 'true', + 'HUBOT_RSS_PRINTSUMMARY' => 'false', + 'HUBOT_RSS_PRINTERROR' => 'false', + 'HUBOT_RSS_IRCCOLORS' => 'true', + 'HUBOT_RSS_HEADER' => 'Update:', + 'HUBOT_PLUSPLUS_POINTS_TERM' => 'karma,karma', + 'REDIS_URL' => 'redis://localhost:6379?hal8000_xmpp', + # IPFS_API_HOST and KREDITS_PROVIDER_URL are resolved by the default + # recipe from node searches (ipfs_gateway / rskj_testnet). + 'IPFS_API_HOST' => 'localhost', + 'IPFS_API_PORT' => '5001', + 'IPFS_API_PROTOCOL' => 'http', + 'KREDITS_PROVIDER_URL' => 'https://rsk-testnet.kosmos.org', + 'KREDITS_WEB_URL' => 'https://kredits.kosmos.org', + 'KREDITS_ROOM' => 'kredits@kosmos.chat', + 'KREDITS_WALLET_PATH' => 'wallet.json', + 'KREDITS_MEDIAWIKI_URL' => 'https://wiki.kosmos.org/', + 'KREDITS_GITHUB_REPO_BLACKLIST' => '67P/test-one-two', + 'KREDITS_GITEA_REPO_BLACKLIST' => 'kosmos/test-one-two', + 'KREDITS_GRANT_HOST' => 'hal8000.kosmos.chat', + 'KREDITS_GRANT_PROTOCOL' => 'https', + 'KREDITS_ZOOM_MEETING_WHITELIST' => '414901303,82557072771' + } + } +} -node.default['wormhole']['http_port'] = 8083 - -node.default['hal8000_xmpp']['hubot_scripts'] = [ - "hubot-help", "hubot-redis-brain", "hubot-rules", "hubot-shipit", - "hubot-tell", "hubot-seen", "hubot-incoming-webhook", - "hubot-auth", "hubot-schedule", "@kredits/hubot-kredits" +# nginx/openresty vhosts that front the bots' HTTP endpoints (webhooks, health). +default['kosmos-hubot']['vhosts'] = [ + { 'domain' => 'irc-libera-chat.botka.kosmos.chat', 'port' => 8081 }, + { 'domain' => 'hal8000.kosmos.chat', 'port' => 8082 } ] - -node.default['hal8000_xmpp']['rooms'] = [ - 'kosmos@kosmos.chat', - 'kosmos-dev@kosmos.chat', - 'kredits@kosmos.chat', - 'info@kosmos.chat', - 'ops@kosmos.chat', -] - -node.default['hal8000_xmpp']['auth_admins'] = [] - -node.default['hal8000_xmpp']['kredits']['ipfs_host'] = 'localhost' -node.default['hal8000_xmpp']['kredits']['ipfs_port'] = '5001' -node.default['hal8000_xmpp']['kredits']['ipfs_protocol'] = 'http' -node.default['hal8000_xmpp']['kredits']['room'] = 'kredits@kosmos.chat' -node.default['hal8000_xmpp']['kredits']['provider_url'] = 'https://rsk-testnet.kosmos.org' -node.default['hal8000_xmpp']['kredits']['network_id'] = '31' -node.default['hal8000_xmpp']['kredits']['wallet_path'] = 'wallet.json' -node.default['hal8000_xmpp']['kredits']['mediawiki_url'] = 'https://wiki.kosmos.org/' -node.default['hal8000_xmpp']['kredits']['github_repo_blacklist'] = '67P/test-one-two' -node.default['hal8000_xmpp']['kredits']['gitea_repo_blacklist'] = 'kosmos/test-one-two' -node.default['hal8000_xmpp']['kredits']['web_url'] = 'https://kredits.kosmos.org' diff --git a/site-cookbooks/kosmos-hubot/metadata.rb b/site-cookbooks/kosmos-hubot/metadata.rb index f3be70f..ea897eb 100644 --- a/site-cookbooks/kosmos-hubot/metadata.rb +++ b/site-cookbooks/kosmos-hubot/metadata.rb @@ -12,4 +12,4 @@ depends 'kosmos-ipfs' depends 'kosmos_openresty' depends 'firewall' depends 'git' -depends 'redisio' +depends 'kosmos_redis' diff --git a/site-cookbooks/kosmos-hubot/recipes/_nodejs.rb b/site-cookbooks/kosmos-hubot/recipes/_nodejs.rb index 366e3ae..c7db821 100644 --- a/site-cookbooks/kosmos-hubot/recipes/_nodejs.rb +++ b/site-cookbooks/kosmos-hubot/recipes/_nodejs.rb @@ -3,5 +3,5 @@ # Recipe:: _nodejs # -node.override["kosmos_nodejs"]["version"] = "16.20.2" +node.override["kosmos_nodejs"]["version"] = "22.23.4" include_recipe "kosmos-nodejs" diff --git a/site-cookbooks/kosmos-hubot/recipes/botka_irc-libera-chat.rb b/site-cookbooks/kosmos-hubot/recipes/botka_irc-libera-chat.rb deleted file mode 100644 index a7340d4..0000000 --- a/site-cookbooks/kosmos-hubot/recipes/botka_irc-libera-chat.rb +++ /dev/null @@ -1,111 +0,0 @@ -# -# Cookbook Name:: kosmos-hubot -# Recipe:: botka_irc-libera-chat -# - -app_name = "botka_irc-libera-chat" -app_path = "/opt/#{app_name}" -app_user = "hubot" -app_group = "hubot" - -build_essential app_name do - compile_time true -end - -include_recipe 'redisio::default' -include_recipe 'redisio::enable' -include_recipe "kosmos-hubot::_user" -include_recipe "kosmos-hubot::_nodejs" -include_recipe "kosmos-base::firewall" - -credentials = Chef::EncryptedDataBagItem.load('credentials', app_name) - -git app_path do - user app_user - group app_group - repository "https://gitea.kosmos.org/kosmos/botka.git" - revision "master" - notifies :restart, "systemd_unit[#{app_name}.service]", :delayed -end - -file "#{app_path}/external-scripts.json" do - mode "0640" - owner app_user - group app_group - content [ - "hubot-help", - "hubot-redis-brain", - "hubot-remotestorage-logger", - "hubot-web-push-notifications", - ].to_json -end - -execute "npm install" do - cwd app_path - environment "HOME" => app_path - user app_user -end - -service_env = { - "HUBOT_LOG_LEVEL" => node.chef_environment == "development" ? "debug" : "info", - # Node 16 bundles its own CA store, which still trusts the compromised - # eMudhra intermediate's root; use the (patched) system trust store instead. - "NODE_OPTIONS" => "--use-openssl-ca", - "HUBOT_IRC_USESSL" => "true", - "HUBOT_IRC_SERVER" => credentials["znc_host"], - "HUBOT_IRC_PORT" => credentials["znc_port"], - "HUBOT_IRC_NICK" => "botka", - "HUBOT_IRC_USERNAME" => credentials['znc_user'], - "HUBOT_IRC_PASSWORD" => credentials['znc_password'], - "HUBOT_IRC_REALNAME" => "botka (kosmos)", - "HUBOT_IRC_ROOMS" => "#kosmos,#kosmos-dev,#kosmos-random,#remotestorage,#hackerbeach,#unhosted,#sockethub,#mastodon", - "HUBOT_IRC_UNFLOOD" => "100", - "HUBOT_RSS_PRINTSUMMARY" => "false", - "HUBOT_RSS_PRINTERROR" => "false", - "HUBOT_RSS_IRCCOLORS" => "true", - "REDIS_URL" => "redis://localhost:6379/botka", - "EXPRESS_PORT" => node[app_name]['http_port'], - "HUBOT_AUTH_ADMIN" => "bkero,raucao", - "HUBOT_HELP_REPLY_IN_PRIVATE" => "true", - "RS_LOGGER_USER" => "kosmos@5apps.com", - "RS_LOGGER_TOKEN" => credentials['rs_logger_token'], - "RS_LOGGER_SERVER_NAME" => "irc.libera.chat", - "RS_LOGGER_PUBLIC" => "true", - "GCM_API_KEY" => credentials['gcm_api_key'], - "VAPID_SUBJECT" => "https://kosmos.org", - "VAPID_PUBLIC_KEY" => credentials['vapid_public_key'], - "VAPID_PRIVATE_KEY" => credentials['vapid_private_key'] -} - -systemd_unit "#{app_name}.service" do - content({ - Unit: { - Description: app_name, - Requires: "redis@6379.service", - After: "redis@6379.service" - }, - - Service: { - ExecStart: "#{app_path}/bin/hubot -a irc", - WorkingDirectory: app_path, - User: app_user, - Group: app_group, - Environment: service_env.map { |k, v| "'#{k}=#{v}'" }, - Restart: 'always' - }, - - Install: { - WantedBy: 'multi-user.target' - } - }) - verify false - triggers_reload true - action [:create, :enable, :start] -end - -firewall_rule app_name do - port node[app_name]['http_port'] - source "10.1.1.0/24" - protocol :tcp - command :allow -end diff --git a/site-cookbooks/kosmos-hubot/recipes/default.rb b/site-cookbooks/kosmos-hubot/recipes/default.rb new file mode 100644 index 0000000..afc986f --- /dev/null +++ b/site-cookbooks/kosmos-hubot/recipes/default.rb @@ -0,0 +1,36 @@ +# +# Cookbook:: kosmos-hubot +# Recipe:: default +# + +build_essential 'hubot' +include_recipe 'git' +include_recipe 'kosmos-base::firewall' +include_recipe 'kosmos-hubot::_user' +include_recipe 'kosmos-hubot::_nodejs' + +# A local Redis provides the brain store for the bots. It is only reachable from +# the node itself, and the bots connect without auth. +node.override['kosmos_redis']['requirepass'] = false +include_recipe 'kosmos_redis::default' + +node['kosmos-hubot']['bots'].each do |app_name, config| + # A bot's extras recipe (if any) augments its config before it is declared. + include_recipe "kosmos-hubot::#{config['extras']}" if config['extras'] + + bot = node['kosmos-hubot']['bots'][app_name] + + kosmos_hubot_bot app_name do + repository bot['repository'] + revision bot['revision'] || 'master' + adapter bot['adapter'] + robot_name bot['robot_name'] + http_port bot['http_port'] + redis bot['redis'] || false + firewall bot['firewall'] || {} + external_scripts bot['external_scripts'] || [] + env bot['env'] || {} + secret_env bot['secret_env'] || {} + extra_files bot['extra_files'] || [] + end +end diff --git a/site-cookbooks/kosmos-hubot/recipes/hal8000_extras.rb b/site-cookbooks/kosmos-hubot/recipes/hal8000_extras.rb new file mode 100644 index 0000000..0fff9c0 --- /dev/null +++ b/site-cookbooks/kosmos-hubot/recipes/hal8000_extras.rb @@ -0,0 +1,48 @@ +# +# Cookbook:: kosmos-hubot +# Recipe:: hal8000_extras +# +# Augments the hal8000 bot with its kredits-specific configuration. Included by +# the default recipe before the bot is declared; it only sets node overrides +# (no resources of its own). +# + +app_name = 'hal8000_xmpp' +secrets = data_bag_item('credentials', 'hubot')[app_name] + +# The kredits integration targets the current IPFS gateway and RSK testnet node. +ipfs_host = search(:node, 'role:ipfs_gateway').first&.dig('knife_zero', 'host') +rsk_host = search(:node, 'role:rskj_testnet').first&.dig('knife_zero', 'host') + +if ipfs_host + node.override['kosmos-hubot']['bots'][app_name]['env']['IPFS_API_HOST'] = ipfs_host +end +if rsk_host + node.override['kosmos-hubot']['bots'][app_name]['env']['KREDITS_PROVIDER_URL'] = "http://#{rsk_host}:4444" +end + +env = node['kosmos-hubot']['bots'][app_name]['env'] + +# @kredits/hubot-kredits reads these from a .env file in its package directory; +# it and the Ethereum wallet are written by the bot resource after npm install. +node.override['kosmos-hubot']['bots'][app_name]['extra_files'] = [ + { + 'path' => 'node_modules/@kredits/hubot-kredits/.env', + 'mode' => '0600', + 'content' => <<-EOF +GITEA_TOKEN=#{secrets['gitea_token']} +GITHUB_TOKEN=#{secrets['github_token']} +KREDITS_PROVIDER_URL=#{env['KREDITS_PROVIDER_URL']} +IPFS_API_HOST=#{env['IPFS_API_HOST']} +IPFS_API_PORT=#{env['IPFS_API_PORT']} +IPFS_API_PROTOCOL=#{env['IPFS_API_PROTOCOL']} +KREDITS_WALLET_PATH=../../#{env['KREDITS_WALLET_PATH']} +KREDITS_WALLET_PASSWORD=#{secrets['kredits_wallet_password']} + EOF + }, + { + 'path' => 'wallet.json', + 'source' => 'wallet.json', + 'mode' => '0644' + } +] diff --git a/site-cookbooks/kosmos-hubot/recipes/hal8000_xmpp.rb b/site-cookbooks/kosmos-hubot/recipes/hal8000_xmpp.rb deleted file mode 100644 index 6c8b2d7..0000000 --- a/site-cookbooks/kosmos-hubot/recipes/hal8000_xmpp.rb +++ /dev/null @@ -1,140 +0,0 @@ -# -# Cookbook Name:: kosmos-hubot -# Recipe:: hal8000_xmpp -# - -app_name = "hal8000_xmpp" -app_path = "/opt/#{app_name}" -app_user = "hubot" -app_group = "hubot" - -build_essential app_name do - compile_time true -end - -include_recipe 'redisio::default' -include_recipe 'redisio::enable' -include_recipe "kosmos-hubot::_user" -include_recipe "kosmos-hubot::_nodejs" -include_recipe "kosmos-base::firewall" - -data_bag = Chef::EncryptedDataBagItem.load('credentials', app_name) - -git app_path do - user app_user - group app_group - repository "https://gitea.kosmos.org/kosmos/hal8000.git" - revision "master" - notifies :restart, "systemd_unit[#{app_name}.service]", :delayed -end - -file "#{app_path}/external-scripts.json" do - mode "0640" - owner app_user - group app_group - content node[app_name]['hubot_scripts'].to_json -end - -execute "npm install" do - cwd app_path - environment "HOME" => app_path - user app_user -end - -ipfs_host = search(:node, "role:ipfs_gateway").first["knife_zero"]["host"] -node.override[app_name]['kredits']['ipfs_host'] = ipfs_host - -rsk_node_ip = search(:node, "role:rskj_testnet").first["knife_zero"]["host"] -node.override[app_name]['kredits']['provider_url'] = "http://#{rsk_node_ip}:4444" - -file "#{app_path}/node_modules/@kredits/hubot-kredits/.env" do - mode "0600" - owner app_user - group app_group - content <<-EOF -GITEA_TOKEN=#{data_bag['gitea_token']} -GITHUB_TOKEN=#{data_bag['github_token']} -KREDITS_PROVIDER_URL=#{node[app_name]['kredits']['provider_url']} -IPFS_API_HOST=#{node[app_name]['kredits']['ipfs_host']} -IPFS_API_PORT=#{node[app_name]['kredits']['ipfs_port']} -IPFS_API_PROTOCOL=#{node[app_name]['kredits']['ipfs_protocol']} -KREDITS_WALLET_PATH=../../#{node[app_name]['kredits']['wallet_path']} -KREDITS_WALLET_PASSWORD=#{data_bag['kredits_wallet_password']} - EOF -end - -cookbook_file "#{app_path}/wallet.json" do - source "wallet.json" -end - -service_env = { - "HUBOT_LOG_LEVEL" => node.chef_environment == "development" ? "debug" : "info", - # Node 16 bundles its own CA store, which still trusts the compromised - # eMudhra intermediate's root; use the (patched) system trust store instead. - "NODE_OPTIONS" => "--use-openssl-ca", - "HUBOT_XMPP_USERNAME" => "hal8000@kosmos.org/hubot", - "HUBOT_XMPP_PASSWORD" => data_bag['xmpp_password'], - "HUBOT_XMPP_ROOMS" => node[app_name]['rooms'].join(','), - "HUBOT_AUTH_ADMIN" => node[app_name]['auth_admins'].join(','), - "HUBOT_RSS_PRINTSUMMARY" => "false", - "HUBOT_RSS_PRINTERROR" => "false", - "HUBOT_RSS_IRCCOLORS" => "true", - "HUBOT_PLUSPLUS_POINTS_TERM" => "karma,karma", - "HUBOT_RSS_HEADER" => "Update:", - "HUBOT_HELP_REPLY_IN_PRIVATE" => "true", - "REDIS_URL" => "redis://localhost:6379/#{app_name}", - "EXPRESS_PORT" => node[app_name]['http_port'], - "WEBHOOK_TOKEN" => data_bag['webhook_token'], - "IPFS_API_HOST" => node[app_name]['kredits']['ipfs_host'], - "IPFS_API_PORT" => node[app_name]['kredits']['ipfs_port'], - "IPFS_API_PROTOCOL" => node[app_name]['kredits']['ipfs_protocol'], - "KREDITS_WEB_URL" => node[app_name]['kredits']['web_url'], - "KREDITS_ROOM" => node[app_name]['kredits']['room'], - "KREDITS_WEBHOOK_TOKEN" => data_bag['kredits_webhook_token'], - "KREDITS_PROVIDER_URL" => node[app_name]['kredits']['provider_url'], - "KREDITS_WALLET_PATH" => node[app_name]['kredits']['wallet_path'], - "KREDITS_WALLET_PASSWORD" => data_bag['kredits_wallet_password'], - "KREDITS_MEDIAWIKI_URL" => node[app_name]['kredits']['mediawiki_url'], - "KREDITS_GITHUB_REPO_BLACKLIST" => node[app_name]['kredits']['github_repo_blacklist'], - "KREDITS_GITEA_REPO_BLACKLIST" => node[app_name]['kredits']['gitea_repo_blacklist'], - "KREDITS_GRANT_HOST" => node[app_name]['domain'], - "KREDITS_GRANT_PROTOCOL" => "https", - "KREDITS_SESSION_SECRET" => data_bag['kredits_session_secret'], - "KREDITS_GITHUB_KEY" => data_bag['kredits_github_key'], - "KREDITS_GITHUB_SECRET" => data_bag['kredits_github_secret'], - "KREDITS_ZOOM_JWT" => data_bag['kredits_zoom_jwt'], - "KREDITS_ZOOM_MEETING_WHITELIST" => "414901303,82557072771" -} - -systemd_unit "#{app_name}.service" do - content({ - Unit: { - Description: app_name, - Requires: "redis@6379.service", - After: "redis@6379.service" - }, - - Service: { - ExecStart: "#{app_path}/bin/hubot -a xmpp --name hal8000", - WorkingDirectory: app_path, - User: app_user, - Group: app_group, - Environment: service_env.map { |k, v| "'#{k}=#{v}'" }, - Restart: 'always' - }, - - Install: { - WantedBy: 'multi-user.target' - } - }) - verify false - triggers_reload true - action [:create, :enable, :start] -end - -firewall_rule app_name do - port node[app_name]['http_port'] - source "10.1.1.0/24" - protocol :tcp - command :allow -end diff --git a/site-cookbooks/kosmos-hubot/recipes/nginx.rb b/site-cookbooks/kosmos-hubot/recipes/nginx.rb new file mode 100644 index 0000000..0afc8ae --- /dev/null +++ b/site-cookbooks/kosmos-hubot/recipes/nginx.rb @@ -0,0 +1,26 @@ +# +# Cookbook:: kosmos-hubot +# Recipe:: nginx +# +# Fronts the bots' HTTP endpoints (webhooks, health) via openresty. +# + +node['kosmos-hubot']['vhosts'].each do |vhost| + domain = vhost['domain'] + upstream_host = search(:node, 'role:hubot').first['knife_zero']['host'] + + tls_cert_for domain do + auth 'gandi_dns' + acme_domain 'letsencrypt.kosmos.org' + action :create + end + + openresty_site domain do + template 'nginx_conf_hubot.erb' + variables express_port: vhost['port'], + server_name: domain, + ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem", + ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem", + upstream_host: upstream_host + end +end diff --git a/site-cookbooks/kosmos-hubot/recipes/nginx_botka_irc-libera-chat.rb b/site-cookbooks/kosmos-hubot/recipes/nginx_botka_irc-libera-chat.rb deleted file mode 100644 index 3d028c2..0000000 --- a/site-cookbooks/kosmos-hubot/recipes/nginx_botka_irc-libera-chat.rb +++ /dev/null @@ -1,18 +0,0 @@ -domain = "irc-libera-chat.botka.kosmos.chat" - -upstream_host = search(:node, "role:hubot").first["knife_zero"]["host"] - -tls_cert_for domain do - auth "gandi_dns" - acme_domain "letsencrypt.kosmos.org" - action :create -end - -openresty_site domain do - template 'nginx_conf_hubot.erb' - variables express_port: node['botka_irc-libera-chat']['http_port'], - server_name: domain, - ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem", - ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem", - upstream_host: upstream_host -end diff --git a/site-cookbooks/kosmos-hubot/recipes/nginx_hal8000_xmpp.rb b/site-cookbooks/kosmos-hubot/recipes/nginx_hal8000_xmpp.rb deleted file mode 100644 index 072760e..0000000 --- a/site-cookbooks/kosmos-hubot/recipes/nginx_hal8000_xmpp.rb +++ /dev/null @@ -1,19 +0,0 @@ -app_name = "hal8000_xmpp" -domain = node[app_name]['domain'] - -upstream_host = search(:node, "role:hubot").first["knife_zero"]["host"] - -tls_cert_for domain do - auth "gandi_dns" - acme_domain "letsencrypt.kosmos.org" - action :create -end - -openresty_site domain do - template 'nginx_conf_hubot.erb' - variables express_port: node[app_name]['http_port'], - server_name: node[app_name]['domain'], - ssl_cert: "/etc/letsencrypt/live/#{node[app_name]['domain']}/fullchain.pem", - ssl_key: "/etc/letsencrypt/live/#{node[app_name]['domain']}/privkey.pem", - upstream_host: upstream_host -end diff --git a/site-cookbooks/kosmos-hubot/resources/bot.rb b/site-cookbooks/kosmos-hubot/resources/bot.rb new file mode 100644 index 0000000..b1318db --- /dev/null +++ b/site-cookbooks/kosmos-hubot/resources/bot.rb @@ -0,0 +1,131 @@ +# +# Cookbook:: kosmos-hubot +# Resource:: bot +# +# Sets up a single hubot: git checkout, dependencies, generated +# external-scripts.json, and a hardened systemd unit. +# + +resource_name :kosmos_hubot_bot +provides :kosmos_hubot_bot + +property :app_name, String, name_property: true +property :repository, String, required: true +property :revision, String, default: 'master' +property :adapter, String, required: true +property :robot_name, String, required: true +property :http_port, Integer +property :external_scripts, Array, default: [] +property :env, Hash, default: {} +property :secret_env, Hash, default: {} +property :redis, [true, false], default: false +property :firewall, Hash, default: {} +property :extra_files, Array, default: [] + +default_action :create + +action :create do + app_name = new_resource.app_name + app_path = "/opt/#{app_name}" + app_user = 'hubot' + app_group = 'hubot' + + secrets = data_bag_item('credentials', 'hubot')[app_name] || {} + + service_env = { + 'HUBOT_LOG_LEVEL' => node.chef_environment == 'development' ? 'debug' : 'info', + # Node bundles its own CA store, which still trusts the compromised eMudhra + # intermediate's root; use the (patched) system trust store instead. + 'NODE_OPTIONS' => '--use-openssl-ca' + } + service_env['EXPRESS_PORT'] = new_resource.http_port.to_s if new_resource.http_port + service_env.merge!(new_resource.env) + new_resource.secret_env.each do |env_key, bag_key| + service_env[env_key] = secrets[bag_key] + end + + git app_path do + user app_user + group app_group + repository new_resource.repository + revision new_resource.revision + notifies :restart, "systemd_unit[#{app_name}.service]", :delayed + end + + execute "npm install (#{app_name})" do + cwd app_path + user app_user + group app_group + environment 'HOME' => app_path + end + + file "#{app_path}/external-scripts.json" do + mode '0640' + owner app_user + group app_group + content new_resource.external_scripts.to_json + end + + new_resource.extra_files.each do |f| + if f['source'] + cookbook_file "#{app_path}/#{f['path']}" do + source f['source'] + mode f['mode'] || '0644' + owner app_user + group app_group + end + else + file "#{app_path}/#{f['path']}" do + content f['content'] + mode f['mode'] || '0644' + owner app_user + group app_group + end + end + end + + unit = { + Unit: { + Description: app_name + }, + Service: { + Type: 'simple', + User: app_user, + Group: app_group, + WorkingDirectory: app_path, + ExecStart: "#{app_path}/bin/hubot -a #{new_resource.adapter} --name #{new_resource.robot_name}", + Environment: service_env.map { |k, v| "'#{k}=#{v}'" }, + Restart: 'always', + RestartSec: '2', + TimeoutSec: '10', + PrivateTmp: true, + ProtectSystem: 'full', + NoNewPrivileges: true, + PrivateDevices: true + }, + Install: { + WantedBy: 'multi-user.target' + } + } + + if new_resource.redis + unit[:Unit][:Requires] = 'redis@6379.service' + unit[:Unit][:After] = 'redis@6379.service' + end + + systemd_unit "#{app_name}.service" do + content unit + verify false + triggers_reload true + action [:create, :enable, :start] + end + + if new_resource.firewall && !new_resource.firewall.empty? + firewall_rule app_name do + port new_resource.firewall['port'] + source new_resource.firewall['source'] + protocol new_resource.firewall.fetch('protocol', :tcp) + command :allow + end + end +end