kosmos-hubot: scope the nginx upstream to the production environment

search(:node, 'role:hubot') also matched retired nodes outside production
(e.g. nodejs-4 in _default), so the vhosts could proxy to a dead host and
return 502. Restrict the search to chef_environment:production and pick
deterministically.

site-cookbooks/kosmos-hubot/recipes/nginx.rb

@@ -6,8 +6,16 @@
 #
 
 node['kosmos-hubot']['vhosts'].each do |vhost|
-  domain        = vhost['domain']
-  upstream_host = search(:node, 'role:hubot').first['knife_zero']['host']
+  domain = vhost['domain']
+
+  # Restrict to the production environment and pick deterministically, so a
+  # stray node carrying role[hubot] (e.g. a retired one in _default) can't
+  # hijack the upstream.
+  upstream = search(:node, 'role:hubot AND chef_environment:production')
+             .sort_by(&:name).first
+  raise 'No production node with role[hubot] found for the hubot vhosts' unless upstream
+
+  upstream_host = upstream['knife_zero']['host']
 
   tls_cert_for domain do
     auth        'gandi_dns'