kosmos/chef
8
3
Fork 0
Code Issues 38 Pull Requests 2 Projects 2 Activity
930 Commits 9 Branches 0 Tags
1837285b79d79a9d24d89edc16d9d6a8516c5480
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
greg 1837285b79 Add the kosmos_kvm recipe and the firewall rules 
... to the KVM hosts, centaurus and draco

Refs #244
 2020-12-04 16:33:18 +01:00
greg ee7a117d63 Add initial kosmos_zerotier cookbook 
For now it only includes the firewall rule

Refs #244
 2020-12-04 16:29:22 +01:00
greg e6b7794e20 Extract firewall definitions to their own recipe 
This allows us to use them for KVM hosts as well. Until now we had set
up ufw rules manually on the two KVM hosts (draco and centaurus)

Refs #244
 2020-12-04 16:27:42 +01:00
greg 9dbe5bcfcb Deploy a script to create new VMs 
It uses `virt-install` with the official Ubuntu 20.04 cloud image as a
starting point, with cloud-init to add our SSH keys to the ubuntu user
and set up Zerotier.

USAGE: create_vm VMNAME

Closes #244
 2020-12-04 16:21:52 +01:00
greg bbf01711f8 Add ejabberd-1 client and node file 2020-11-25 16:42:23 +01:00
greg fbd71204c2 Use the production run list when no Chef environment was set 2020-11-25 16:41:43 +01:00
greg 613b316588 Add comment about needing to run Chef a second time... 
... after the TLS certs are generated
 2020-11-25 16:36:07 +01:00
greg 3a8af26b5f Remove firewall rule for an unused port 2020-11-25 16:36:07 +01:00
greg 23ca3552d2 Remove the absolute path of certbot to use the new package 2020-11-25 16:36:07 +01:00
greg ddb706b61c Add a missing dependency on kosmos-dirsrv 2020-11-25 16:36:07 +01:00
greg 085bd8abd5 Move TURN port to a different range 
It landed on a port used by PostgreSQL. Also switch STUN/TURN to TCP
because HAProxy does not support UDP.

Closes #240
 2020-11-25 16:36:07 +01:00
greg 7636f6ed19 Move the Gandi DNS certbot hook to kosmos-ejabberd 2020-11-25 16:36:07 +01:00
greg 8b1f90c568 Use the same Erlang cookie to enable clustering 
Refs #243
 2020-11-25 16:35:37 +01:00
greg df4c92b64e Update the centaurus node after adding drone to it 2020-11-19 12:59:24 +01:00
greg d7e54bf7ce Add drone role 2020-11-19 12:59:24 +01:00
greg ebf5f405f5 Initial kosmos_drone cookbook 
Closes #235
 2020-11-19 12:59:15 +01:00
greg 255e43c680 Fix the Systemd unit for discourse 
Switch the systemd unit to a oneshot type
 2020-10-23 09:28:31 +02:00
greg 5062392c71 Fix the undefined variable in the instance resource 2020-10-20 19:53:11 +02:00
greg dc2fe38e10 Add the discourse role to centaurus 2020-10-20 12:22:07 +02:00
greg 07e6da4d33 Add a role for discourse 2020-10-20 12:22:07 +02:00
greg 429b609ac2 Initial kosmos_discourse cookbook 
The systemd unit does not work

Refs #222
 2020-10-20 12:21:53 +02:00
greg 7eaf177bb2 Set the autocreate permission for Mediawiki users 
This allows LDAP sign ins to create an account automatically

Fixes #219
 2020-10-06 15:51:01 +02:00
greg 2119c11243 Do not include kosmos-postgresql in kosmos-ejabberd default recipe 
It will install PostgreSQL, and we do not want that on the ejabberd
server
 2020-09-25 16:29:01 +02:00
greg a8b303af4a Fix the search command for Kosmos LDAP users 2020-09-16 11:36:29 +02:00
gregandbasti e31f480f27 Fix the attribute name 2020-08-16 16:14:18 +02:00
gregandbasti aedf7bcb62 Create the snap mount directory in the user's home 2020-08-16 16:14:18 +02:00
gregandbasti 069246cf41 Create the bitcoind user and its home directory 2020-08-16 16:14:18 +02:00
gregandbasti 1b9a4aad17 Work around a bug in Chef's snap_package resource 
https://github.com/chef/chef/issues/8827

`snap install` returns 0 when a package is already installed, so no need
for a guard clause
 2020-08-16 16:14:17 +02:00
greg 41fd1576ad Override the header template to remove the Roboto font 
Using the system font instead
 2020-07-30 12:33:09 +02:00
greg 924f67d8a8 Update Gitea to 1.12.3 
Closes #189
 2020-07-30 12:16:31 +02:00
greg 5e5bbe07dc Restart gitea after upgrading it 2020-07-30 12:16:04 +02:00
greg 3f7894bd46 Run Chef again after upgrading centaurus to Ubuntu 20.04 
Closes #195
 2020-07-30 11:59:30 +02:00
greg 44b49ddd57 Upgrade nginx to the latest mainline version 2020-07-30 11:58:52 +02:00
greg d2126f6153 Use the right variable for the TLS cert's domain 
`domain` was undefined. `new_resource.hostname` is ldap.kosmos.org and
is what we need

Fixes #193
 2020-07-22 15:59:27 +02:00
greg 4583421597 Connect to the PostgreSQL primary server instead of localhost 
Move the db and user creation to its own recipe

Refs #186
 2020-06-26 15:22:14 +02:00
greg 004a6913b4 Remove dependency to an old PostgreSQL in the Systemd unit 
Refs #186
 2020-06-26 15:22:05 +02:00
greg fb8687b63c Add the postgresql_replica role to draco 2020-06-19 17:33:06 +02:00
greg f7dfffd967 Add the kosmos_encfs recipe to draco 2020-06-19 17:33:06 +02:00
greg 8386dae46f Add the new Hetzner server, draco.kosmos.org 2020-06-19 17:33:06 +02:00
greg 84cf008bac Install vim 2020-06-19 17:30:02 +02:00
greg b4357df471 Enable unattended-upgrades (security and updates repositories) 
... with email notifications on failure and logging with syslog
 2020-06-19 17:30:02 +02:00
greg e7edb5a464 Update apt to 7.3.0 
It now includes unattended-upgrades support
 2020-06-19 17:30:02 +02:00
greg 5e483240c3 Set the Gitea root URL to HTTPS 
It fixes U2F security keys support, that was broken because the protocol
did not match

Fixes #182
 2020-06-12 17:22:34 +02:00
greg ee9c241a4d Add a postgresql_client role 
The role is empty but is used to explicitly define servers that have
access rights to all PostgreSQL databases and users
 2020-06-12 16:54:58 +02:00
greg 6f696d7634 Define access rules in the PostgreSQL primary recipe 
Access is done for the IP of a server for all users and all databases
for ejabberd and gitea
 2020-06-11 18:20:04 +02:00
greg 26097a7584 Use the correct database name for the access rights 2020-06-11 09:00:50 +02:00
greg 1a6ce44758 Create a minimalist ejabberd role for development 
No Let's Encrypt, no backups
 2020-06-10 18:43:34 +02:00
greg 2c21d6255b Add PostgreSQL primary support to the kosmos-ejabberd cookbook 
* Move the PostgreSQL user and database creation to a pg_db recipe
* Generate access rights for the ejabberd servers in the pg_db recipe
* Connect to the PostgreSQL primary instead of localhost

Refs #180
 2020-06-10 18:38:40 +02:00
greg 091a46e972 Do not pass the pgsql_password variable to ejabberd.yml 
The password is only used in the config files for the vhosts
 2020-06-10 18:37:36 +02:00
greg a0db6adaf2 Pass the data_directory to the postgresql_server_conf resource 
Previously we were passing it as an additional config, but it is set by
default. The last value was used, the custom one, so the server still
used the correct file
 2020-06-10 14:41:07 +02:00
greg e3e726097f Do not enable the postgresql@12-main service 
We want it to run only once the encrypted data directory has been
mounted
 2020-06-10 14:41:07 +02:00
greg dba6629869 Use the attribute from the encfs recipe for the data directory 2020-06-10 14:41:03 +02:00
greg 229e9cfbd2 Add the kosmos_encfs recipe to centaurus 2020-06-10 14:40:01 +02:00
greg 1e60722ec4 Create an initial encfs cookbook 
Usage: Add the kosmos_encfs::default recipe to the run list of a node.
Creating the encrypted directory will keep it mounted. After a reboot,
start the encfs service and enter the password:

```
$ systemctl start encfs
encfs password:
```

For now postgresql@12-main is a hardcoded dependency of the encfs
Systemd unit that is automatically started once the user inputs the
correct password. This list of dependency will need to be different for
every server, based on the services it is running
 2020-06-04 19:50:20 +02:00
greg eded62a3ec Merge branch 'master' into feature/pg_encfs 2020-06-04 15:13:53 +02:00
greg ccd49aefa4 Add Gitea to the run lists for Andromeda and Centaurus 2020-06-02 16:19:21 +02:00
greg 759fa52e03 Enable the certbot resource 2020-06-02 16:19:05 +02:00
greg 0f10723c81 Enable secure cookies 2020-06-02 16:18:48 +02:00
greg 55865c526c Add the Let's Encrypt hook dir to the config 
Only enabled when there is no TLS cert. This is already part of the
certbot nginx vhost
 2020-06-02 16:17:34 +02:00
greg 0c502580c2 Fix the condition for the Let's Encrypt cert in the template 
The line contained an extra !
 2020-06-02 16:16:30 +02:00
greg 27845525da Use the same JWT_SECRET as on our previous Gitea 
A different one breaks 2FA
 2020-06-02 12:12:59 +02:00
greg c8e50fd226 Install git, it is a required dependency for Gitea 
I didn't catch it because git is installed by default in the Vagrant box
I used to write the cookbook
 2020-06-02 11:41:19 +02:00
greg 2d6c514257 Add the gitea role 2020-06-02 11:22:10 +02:00
greg 94330f2052 Comment out the COOKIE_SECURE config for now 
We will enable it again after we have a valid TLS cert generated with
Let's Encrypt. It prevents logins using http, and we will need that as
an admin account
 2020-05-28 18:43:31 +02:00
greg baaae695af Merge branch 'master' into feature/147-gitea_cookbook 2020-05-28 15:44:44 +02:00
greg baa0739936 Add the backup recipe 
Also move the Gitea data dir to an attribute
 2020-05-26 15:21:26 +02:00
greg 3332a1b2e8 Write initial README 2020-05-26 15:21:07 +02:00
greg 210c76c479 Fix the name of the Let's Encrypt cert execute resource 
The resource in the notification was invalid, missing the type of
resource (execute)

Fixes #171
 2020-05-26 14:10:47 +02:00
greg 1f0e2ccbdd Move the binary URL to an attribute 2020-05-21 11:51:06 +02:00
greg 51d4d88568 Initial kosmos_gitea cookbook 
The default recipe deploys the gitea binary, generates a config file and
our custom Kosmos label set. The service runs as a Systemd unit.

The pg_db recipe needs to run on the primary PostgreSQL (currently
andromeda).

The backup recipe is empty for now

Refs #147
 2020-05-18 19:39:43 +02:00
greg 20cbc678bc Add a method that returns the PostgreSQL service 2020-05-18 19:38:37 +02:00
greg d0daa9cee7 Add the encryption password for encfs to the data bag 2020-05-15 18:46:24 +02:00
greg d79cdf087b Move the PGPASS environment variable to the execute resource 
That way it does not appear in the list of running processes while the
command is running
 2020-05-15 18:45:12 +02:00
greg 31dc14e88c Fix the firewall rules for PostgreSQL 
I got the source and destination mixed up.
 2020-05-15 18:44:42 +02:00
greg 55b1cbc1d7 Encrypt the Postgresql data dir on the replica (centaurus) 
encfs always runs a configuration assistant when creating a new
volume, so this needs to be done manually:

   systemctl stop postgresql@12-main
   mv /var/lib/postgresql /var/lib/postgresql.old
   encfs /var/lib/postgresql_encrypted /var/lib/postgresql --public
Pick p (paranoia mode) and enter the password from the data bag twice

   mv /var/lib/postgresql/* /var/lib/postgresql/
   systemctl start postgresql@12-main

This is running on centaurus and is mounted automatically on boot by a
system unit

Refs #129
 2020-05-15 18:41:31 +02:00
greg 57f46c6c61 Merge branch 'master' into bugfix/enable_dirsrv 2020-05-15 17:24:04 +02:00
greg b4209fa294 Fix the invalid ACIs on initial creation (for real) 
Follow-up to #156

I found another issue with the initial ACI creation, while creating a
fresh VM. I thought I had fixed it in #156 but I was wrong. This time
the ACIs are really set and the code runs successfully.

The ACIs are set on the suffix, so modifying it is needed

This won't be executed on a server that is already running, this is only
done on the initial setup
 2020-05-15 14:05:35 +02:00
greg 10f0460fd5 Fix startup of the dirsrv@master Systemd unit on boot 
The symlink created by Chef's service resource was wrong. Creating the
correct symlink fixes the automatic startup on boot
 2020-05-15 13:54:34 +02:00
greg bf60f9fca8 Add the Chef client public keys for andromeda and barnard 2020-05-14 15:34:10 +02:00
greg da278822f6 Use the new postgresql_primary role on andromeda 2020-05-14 15:09:33 +02:00
greg 18973fe4f6 Remove the deleted tls property from the resources 2020-05-14 15:09:15 +02:00
greg fbf610a643 Merge branch 'master' into feature/160-postgres_replication 2020-05-14 15:06:00 +02:00
greg 069090bf44 Remove TODOs 
Access rules will not be part of this cookbook, they need to be added to
the cookbooks that use a PostgreSQL database
 2020-05-14 13:15:47 +02:00
greg dd92d6cdb7 Remove deploying the root cert to clients from the README 
We do not want to verify the root cert so this is not needed
 2020-05-14 13:14:42 +02:00
greg 124ee5e6f3 Update the README 2020-05-14 12:36:20 +02:00
greg 0063776297 Remove unused dependencies 2020-05-13 19:11:00 +02:00
greg 8d2ab785fc Use a self-signed TLS certificate for PostgreSQL 2020-05-13 19:10:14 +02:00
greg 84cb3de4a0 Remove outdated comment 
This was the case when the code lived inside of the custom resource
 2020-05-13 19:04:12 +02:00
greg f3f8e47cce Add replication_password to the postgresql credentials 2020-05-13 15:35:34 +02:00
greg 51b23c2f47 Add postgresql roles 2020-05-13 15:35:15 +02:00
greg eb98aa1bac Clarify the firewall and client authentication rules 2020-05-12 16:04:58 +02:00
greg 0180da1aa6 Fix a typo in the README 2020-05-12 15:59:55 +02:00
greg 254f9020ae Enable firewall rules to allow primary/replica to connect 2020-05-12 12:10:10 +02:00
greg 80c7263a72 Upgrade PostgreSQL from 10 to 12 
Refs #160
 2020-05-11 18:26:57 +02:00
greg b22a7e3c0f Update the postgresql upstream cookbook 2020-05-11 18:26:35 +02:00
greg 21119fff08 Add a custom resource to set up PostgreSQL 12 
Supports both primary and replica. The access rules and firewall have to
be set up outside of the custom resource, so they are part of the
recipes instead

Refs #160
 2020-05-11 18:23:11 +02:00
greg 1c920a8cb2 Remove the encryption keys after TLS cert renewal 
This is done with awk, this was the best way I found to perform the
multi-line deletion. It deletes both the AES AND 3DES sections

The keys will be recreated on service restart

https://access.redhat.com/documentation/en-us/red_hat_directory_server/9.0/html/administration_guide/ssl-and-attr-encryption

Closes #152
 2020-04-20 19:11:34 +02:00
greg 5e3c8066f9 Add the missing certbot command to generate the LDAP TLS cert 
This had been done manually on barnard. This will not be executed on
barnard again since the cert exists
 2020-04-20 19:10:15 +02:00
greg d01c9a4d0a Fix the name of the deploy certbot hook 2020-04-20 19:09:43 +02:00
greg 3ca8ab45da Fix the invalid ACIs on initial creation 
This is only executed on initial creation of the instance, the
production one is using these fixed ACIs, this was only an issue with
the setup

The issue was the ACI was set at the wrong level
 2020-04-20 19:00:28 +02:00