Initial Chef repository

site-cookbooks/kosmos-base/README.md

@@ -0,0 +1,4 @@
+5apps-base Cookbook
+======================
+
+This sets up base behaviour for our servers

site-cookbooks/kosmos-base/metadata.rb

@@ -0,0 +1,16 @@
+name             'kosmos-base'
+maintainer       'Kosmos'
+maintainer_email 'mail@kosmos.org'
+license          'All rights reserved'
+description      'The Kosmos base cookbook'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+version          '0.1.0'
+
+depends 'unattended-upgrades'
+depends 'users'
+depends 'chef-solo-search'
+depends 'sudo'
+depends 'kosmos-postfix'
+depends 'hostname'
+depends 'ufw'
+depends 'omnibus_updater'

site-cookbooks/kosmos-base/recipes/default.rb

@@ -0,0 +1,49 @@
+#
+# Cookbook Name:: kosmos-base
+# Recipe:: default
+#
+# Copyright 2015, Kosmos
+#
+# All rights reserved - Do Not Redistribute
+#
+
+node.override['omnibus_updater']['version']              = '12.4.1'
+node.override['omnibus_updater']['kill_chef_on_upgrade'] = false
+include_recipe 'omnibus_updater'
+
+package 'mailutils'
+node.override['unattended-upgrades']['admin_email'] = 'ops@5apps.com'
+include_recipe 'unattended-upgrades'
+
+package 'ruby2.1'
+package 'ruby2.1-dev'
+
+include_recipe 'users::sysadmins'
+
+node.override['authorization']['sudo']['passwordless'] = true
+include_recipe 'sudo'
+
+include_recipe 'kosmos-postfix'
+
+node.override['set_fqdn'] = '*'
+include_recipe 'hostname'
+
+include_recipe 'kosmos-base::firewall'
+
+package 'ca-certificates'
+
+directory '/usr/local/share/ca-certificates/cacert' do
+  action :create
+end
+
+['http://www.cacert.org/certs/root.crt', 'http://www.cacert.org/certs/class3.crt'].each do |cert|
+  remote_file "/usr/local/share/ca-certificates/cacert/#{File.basename(cert)}" do
+    source cert
+    action :create_if_missing
+    notifies :run, 'execute[update-ca-certificates]', :immediately
+  end
+end
+
+execute 'update-ca-certificates' do
+  action :nothing
+end

site-cookbooks/kosmos-base/recipes/firewall.rb

@@ -0,0 +1,19 @@
+#
+# Cookbook Name:: kosmos-base
+# Recipe:: firewall
+#
+# Copyright 2015, Kosmos
+#
+# All rights reserved - Do Not Redistribute
+#
+
+# enable default firewall
+firewall 'ufw' do
+  action :enable
+end
+
+firewall_rule 'ssh' do
+  port     22
+  protocol :tcp
+  action   :allow
+end

site-cookbooks/kosmos-hubot/README.md

@@ -0,0 +1,4 @@
+kosmos-hubot Cookbook
+=====================
+
+This cookbook sets up our hubots

site-cookbooks/kosmos-hubot/metadata.rb

@@ -0,0 +1,9 @@
+name             'kosmos-hubot'
+maintainer       'Kosmos'
+maintainer_email 'mail@kosmos.org'
+license          'All rights reserved'
+description      'Installs/Configures kosmos-hubot'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+version          '0.1.0'
+
+depends 'kosmos-nodejs'

site-cookbooks/kosmos-hubot/recipes/default.rb

@@ -0,0 +1,96 @@
+#
+# Cookbook Name:: kosmos-hubot
+# Recipe:: default
+#
+# Copyright 2015, Kosmos
+#
+# All rights reserved - Do Not Redistribute
+#
+
+include_recipe "kosmos-nodejs"
+include_recipe "kosmos-redis"
+
+group "hubot" do
+  gid 48268
+end
+
+user "hubot" do
+  comment "hubot user"
+  uid 48268
+  gid 48268
+  shell "/bin/bash"
+  home "/srv/hal8000"
+end
+
+hal8000_freenode_data_bag_item = Chef::EncryptedDataBagItem.load('credentials', 'hal8000_freenode')
+
+application "hal8000" do
+  path "/srv/hal8000"
+  owner "hubot"
+  group "hubot"
+
+  action :deploy
+
+  repository "https://github.com/67P/hal8000.git"
+  revision   "master"
+
+  nodejs do
+    entry_point "/srv/hal8000/current/bin/hubot -a irc"
+    # Use our own systemd service that depends on redis-server
+    template "nodejs.systemd.service.erb"
+    environment "HUBOT_IRC_SERVER"            => "irc.freenode.net",
+                "HUBOT_IRC_ROOMS"             => "#5apps,#67p,#kosmos,#kosmos-dev,#remotestorage,#hackerbeach,#unhosted,#sockethub",
+                "HUBOT_IRC_NICK"              => "hal8000",
+                "HUBOT_IRC_NICKSERV_USERNAME" => "hal8000",
+                "HUBOT_IRC_NICKSERV_PASSWORD" => hal8000_freenode_data_bag_item['nickserv_password'],
+                "HUBOT_IRC_UNFLOOD"           => "100",
+                "HUBOT_RSS_PRINTSUMMARY"      => "false",
+                "HUBOT_RSS_IRCCOLORS"         => "true",
+                # "HUBOT_LOG_LEVEL"             => "error",
+                "EXPRESS_PORT"                => "8080",
+                "HUBOT_RSS_HEADER"            => "Update:",
+                "HUBOT_AUTH_ADMIN"            => "bkero,derbumi,galfert,gregkare,jaaan,slvrbckt,raucao",
+                "RS_LOGGER_USER"              => "kosmos@5apps.com",
+                "RS_LOGGER_TOKEN"             => hal8000_freenode_data_bag_item['rs_logger_token'],
+                "RS_LOGGER_SERVER_NAME"       => "freenode",
+                "RS_LOGGER_PUBLIC"            => "true"
+  end
+end
+
+schlupp_5apps_data_bag_item = Chef::EncryptedDataBagItem.load('credentials', 'schlupp_5apps')
+
+application "schlupp" do
+  path "/srv/schlupp"
+  owner "hubot"
+  group "hubot"
+
+  action :deploy
+
+  repository "https://github.com/67P/hal8000.git"
+  revision   "master"
+
+  nodejs do
+    entry_point "/srv/schlupp/current/bin/hubot -a irc"
+    # Use our own systemd service that depends on redis-server
+    template "nodejs.systemd.service.erb"
+    environment "HUBOT_IRC_SERVER"            => "5apps.irc.grove.io",
+                "HUBOT_IRC_ROOMS"             => "#5ops,#core",
+                "HUBOT_IRC_NICK"              => "schlupp",
+                "HUBOT_IRC_NICKSERV_PASSWORD" => schlupp_5apps_data_bag_item['nickserv_password'],
+                "HUBOT_IRC_PASSWORD"          => "5apps",
+                "HUBOT_IRC_UNFLOOD"           => "100",
+                "HUBOT_RSS_PRINTSUMMARY"      => "false",
+                "HUBOT_RSS_IRCCOLORS"         => "true",
+                "HUBOT_LOG_LEVEL"             => "error",
+                "EXPRESS_PORT"                => "8081",
+                "HUBOT_RSS_HEADER"            => "Update:",
+                "HUBOT_AUTH_ADMIN"            => "galfert,gregkare,basti",
+                "HUBOT_IRC_USESSL"            => "true",
+                "REDIS_URL"                   => "redis://localhost:6379/5apps",
+                "HUBOT_IRC_PORT"              => "6697",
+                "RS_LOGGER_USER"              => "5apps@5apps.com",
+                "RS_LOGGER_TOKEN"             => schlupp_5apps_data_bag_item['rs_logger_token'],
+                "RS_LOGGER_SERVER_NAME"       => "grove-5apps"
+  end
+end
+

site-cookbooks/kosmos-hubot/templates/default/nodejs.systemd.service.erb

@@ -0,0 +1,17 @@
+[Unit]
+Description=Start nodejs app
+Requires=redis-server.service
+After=redis-server.service
+
+[Service]
+ExecStart=<%= @entry %>
+WorkingDirectory=<%= @app_dir %>
+User=<%= @user %>
+Group=<%= @group %>
+<% unless @environment.empty? -%>
+Environment=<% @environment.each do |key, value| -%>'<%= key %>=<%= value %>' <% end %>
+<% end -%>
+Restart=always
+
+[Install]
+WantedBy=multi-user.target

site-cookbooks/kosmos-nginx/README.md

@@ -0,0 +1,4 @@
+kosmos-nginx Cookbook
+=====================
+
+This is a wrapper cookbook for nginx

site-cookbooks/kosmos-nginx/metadata.rb

@@ -0,0 +1,9 @@
+name             'kosmos-nginx'
+maintainer       'Kosmos'
+maintainer_email 'mail@kosmos.org'
+license          'All rights reserved'
+description      'Installs/Configures kosmos-nginx'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+version          '0.1.0'
+
+depends 'nginx'

site-cookbooks/kosmos-nginx/recipes/default.rb

@@ -0,0 +1,32 @@
+#
+# Cookbook Name:: kosmos-nginx
+# Recipe:: default
+#
+# Copyright 2015, Kosmos
+#
+# All rights reserved - Do Not Redistribute
+#
+node.override['nginx']['default_site_enabled'] = false
+node.override['nginx']['server_tokens']        = 'off'
+node.override['nginx']['log_formats']['json']  = <<-EOF
+'{"ip":"$remote_addr",'
+'"time":"$time_local",'
+'"host":"$host",'
+'"method":"$request_method",'
+'"uri":"$uri",'
+'"status":$status,'
+'"size":$body_bytes_sent,'
+'"referer":"$http_referer",'
+'"upstream_addr":"$upstream_addr",'
+'"upstream_response_time":"$upstream_response_time",'
+'"ua":"$http_user_agent"}'
+EOF
+
+
+include_recipe 'nginx'
+
+firewall_rule 'http/https' do
+  port     [80, 443]
+  protocol :tcp
+  action   :allow
+end

site-cookbooks/kosmos-nodejs/README.md

@@ -0,0 +1,68 @@
+kosmos-nodejs Cookbook
+======================
+TODO: Enter the cookbook description here.
+
+e.g.
+This cookbook makes your favorite breakfast sandwich.
+
+Requirements
+------------
+TODO: List your cookbook requirements. Be sure to include any requirements this cookbook has on platforms, libraries, other cookbooks, packages, operating systems, etc.
+
+e.g.
+#### packages
+- `toaster` - kosmos-nodejs needs toaster to brown your bagel.
+
+Attributes
+----------
+TODO: List your cookbook attributes here.
+
+e.g.
+#### kosmos-nodejs::default
+<table>
+  <tr>
+    <th>Key</th>
+    <th>Type</th>
+    <th>Description</th>
+    <th>Default</th>
+  </tr>
+  <tr>
+    <td><tt>['kosmos-nodejs']['bacon']</tt></td>
+    <td>Boolean</td>
+    <td>whether to include bacon</td>
+    <td><tt>true</tt></td>
+  </tr>
+</table>
+
+Usage
+-----
+#### kosmos-nodejs::default
+TODO: Write usage instructions for each cookbook.
+
+e.g.
+Just include `kosmos-nodejs` in your node's `run_list`:
+
+```json
+{
+  "name":"my_node",
+  "run_list": [
+    "recipe[kosmos-nodejs]"
+  ]
+}
+```
+
+Contributing
+------------
+TODO: (optional) If this is a public cookbook, detail the process for contributing. If this is a private cookbook, remove this section.
+
+e.g.
+1. Fork the repository on Github
+2. Create a named feature branch (like `add_component_x`)
+3. Write your change
+4. Write tests for your change (if applicable)
+5. Run the tests, ensuring they all pass
+6. Submit a Pull Request using Github
+
+License and Authors
+-------------------
+Authors: TODO: List authors

site-cookbooks/kosmos-nodejs/metadata.rb

@@ -0,0 +1,7 @@
+name             'kosmos-nodejs'
+maintainer       'Kosmos'
+maintainer_email 'mail@kosmos.org'
+license          'All rights reserved'
+description      'Installs/Configures kosmos-nodejs'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+version          '0.1.0'

site-cookbooks/kosmos-nodejs/recipes/default.rb

@@ -0,0 +1,18 @@
+#
+# Cookbook Name:: kosmos-nodejs
+# Recipe:: default
+#
+# Copyright 2015, Kosmos
+#
+# All rights reserved - Do Not Redistribute
+#
+
+include_recipe 'build-essential'
+node.override['nodejs']['repo'] = 'https://deb.nodesource.com/node_0.12'
+include_recipe 'nodejs::nodejs_from_package'
+
+# Update npm
+nodejs_npm "npm" do
+  version "2.13.0"
+end
+

site-cookbooks/kosmos-postfix/README.md

@@ -0,0 +1,5 @@
+5apps-postfix Cookbook
+======================
+
+This cookbook is a wrapper for the postfix cookbook. It sets up postfix the way
+we like it.

site-cookbooks/kosmos-postfix/metadata.rb

@@ -0,0 +1,9 @@
+name             'kosmos-postfix'
+maintainer       'Kosmos'
+maintainer_email 'mail@kosmos.org'
+license          'All rights reserved'
+description      'A wrapper cookbook for postfix'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+version          '0.1.0'
+
+depends 'postfix'

site-cookbooks/kosmos-postfix/recipes/default.rb

@@ -0,0 +1,23 @@
+#
+# Cookbook Name:: kosmos-postfix
+# Recipe:: default
+#
+# Copyright 2015, Kosmos
+#
+# All rights reserved - Do Not Redistribute
+#
+
+smtp_credentials = Chef::EncryptedDataBagItem.load('credentials', 'smtp')
+
+node.override['postfix']['sasl']['smtp_sasl_user_name']        = smtp_credentials['user_name']
+node.override['postfix']['sasl']['smtp_sasl_passwd']           = smtp_credentials['password']
+node.override['postfix']['sasl_password_file']                 = "#{node['postfix']['conf_dir']}/sasl_passwd"
+# Postfix doesn't support smtps relayhost, use STARTSSL instead
+node.override['postfix']['main']['relayhost']                  = smtp_credentials['relayhost']
+node.override['postfix']['main']['smtp_sasl_auth_enable']      = 'yes'
+node.override['postfix']['main']['smtp_sasl_password_maps']    = "hash:#{node['postfix']['sasl_password_file']}"
+node.override['postfix']['main']['smtp_sasl_security_options'] = 'noanonymous'
+node.override['postfix']['main']['smtp_tls_CAfile']            = '/etc/ssl/certs/ca-certificates.crt'
+node.override['postfix']['main']['smtpd_tls_CAfile']           = '/etc/ssl/certs/ca-certificates.crt'
+
+include_recipe 'postfix::default'

site-cookbooks/kosmos-redis/README.md

@@ -0,0 +1,4 @@
+kosmos-redis Cookbook
+=====================
+
+redis wrapper cookbook

site-cookbooks/kosmos-redis/metadata.rb

@@ -0,0 +1,9 @@
+name             'kosmos-redis'
+maintainer       'Kosmos'
+maintainer_email 'mail@kosmos.org'
+license          'All rights reserved'
+description      'redis wrapper cookbook'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+version          '0.1.0'
+
+depends 'redis'

site-cookbooks/kosmos-redis/recipes/default.rb

@@ -0,0 +1,11 @@
+#
+# Cookbook Name:: kosmos-redis
+# Recipe:: default
+#
+# Copyright 2015, Kosmos
+#
+# All rights reserved - Do Not Redistribute
+#
+
+node.override['redis']['unixsocket'] = ''
+include_recipe 'redis::server'

site-cookbooks/sockethub/CHANGELOG.md

@@ -0,0 +1,13 @@
+sockethub CHANGELOG
+===================
+
+This file is used to list changes made in each version of the sockethub cookbook.
+
+0.1.0
+-----
+- [your_name] - Initial release of sockethub
+
+- - -
+Check the [Markdown Syntax Guide](http://daringfireball.net/projects/markdown/syntax) for help with Markdown.
+
+The [Github Flavored Markdown page](http://github.github.com/github-flavored-markdown/) describes the differences between markdown on github and standard markdown.

site-cookbooks/sockethub/README.md

@@ -0,0 +1,68 @@
+sockethub Cookbook
+==================
+TODO: Enter the cookbook description here.
+
+e.g.
+This cookbook makes your favorite breakfast sandwich.
+
+Requirements
+------------
+TODO: List your cookbook requirements. Be sure to include any requirements this cookbook has on platforms, libraries, other cookbooks, packages, operating systems, etc.
+
+e.g.
+#### packages
+- `toaster` - sockethub needs toaster to brown your bagel.
+
+Attributes
+----------
+TODO: List your cookbook attributes here.
+
+e.g.
+#### sockethub::default
+<table>
+  <tr>
+    <th>Key</th>
+    <th>Type</th>
+    <th>Description</th>
+    <th>Default</th>
+  </tr>
+  <tr>
+    <td><tt>['sockethub']['bacon']</tt></td>
+    <td>Boolean</td>
+    <td>whether to include bacon</td>
+    <td><tt>true</tt></td>
+  </tr>
+</table>
+
+Usage
+-----
+#### sockethub::default
+TODO: Write usage instructions for each cookbook.
+
+e.g.
+Just include `sockethub` in your node's `run_list`:
+
+```json
+{
+  "name":"my_node",
+  "run_list": [
+    "recipe[sockethub]"
+  ]
+}
+```
+
+Contributing
+------------
+TODO: (optional) If this is a public cookbook, detail the process for contributing. If this is a private cookbook, remove this section.
+
+e.g.
+1. Fork the repository on Github
+2. Create a named feature branch (like `add_component_x`)
+3. Write your change
+4. Write tests for your change (if applicable)
+5. Run the tests, ensuring they all pass
+6. Submit a Pull Request using Github
+
+License and Authors
+-------------------
+Authors: TODO: List authors

site-cookbooks/sockethub/attributes/default.rb

@@ -0,0 +1,2 @@
+node.default['sockethub']['port'] = '10551'
+node.default['sockethub']['external_port'] = '10550'

site-cookbooks/sockethub/metadata.rb

@@ -0,0 +1,14 @@
+name             'sockethub'
+maintainer       'Kosmos'
+maintainer_email 'mail@kosmos.org'
+license          'All rights reserved'
+description      'Installs/Configures sockethub'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+version          '0.1.0'
+
+depends 'application'
+depends 'application_nodejs'
+depends 'kosmos-redis'
+depends 'kosmos-nodejs'
+depends 'kosmos-nginx'
+depends 'firewall'

site-cookbooks/sockethub/recipes/default.rb

@@ -0,0 +1,32 @@
+#
+# Cookbook Name:: sockethub
+# Recipe:: default
+#
+# Copyright 2015, Kosmos
+#
+# All rights reserved - Do Not Redistribute
+#
+
+include_recipe 'kosmos-nodejs'
+
+include_recipe 'kosmos-redis'
+
+application "sockethub" do
+  path "/srv/sockethub"
+  owner "www-data"
+  group "www-data"
+
+  action :deploy
+
+  repository 'https://github.com/sockethub/sockethub.git'
+  revision   'experimental_v1_0'
+
+  nodejs do
+    entry_point '/srv/sockethub/current/bin/sockethub'
+    # Use our own systemd service that depends on redis-server
+    template 'nodejs.systemd.service.erb'
+    environment 'DEBUG' => '*',
+                'PORT' => node['sockethub']['port']
+  end
+end
+

site-cookbooks/sockethub/recipes/proxy.rb

@@ -0,0 +1,50 @@
+#
+# Cookbook Name:: sockethub
+# Recipe:: proxy
+#
+# Copyright 2015, Kosmos
+#
+# All rights reserved - Do Not Redistribute
+#
+
+firewall_rule 'sockethub' do
+  port     node['sockethub']['external_port'].to_i
+  protocol :tcp
+  action   :allow
+end
+
+include_recipe 'kosmos-nginx'
+
+data_bag_item = Chef::EncryptedDataBagItem.load('certificates', 'wildcard_kosmos_org')
+
+ssl_cert_path = "/etc/ssl/private/wildcard.kosmos.org.crt"
+file ssl_cert_path do
+  content   data_bag_item['ssl_cert']
+  mode      0600
+  owner     'www-data'
+  sensitive true
+end
+
+ssl_key_path = "/etc/ssl/private/wildcard.kosmos.org.key"
+file ssl_key_path do
+  content   data_bag_item['ssl_key']
+  mode      0600
+  owner     'www-data'
+  sensitive true
+end
+
+template "#{node['nginx']['dir']}/sites-available/sockethub" do
+  source 'nginx_conf_sockethub.erb'
+  owner 'www-data'
+  mode 0640
+  variables sockethub_port:          node['sockethub']['port'],
+            sockethub_external_port: node['sockethub']['external_port'],
+            server_name:             'sockethub.kosmos.org',
+            ssl_cert:                ssl_cert_path,
+            ssl_key:                 ssl_key_path
+  notifies :reload, 'service[nginx]', :delayed
+end
+
+nginx_site 'sockethub' do
+  enable true
+end

site-cookbooks/sockethub/templates/default/nginx_conf_sockethub.erb

@@ -0,0 +1,55 @@
+# Generated by Chef
+upstream _sockethub {
+  server   localhost:<%= @sockethub_port %>;
+}
+
+map $http_upgrade $connection_upgrade {
+  default upgrade;
+  '' close;
+}
+
+server {
+  listen <%= @sockethub_external_port %> ssl spdy;
+  add_header Strict-Transport-Security "max-age=15768000";
+
+  server_name <%= @server_name %>;
+
+  access_log <%= node[:nginx][:log_dir] %>/sockethub.access.log json;
+  error_log <%= node[:nginx][:log_dir] %>/sockethub.error.log warn;
+
+  # We might need real ETags, disable those for now
+  gzip off;
+
+  location / {
+    # an HTTP header important enough to have its own Wikipedia entry:
+    #  http://en.wikipedia.org/wiki/X-Forwarded-For
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+
+    # enable this if and only if you use HTTPS, this helps Rack
+    # set the proper protocol for doing redirects:
+    proxy_set_header X-Forwarded-Proto https;
+
+    # pass the Host: header from the client right along so redirects
+    # can be set properly within the Rack application
+    proxy_set_header Host $http_host;
+
+    # we don't want nginx trying to do something clever with
+    # redirects, we set the Host: header above already.
+    proxy_redirect off;
+
+    # Increase number of buffers. Default is 8
+    proxy_buffers 1024 8k;
+
+    proxy_pass http://_sockethub;
+    proxy_http_version 1.1;
+    # Enable WebSockets
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $connection_upgrade;
+
+    # CORS
+    add_header 'Access-Control-Allow-Origin' '*';
+   }
+
+  ssl_certificate <%= @ssl_cert %>;
+  ssl_certificate_key <%= @ssl_key %>;
+}

site-cookbooks/sockethub/templates/default/nodejs.systemd.service.erb

@@ -0,0 +1,16 @@
+[Unit]
+Description=Start nodejs app
+Requires=redis-server.service
+After=redis-server.service
+
+[Service]
+ExecStart=<%= @entry %>
+User=<%= @user %>
+Group=<%= @group %>
+<% unless @environment.empty? -%>
+Environment=<% @environment.each do |key, value| -%>'<%= key %>=<%= value %>' <% end %>
+<% end -%>
+Restart=always
+
+[Install]
+WantedBy=multi-user.target