From 3c9e58f324931ec4837f4d8aed6e5b87b7009296 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Mon, 2 Nov 2026 11:03:43 +0400 Subject: [PATCH 1/4] Update AGENTS.md --- AGENTS.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index a9d2989..530141d 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -3,6 +3,7 @@ Welcome, AI Agent! This file contains essential context and rules for interacting with the Kosmos Chef repository. Read this carefully before planning or executing any changes. ## 🏢 Project Overview + This repository contains the infrastructure automation code used by Kosmos to provision and configure bare metal servers (KVM hosts) and Ubuntu virtual machines (KVM guests). We use **Chef Infra**, managed locally via **Knife Zero** (agentless Chef), and **Berkshelf** for dependency management. @@ -26,11 +27,13 @@ We use **Chef Infra**, managed locally via **Knife Zero** (agentless Chef), and - Instruct the user to run `berks install` and `berks vendor cookbooks/ --delete` (or run it via the `bash` tool if permitted). 2. **Provisioning (Knife Zero)** - - Bootstrapping and converging nodes is done using `knife zero`. - - *Example:* `knife zero converge name:server-name.kosmos.org` + - Bootstrapping and converging nodes is done using `knife zero`. + - *Example:* `knife zero converge -a knife_zero.host name:gitea-2` + - *Example for a VM host/proxy (different port):* `knife zero converge -p2222 name:fornax` + - *Example for all machines matching a role:* `knife zero converge -p2222 -a knife_zero.host 'role:openresty_proxy'` 3. **Code Style & Conventions** - - Chef recipes, resources, and roles are written in **Ruby**. + - Chef recipes, resources, and roles are written in **Ruby**. - Follow standard Chef and Ruby (RuboCop) idioms. Look at neighboring files in `site-cookbooks/` or `roles/` to match formatting and naming conventions. ## 🚨 Core Directives for AI Agents @@ -38,4 +41,4 @@ We use **Chef Infra**, managed locally via **Knife Zero** (agentless Chef), and 1. **Infrastructure as Code**: Manual server configurations are highly discouraged. All changes must be codified in a cookbook or role. 2. **Test Safety Nets**: Look for `.kitchen.yml` within specific `site-cookbooks/` to understand if local integration tests are available. 3. **No Assumptions**: Do not assume standard test commands. Check `README.md` and repository config files first. -4. **Secret Handling**: Avoid hardcoding passwords or API keys in recipes or roles. Assume sensitive information is managed via Chef `data_bags`. \ No newline at end of file +4. **Secret Handling**: Avoid hardcoding passwords or API keys in recipes or roles. Assume sensitive information is managed via Chef `data_bags`. From 27dd10d2ee1e9d020a57efd0983cb122ceeda37f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Mon, 2 Nov 2026 11:23:26 +0400 Subject: [PATCH 2/4] Upgrade Gitea to 28.3.0, Actions runner to 5.2.4 Gitea 28.1.0 -> 28.3.0 (skipping 28.2.0). Both are maintenance releases with no breaking changes and no app.ini changes. They carry a large set of security fixes: token scope enforcement across many API and web routes, OAuth2 ACCOUNT_LINKING=auto account takeover, review-triggered Actions workflows running with repository secrets, stored XSS via Actions artifact Content-Encoding, SSH certificate principal confusion, OpenID association CSRF, and several private-data leaks in feeds, profiles, project boards and issue timelines. Behavior changes to be aware of, none requiring a cookbook change: git maintenance now defaults to the gc strategy; profile pages treat token requests as anonymous and user/org RSS/Atom feeds require read:user or read:organization; the API rejects changes to issues, labels, milestones and releases of archived repositories; review-triggered workflows run on the pull request head; the gitea-vscode OAuth2 application is pre-registered; email validation is relaxed to what Go's mail.ParseAddress accepts. Gitea Actions runner 5.2.2 -> 5.2.4. No config.yaml changes were required. 5.2.4 fixes the v4 artifact API in exec mode so upload-artifact v4 and later work; 5.2.3 fixes the action header group, dry runs touching the Docker daemon, and damaged shared action cache trees. Checksums verified against the published binaries. --- site-cookbooks/kosmos_gitea/CHANGELOG.md | 24 +++++++++++++++++++ .../kosmos_gitea/attributes/default.rb | 8 +++---- site-cookbooks/kosmos_gitea/metadata.rb | 2 +- 3 files changed, 29 insertions(+), 5 deletions(-) diff --git a/site-cookbooks/kosmos_gitea/CHANGELOG.md b/site-cookbooks/kosmos_gitea/CHANGELOG.md index c6cfb95..3a5f835 100644 --- a/site-cookbooks/kosmos_gitea/CHANGELOG.md +++ b/site-cookbooks/kosmos_gitea/CHANGELOG.md @@ -2,6 +2,30 @@ This file is used to list changes made in each version of the kosmos_gitea cookbook. +# 0.3.5 + +- Upgrade Gitea from 28.1.0 to 28.3.0, skipping 28.2.0. Both are maintenance + releases with no breaking changes and no `app.ini` changes; no configuration + updates were required. +- Security fixes included: token scope enforcement on many API and web routes + (public-only tokens could read private data and, for admins, create + administrators), OAuth2 `ACCOUNT_LINKING = auto` account takeover, review + triggered Actions workflows running with repository secrets, stored XSS via + Actions artifact `Content-Encoding`, SSH certificate principal confusion, + OpenID association CSRF, and several private-data leaks in feeds, profiles, + project boards and issue timelines. +- Behavior changes to be aware of (no cookbook change): `git maintenance` now + defaults to the `gc` strategy; profile pages treat token requests as + anonymous and user/org RSS/Atom feeds require `read:user` / + `read:organization`; the API rejects changes to issues, labels, milestones + and releases of archived repositories; review-triggered workflows run on the + pull request head; the `gitea-vscode` OAuth2 application is pre-registered; + email address validation is relaxed to what Go's `mail.ParseAddress` accepts. +- Upgrade the Gitea Actions runner from 5.2.2 to 5.2.4. No `config.yaml` + changes were required. 5.2.4 fixes the v4 artifact API in `exec` mode so + `upload-artifact` v4 and later work, and 5.2.3 fixes the action header group, + dry runs touching the Docker daemon, and damaged shared action cache trees. + # 0.3.4 - Upgrade the Gitea Actions runner from 5.0.0 to 5.2.2. No `config.yaml` changes diff --git a/site-cookbooks/kosmos_gitea/attributes/default.rb b/site-cookbooks/kosmos_gitea/attributes/default.rb index f7308b8..96fbcb7 100644 --- a/site-cookbooks/kosmos_gitea/attributes/default.rb +++ b/site-cookbooks/kosmos_gitea/attributes/default.rb @@ -1,5 +1,5 @@ -node.default["gitea"]["version"] = "28.1.0" -node.default["gitea"]["checksum"] = "ea93cfa4a300564ac457d3903469fea49ec5a4da37d0cebaa435f8e329ea64d0" +node.default["gitea"]["version"] = "28.3.0" +node.default["gitea"]["checksum"] = "5f834e8f04986f3b9206cf14743b5a6e6996ceddc238dac6409866ebda2a0686" node.default["gitea"]["repo"] = nil node.default["gitea"]["revision"] = nil node.default["gitea"]["working_directory"] = "/var/lib/gitea" @@ -24,8 +24,8 @@ node.default["gitea"]["config"] = { } } -node.default["gitea"]["runner"]["version"] = "5.2.2" -node.default["gitea"]["runner"]["checksum"] = "5a2639fd2a57feeba29a9b1fb0e941489f092a4fa681c7c333c0372731248b63" +node.default["gitea"]["runner"]["version"] = "5.2.4" +node.default["gitea"]["runner"]["checksum"] = "674145e627e5c879d72c293a08991458cf73c81124e54afdd40cf6995098a01b" node.default["gitea"]["runner"]["cache_base_port"] = 8088 node.default["gitea"]["runner"]["config"] = { "runner" => { diff --git a/site-cookbooks/kosmos_gitea/metadata.rb b/site-cookbooks/kosmos_gitea/metadata.rb index a847057..2b17f77 100644 --- a/site-cookbooks/kosmos_gitea/metadata.rb +++ b/site-cookbooks/kosmos_gitea/metadata.rb @@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org' license 'MIT' description 'Installs/configures Gitea' long_description 'Installs/configures Gitea' -version '0.3.4' +version '0.3.5' chef_version '>= 14.0' depends "firewall" From 292c1e92962ed101a33b2395f12c6eb5f7f3869e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Mon, 2 Nov 2026 11:32:16 +0400 Subject: [PATCH 3/4] Update nodes --- nodes | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nodes b/nodes index 3b5019c..8d59d38 160000 --- a/nodes +++ b/nodes @@ -1 +1 @@ -Subproject commit 3b5019c10960d31effb76162c3c353c9e3084d8f +Subproject commit 8d59d3832f6f25c8e5007de01376c260e57c2249 From 8241995fd7c0ef1869083a1b0d61b49b0b6c3e86 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Mon, 2 Nov 2026 11:33:16 +0400 Subject: [PATCH 4/4] Add sockethub-testing node --- nodes | 2 +- roles/sockethub-testing.rb | 21 +++++++++++++++++++++ 2 files changed, 22 insertions(+), 1 deletion(-) create mode 100644 roles/sockethub-testing.rb diff --git a/nodes b/nodes index 8d59d38..0c981ad 160000 --- a/nodes +++ b/nodes @@ -1 +1 @@ -Subproject commit 8d59d3832f6f25c8e5007de01376c260e57c2249 +Subproject commit 0c981ad098ff2f95b64fc68b9f1828fdc448e2de diff --git a/roles/sockethub-testing.rb b/roles/sockethub-testing.rb new file mode 100644 index 0000000..df084c1 --- /dev/null +++ b/roles/sockethub-testing.rb @@ -0,0 +1,21 @@ +name "sockethub-testing" + +default_attributes 'kosmos_redis' => { + 'requirepass' => false +}, +'sockethub' => { + 'about' => { + 'name' => 'Sockethub Test Instance', + 'description' => '', + 'contact' => 'ops@kosmos.org', + 'links' => [], + 'showVersion' => true, + 'showUptime' => true + } +} + +run_list %w( + kosmos_redis::default + sockethub::default + sockethub::firewall +)