kosmos/chef
8
3
Fork 0
Code Issues 34 Pull Requests 3 Projects 2 Activity

Set up fail2ban for nginx, move IPFS gateway to proxy role

Browse Source
This commit is contained in:
Râu Cao
2022-11-22 21:16:27 +01:00
parent 7f545404b1
commit d06f5d7723
33 changed files with 1528 additions and 100 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
site-cookbooks/kosmos-ipfs/recipes/default.rb
View File

@@ -18,7 +18,14 @@ unless node.chef_environment == "development"
end
firewall_rule 'ipfs_api' do
port node['kosmos-ipfs']['api']['port']
port node['kosmos-ipfs']['api_port']
source "10.1.1.0/24"
protocol :tcp
command :allow
end
firewall_rule 'ipfs_gateway' do
port node['kosmos-ipfs']['gateway_port']
source "10.1.1.0/24"
protocol :tcp
command :allow

11
site-cookbooks/kosmos-ipfs/recipes/firewall_public_gateway.rb
View File

@@ -1,11 +0,0 @@
#
# Cookbook Name:: kosmos-ipfs
# Recipe:: firewall_public_gateway
#
include_recipe 'firewall'
firewall_rule 'ipfs_api' do
port node['kosmos-ipfs']['nginx']['external_api_port']
protocol :tcp
command :allow
end

2
site-cookbooks/kosmos-ipfs/recipes/firewall_swarm.rb
View File

@@ -5,7 +5,7 @@
include_recipe 'firewall'
firewall_rule 'ipfs_swarm_p2p' do
port node['kosmos-ipfs']['nginx']['swarm_p2p_port']
port node['kosmos-ipfs']['swarm_p2p_port']
protocol :tcp
command :allow
end

61
site-cookbooks/kosmos-ipfs/recipes/nginx_public_gateway.rb Normal file
View File

@@ -0,0 +1,61 @@
#
# Cookbook Name:: kosmos-ipfs
# Recipe:: nginx_public_gateway
#
include_recipe "kosmos-nginx"
include_recipe 'firewall'
domain = node["kosmos-ipfs"]["nginx"]["domain"]
ipfs_node_ip_addresses = []
search(:node, "role:ipfs_gateway").each do |node|
ipfs_node_ip_addresses << node["knife_zero"]["host"]
end
nginx_certbot_site domain
template "#{node['nginx']['dir']}/sites-available/#{domain}" do
source "nginx_conf_#{domain}.erb"
owner 'www-data'
mode 0640
variables server_name: domain,
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem",
ipfs_api_port: node['kosmos-ipfs']['api_port'],
ipfs_gateway_port: node['kosmos-ipfs']['gateway_port'],
ipfs_external_api_port: node['kosmos-ipfs']['nginx']['external_api_port'],
upstream_hosts: ipfs_node_ip_addresses
notifies :reload, 'service[nginx]', :delayed
end
nginx_site domain do
action :enable
end
firewall_rule 'ipfs_api' do
port node['kosmos-ipfs']['nginx']['external_api_port']
protocol :tcp
command :allow
end
node.normal['fail2ban']['filters'] = {
'nginx-ipfs-404' => {
'failregex' => ['^<HOST> -.*"(GET|POST|PUT|DELETE|OPTIONS|HEAD).*HTTP.*" 404'],
'ignoreregex' => []
}
}
node.normal['fail2ban']['services'] = {
'nginx-ipfs' => {
'enabled' => 'true',
'filter' => 'nginx-ipfs-404',
'logpath' => "/var/log/nginx/#{domain}.access.log",
'maxretry' => '10',
'bantime' => '1440m',
'findtime' => '1440m'
}
}
include_recipe "fail2ban"

53
site-cookbooks/kosmos-ipfs/recipes/public_gateway.rb
View File

@@ -1,53 +0,0 @@
#
# Cookbook Name:: kosmos-ipfs
# Recipe:: public_gateway
#
# The MIT License (MIT)
#
# Copyright:: 2019, Kosmos Developers
#
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
#
# The above copyright notice and this permission notice shall be included in
# all copies or substantial portions of the Software.
#
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
# THE SOFTWARE.
include_recipe "kosmos-nginx"
domain = node["kosmos-ipfs"]["nginx"]["domain"]
template "#{node['nginx']['dir']}/sites-available/#{domain}" do
source "nginx_conf_#{domain}.erb"
owner 'www-data'
mode 0640
variables server_name: domain,
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem",
ipfs_api_port: node['kosmos-ipfs']['nginx']['api_port'],
ipfs_gateway_port: node['kosmos-ipfs']['nginx']['gateway_port'],
ipfs_external_api_port: node['kosmos-ipfs']['nginx']['external_api_port']
notifies :reload, 'service[nginx]', :delayed
end
nginx_site domain do
action :enable
end
nginx_certbot_site domain
unless node.chef_environment == "development"
include_recipe "kosmos-ipfs::firewall_public_gateway"
end