From e53df92b577488486ffee1c5e93b0b4a44c37ce7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Wed, 28 Oct 2026 17:07:11 +0400 Subject: [PATCH] kosmos-hubot: scope the nginx upstream to the production environment search(:node, 'role:hubot') also matched retired nodes outside production (e.g. nodejs-4 in _default), so the vhosts could proxy to a dead host and return 502. Restrict the search to chef_environment:production and pick deterministically. --- site-cookbooks/kosmos-hubot/recipes/nginx.rb | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/site-cookbooks/kosmos-hubot/recipes/nginx.rb b/site-cookbooks/kosmos-hubot/recipes/nginx.rb index 0afc8ae..279ef16 100644 --- a/site-cookbooks/kosmos-hubot/recipes/nginx.rb +++ b/site-cookbooks/kosmos-hubot/recipes/nginx.rb @@ -6,8 +6,16 @@ # node['kosmos-hubot']['vhosts'].each do |vhost| - domain = vhost['domain'] - upstream_host = search(:node, 'role:hubot').first['knife_zero']['host'] + domain = vhost['domain'] + + # Restrict to the production environment and pick deterministically, so a + # stray node carrying role[hubot] (e.g. a retired one in _default) can't + # hijack the upstream. + upstream = search(:node, 'role:hubot AND chef_environment:production') + .sort_by(&:name).first + raise 'No production node with role[hubot] found for the hubot vhosts' unless upstream + + upstream_host = upstream['knife_zero']['host'] tls_cert_for domain do auth 'gandi_dns'