kosmos/chef
8
3
Fork 0
Code Issues 34 Pull Requests 3 Projects 2 Activity

Set up fail2ban for nginx, move IPFS gateway to proxy role

Browse Source
This commit is contained in:
Râu Cao
2022-11-22 21:16:27 +01:00
parent 7f545404b1
commit d06f5d7723
33 changed files with 1528 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
site-cookbooks/kosmos-ipfs/attributes/default.rb
View File

@@ -1,12 +1,19 @@
node.normal['ipfs']['version'] = "0.15.0"
node.normal['ipfs']['checksum'] = "5830ce226956c5e2a2de3a3440704402dd3501c43ec16eeec2d61491317005f2"
node.default['kosmos-ipfs']['api']['port'] = 5001
node.default['kosmos-ipfs']['swarm_p2p_port'] = 4001
node.default['kosmos-ipfs']['api_port'] = 5001
node.default['kosmos-ipfs']['gateway_port'] = 9090
node.default['kosmos-ipfs']['ipfs']['config'] = {
# The default gateway is already used by kosmos' hubot (8080)
"Addresses.Gateway" => "/ip4/127.0.0.1/tcp/9090",
"Addresses.Gateway" => "/ip4/0.0.0.0/tcp/#{node['kosmos-ipfs']['gateway_port']}",
# API with Web UI
"Addresses.API" => "/ip4/0.0.0.0/tcp/5001",
"Addresses.API" => "/ip4/0.0.0.0/tcp/#{node['kosmos-ipfs']['api_port']}",
# Do not fetch/serve anything not pinned/cached on our node
"Gateway.NoFetch" => true,
# Act as DHT client only
"Routing.Type" => "dhtclient",
# Enable bandwith metrics
'Swarm.DisableBandwidthMetrics' => false,
# Disable the p2p-circuit relay transport
@@ -52,10 +59,7 @@ node.default['kosmos-ipfs']['ipfs']['config'] = {
'/ip4/240.0.0.0/ipcidr/4'],
}
node.default['kosmos-ipfs']['nginx']['api_port'] = 5001
node.default['kosmos-ipfs']['nginx']['gateway_port'] = 9090
node.default['kosmos-ipfs']['nginx']['external_api_port'] = 5444
node.default['kosmos-ipfs']['nginx']['swarm_p2p_port'] = 4001
node.default['kosmos-ipfs']['nginx']['domain'] = "ipfs.kosmos.org"
node.default['kosmos-ipfs']['nginx']['external_api_port'] = 5444
node.default['kosmos-ipfs']['kredits-pinner']['revision'] = "v2.1.0"

1
site-cookbooks/kosmos-ipfs/metadata.rb
View File

@@ -7,6 +7,7 @@ long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
version '0.3.0'
depends 'ipfs'
depends 'fail2ban'
depends 'kosmos-base'
depends 'kosmos-nginx'
depends 'kosmos-nodejs'

9
site-cookbooks/kosmos-ipfs/recipes/default.rb
View File

@@ -18,7 +18,14 @@ unless node.chef_environment == "development"
end
firewall_rule 'ipfs_api' do
port node['kosmos-ipfs']['api']['port']
port node['kosmos-ipfs']['api_port']
source "10.1.1.0/24"
protocol :tcp
command :allow
end
firewall_rule 'ipfs_gateway' do
port node['kosmos-ipfs']['gateway_port']
source "10.1.1.0/24"
protocol :tcp
command :allow

11
site-cookbooks/kosmos-ipfs/recipes/firewall_public_gateway.rb
View File

@@ -1,11 +0,0 @@
#
# Cookbook Name:: kosmos-ipfs
# Recipe:: firewall_public_gateway
#
include_recipe 'firewall'
firewall_rule 'ipfs_api' do
port node['kosmos-ipfs']['nginx']['external_api_port']
protocol :tcp
command :allow
end

2
site-cookbooks/kosmos-ipfs/recipes/firewall_swarm.rb
View File

@@ -5,7 +5,7 @@
include_recipe 'firewall'
firewall_rule 'ipfs_swarm_p2p' do
port node['kosmos-ipfs']['nginx']['swarm_p2p_port']
port node['kosmos-ipfs']['swarm_p2p_port']
protocol :tcp
command :allow
end

61
site-cookbooks/kosmos-ipfs/recipes/nginx_public_gateway.rb Normal file
View File

@@ -0,0 +1,61 @@
#
# Cookbook Name:: kosmos-ipfs
# Recipe:: nginx_public_gateway
#
include_recipe "kosmos-nginx"
include_recipe 'firewall'
domain = node["kosmos-ipfs"]["nginx"]["domain"]
ipfs_node_ip_addresses = []
search(:node, "role:ipfs_gateway").each do |node|
ipfs_node_ip_addresses << node["knife_zero"]["host"]
end
nginx_certbot_site domain
template "#{node['nginx']['dir']}/sites-available/#{domain}" do
source "nginx_conf_#{domain}.erb"
owner 'www-data'
mode 0640
variables server_name: domain,
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem",
ipfs_api_port: node['kosmos-ipfs']['api_port'],
ipfs_gateway_port: node['kosmos-ipfs']['gateway_port'],
ipfs_external_api_port: node['kosmos-ipfs']['nginx']['external_api_port'],
upstream_hosts: ipfs_node_ip_addresses
notifies :reload, 'service[nginx]', :delayed
end
nginx_site domain do
action :enable
end
firewall_rule 'ipfs_api' do
port node['kosmos-ipfs']['nginx']['external_api_port']
protocol :tcp
command :allow
end
node.normal['fail2ban']['filters'] = {
'nginx-ipfs-404' => {
'failregex' => ['^<HOST> -.*"(GET|POST|PUT|DELETE|OPTIONS|HEAD).*HTTP.*" 404'],
'ignoreregex' => []
}
}
node.normal['fail2ban']['services'] = {
'nginx-ipfs' => {
'enabled' => 'true',
'filter' => 'nginx-ipfs-404',
'logpath' => "/var/log/nginx/#{domain}.access.log",
'maxretry' => '10',
'bantime' => '1440m',
'findtime' => '1440m'
}
}
include_recipe "fail2ban"

53
site-cookbooks/kosmos-ipfs/recipes/public_gateway.rb
View File

@@ -1,53 +0,0 @@
#
# Cookbook Name:: kosmos-ipfs
# Recipe:: public_gateway
#
# The MIT License (MIT)
#
# Copyright:: 2019, Kosmos Developers
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
include_recipe "kosmos-nginx"
domain = node["kosmos-ipfs"]["nginx"]["domain"]
template "#{node['nginx']['dir']}/sites-available/#{domain}" do
source "nginx_conf_#{domain}.erb"
owner 'www-data'
mode 0640
variables server_name: domain,
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem",
ipfs_api_port: node['kosmos-ipfs']['nginx']['api_port'],
ipfs_gateway_port: node['kosmos-ipfs']['nginx']['gateway_port'],
ipfs_external_api_port: node['kosmos-ipfs']['nginx']['external_api_port']
notifies :reload, 'service[nginx]', :delayed
end
nginx_site domain do
action :enable
end
nginx_certbot_site domain
unless node.chef_environment == "development"
include_recipe "kosmos-ipfs::firewall_public_gateway"
end

23
site-cookbooks/kosmos-ipfs/templates/default/nginx_conf_ipfs.kosmos.org.erb
View File

@@ -1,21 +1,27 @@
upstream _ipfs_gateway {
server localhost:<%= @ipfs_gateway_port %>;
<% @upstream_hosts.each do |host| %>
server <%= host %>:<%= @ipfs_gateway_port %>;
<% end %>
}
upstream _ipfs_api {
server localhost:<%= @ipfs_api_port %>;
<% @upstream_hosts.each do |host| %>
server <%= host %>:<%= @ipfs_api_port %>;
<% end %>
}
limit_req_zone $binary_remote_addr zone=ipfsgateway:10m rate=10r/s;
server {
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
listen 443 ssl http2;
listen [::]:443 ssl http2;
<% else -%>
listen 80;
listen [::]:80;
<% end -%>
server_name ipfs.kosmos.org;
access_log /var/log/nginx/<%= @server_name %>.access.log;
error_log /var/log/nginx/<%= @server_name %>.error.log;
location /ipfs {
limit_req zone=ipfsgateway burst=20 nodelay;
proxy_pass http://_ipfs_gateway/ipfs;
}
@@ -32,6 +38,9 @@ server {
server_name <%= @server_name %>;
access_log /var/log/nginx/<%= @server_name %>.access.log;
error_log /var/log/nginx/<%= @server_name %>.error.log;
location / {
return 200 'Nothing to see here';
add_header Content-Type text/plain;