kosmos/chef
kosmos/chef
8
3
Fork 0
Code Issues 29 Pull Requests 3 Projects 2 Activity
1,589 Commits 7 Branches 0 Tags
Commit Graph

1589 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Greg Karékinian
6fa89b3c25 Switch the ejabberd LDAP setup to a new application account 
Needs the new directory structure:

```
dn: cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalRole
cn: users

dn: ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
ou: kosmos.org

dn: ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
description: 5apps
ou: 5apps.com

dn: uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: wiki
userPassword: [snip]

dn: uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]

dn: uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]

```

And the new ACIs:

```
dn: ou=5apps.com,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)

dn: ou=kosmos.org,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=wiki,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
```

Refs #140
 2020-02-21 18:03:58 +01:00
gregkare
f34513220e Merge branch 'feature/130-remove_antispam' of kosmos/chef into master 2020-02-20 13:34:15 +00:00
Greg Karékinian
c4fdf1779f Remove the CleanTalk Antispam extension 
It is not needed anymore now that registration is closed and only LDAP
accounts can edit or create pages

Closes #130
 2020-02-20 14:31:39 +01:00
Greg Karékinian
6f7474b4d1 Update the Mediawiki extensions 2020-02-20 14:30:25 +01:00
gregkare
c01f5c1038 Merge branch 'feature/127-new_ldap_dir_structure' of kosmos/chef into master 2020-02-20 13:29:05 +00:00
Greg Karékinian
90a0e6be9f Enable LDAP on the kosmos.org vhost 2020-02-19 12:30:55 +01:00
Greg Karékinian
276daf0ed7 Switch the Mediawiki config to the new LDAP dir structure 
* Use a new read-only account instead of the admin LDAP account
* Disable the LDAPAuthorization plugin. The LDAPAuthentication2 plugin
is still used to authenticate users, but every kosmos.org user has
access to the wiki. See
https://www.mediawiki.org/wiki/Extension:PluggableAuth for the
distinction between authentication and authorization

Refs #127
 2020-02-19 12:29:14 +01:00
Râu Cao
afaff86551 Merge branch 'feature/134-ejabberd_19.05' of kosmos/chef into master 2020-02-17 16:37:13 +00:00
Greg Karékinian
56adfa37fb Fix a warning in the config 
Migrate the web admin to a request handler
 2020-02-17 17:26:55 +01:00
Greg Karékinian
0f9b2777a3 Update ejabberd to 19.05 
Versions from 19.08 to 20.01 contains a blocking bug in the
reload_config command
(https://github.com/processone/ejabberd/issues/3170)

Closes #134
 2020-02-17 17:26:45 +01:00
Râu Cao
e694996ebd Merge branch 'feature/123-ejabberd_5apps' of kosmos/chef into master 2020-02-17 14:41:03 +00:00
Greg Karékinian
c2b2b6f08b Fix the vhost template 
hosts must be defined in the main config file
 2020-02-17 15:04:08 +01:00
Greg Karékinian
72cc6342f1 Remove the unused LDAP variables from the main config file 2020-02-17 13:27:14 +01:00
Greg Karékinian
38f39af2a4 Move each vhost to its own config file 2020-02-17 13:20:54 +01:00
Greg Karékinian
463664448c Merge branch 'master' into feature/123-ejabberd_5apps 2020-02-17 12:21:16 +01:00
Sebastian Kippe
5b86aca5e8
Update andromeda node info 2020-02-15 13:52:00 -05:00
gregkare
585041e36c Merge branch 'bugfix/128-set_acis_on_users' of kosmos/chef into master 2020-02-14 15:47:16 +00:00
Greg Karékinian
55eb95ae73 Verify the TLS server's certificate 
Do not proceed if a certificate is invalid
 2020-02-14 13:56:52 +01:00
Greg Karékinian
dc1226073c Move the admin users to the ejabberd encrypted data bag 2020-02-14 13:56:17 +01:00
Greg Karékinian
49d01991fd Enable LDAP on the XMPP 5apps.com vhost 
Refactor the ejabberd config file to remove hardcoded values about the
vhosts

Refs #123
 2020-02-12 17:40:38 +01:00
Greg Karékinian
e56faab5b1 Set the ACIs on the base DN 
Allow users to change their own password, but nothing else (no search,
no read, no write)

This will only run when setting up the 389-dirsrv instance for the first
time, this has been applied on barnard by editing the dn (see
#128 (comment))

Closes #128
 2020-02-12 16:13:45 +01:00
Greg Karékinian
396cc344fb Switch the ipfs cookbook from GitHub to Gitlab 2020-02-04 16:26:31 +01:00
Râu Cao
628b8c6ef8 Merge branch 'feature/124-enable_cite_extension' of kosmos/chef into master 2020-01-29 14:36:31 +00:00
Greg Karékinian
2a66ff6146 Enable the Cite extension in the MediaWiki config 
This is used to create references as footnotes.
See https://www.mediawiki.org/wiki/Extension:Cite

Closes #124
 2020-01-29 14:30:39 +01:00
Râu Cao
ef29e60403 Merge branch 'feature/107-ldap_mediawiki' of kosmos/chef into master 2020-01-28 17:02:42 +00:00
Greg Karékinian
9ece855902 Remove the config.rb at the root, it interferes with knife-zero 2020-01-28 14:02:34 +01:00
Greg Karékinian
a06ea47e58 Update the LDAPProvider extension 2020-01-28 13:54:57 +01:00
Greg Karékinian
a69192a863 Enable LDAP support on mediawiki 
Users can log in using their LDAP account (in the
ou=users,dc=kosmos,dc=org group and with the wiki attribute set to
enabled)

Add an attribute for the ldap master server, so it can be overridden in
the development environment

Refs #107
 2020-01-24 13:45:17 +01:00
gregkare
484f1306da Merge branch 'chore/default_license' of kosmos/chef into master 2019-12-27 15:32:10 +00:00
Greg Karékinian
d029ee91be Move the generate options to config.rb at the root of the repo 
This has been the only way I managed to make `chef generate cookbook
COOKBOOK_NAME` set the default values

This is not documented, there is an issue open about it:
https://github.com/chef/chef-cli/issues/54
 2019-12-27 11:33:05 +01:00
gregkare
7fd558215d Merge branch 'feature/107-ldap_server' of kosmos/chef into master 2019-12-23 17:50:19 +00:00
gregkare
f3a711ccfe Merge branch 'feature/mediawiki_file_uploads' of kosmos/chef into master 2019-12-20 16:09:10 +00:00
Greg Karékinian
9828b867ba Disable anonymous binds 
See https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.2/html/Administration_Guide/configuring-special-binds.html#disabling-anonymous-binds
 2019-12-20 16:46:03 +01:00
Sebastian Kippe
8d78d41af7
Use MIT as default cookbook license 
And improve the author name, making it more consistent with the rest of
the repo.
 2019-12-18 20:19:42 +01:00
Sebastian Kippe
11c7019bfa
Fix thumbnails not working for larger SVGs 
See linked docs in code comments
 2019-12-13 13:46:57 +01:00
Sebastian Kippe
2358ed00db
Fix wiki permissions 2019-12-13 13:41:48 +01:00
Sebastian Kippe
cbfb760787
Increase wiki file upload size limit 2019-12-13 13:41:48 +01:00
Sebastian Kippe
2158e1d4bf
Allow SVG file uploads 2019-12-13 13:41:48 +01:00
Greg Karékinian
0a96c31e12 Add initial LDAP documentation 2019-12-06 10:54:10 +01:00
Greg Karékinian
1240ed9da8 Move the dirsrv cert generation to a certbot deploy hook 2019-12-05 15:47:10 +01:00
Greg Karékinian
0d192f536f Add the empty nginx vhost template 2019-12-05 15:05:37 +01:00
Greg Karékinian
0dbf350540 Restart the server after importing the TLS cert 2019-12-04 17:40:27 +01:00
Greg Karékinian
5ba700cd00 Add the kosmos-dirsrv recipe to barnard 2019-12-04 17:34:15 +01:00
Greg Karékinian
4e7d453942 Move the firewall and backup recipes outside of the custom resource 
See the comment for more details
 2019-12-04 17:33:41 +01:00
Greg Karékinian
e24cd01287 Add an empty template because the nginx_certbot_site resource needs one 2019-12-04 17:33:13 +01:00
Greg Karékinian
632cb38aab Pass an empty passphrase on the command line for the p12 cert 2019-12-04 17:32:40 +01:00
Greg Karékinian
9d9493af0d Add a missing dependency on the kosmos-nginx cookbook 2019-12-04 17:32:03 +01:00
Greg Karékinian
9e4f12b1b1 Merge branch 'master' into feature/107-ldap_server 2019-12-04 15:52:08 +01:00
gregkare
aecdaabbcc Merge branch 'chore/enable_wiki_editor_toolbar' of kosmos/chef into master 2019-11-29 16:38:08 +00:00
Greg Karékinian
dc91128eca Use a custom resource to create a 389 Directory Server instance 
This replaces the default recipe and will make it much easier to create
other types of instances, for example for replication
 2019-11-29 14:34:52 +01:00