kosmos/chef
8
3
Fork 0
Code Issues 38 Pull Requests 1 Projects 2 Activity
635 Commits 7 Branches 0 Tags
4c1666cde6829887a7f6f858379ac7675f4d0c4b
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
greg 4c1666cde6 Merge branch 'master' into feature/107-ldap 2019-11-04 19:18:26 +01:00
greg 0cb0879a55 Add LDAP support to mastodon 
Users can log in with their account in the database, or with an LDAP
account in the cn=greg,ou=users,dc=kosmos,dc=org group, with the
mastodon attribute set to enabled
 2019-11-04 19:07:13 +01:00
greg ab37a6a24e Add LDAP support to mediawiki 
Users can log in if they have an account in the database, or using their
LDAP account (in the cn=greg,ou=users,dc=kosmos,dc=org group and with
the wiki attribute set to enabled
 2019-11-04 19:07:13 +01:00
greg ef79434cb5 Only set up Tor when not in the dev environment 2019-11-04 19:07:13 +01:00
greg 786a71cee2 Add LDAP support to ejabberd 
Users in the cn=greg,ou=users,dc=kosmos,dc=org group and the xmpp
attribute set to enabled will be able to log in using their userPassword
 2019-11-04 19:07:13 +01:00
greg 56817c9355 Initial version of the kosmos-dirsrv cookbook 
It sets up 389 Directory Server, including a TLS cert acquired using
Let's Encrypt in production (that requires ldap.kosmos.org pointing to
the server's IP)
 2019-11-04 19:07:13 +01:00
greg 0b579b1fea Remove the redirection from HTTP to HTTPS from the mastodon vhost 
This is already done in the certbot vhost
(https://gitea.kosmos.org/kosmos/chef/src/branch/master/site-cookbooks/kosmos-nginx/templates/default/nginx_conf_certbot.erb)
and it redirects every request to HTTPS, breaking Let's Encrypt
validation

Fixes #110
 2019-10-28 11:18:31 +01:00
greg 2c20fa4a2f Fix the nginx vhost for akkounts-api 
Listening on port 80 when there is no TLS cert prevented Let's Encrypt
to generate a cert
 2019-10-18 13:26:04 +02:00
greg 2104e81250 Add the kosmos-akkounts::nginx recipe to kosmos-akkounts::default 2019-10-18 12:30:26 +02:00
greg 6bb93eb5f5 Fix the path to index.js 2019-10-18 12:27:33 +02:00
greg c5eeab3606 Remove typescript and the compilation step 
The app is now compiled during the release phase:
https://github.com/67P/akkounts-api/pull/6
 2019-10-18 12:24:47 +02:00
greg 9ecf40e72a Add dummy encrypted data bag secret 
TODO: replace them with the actual secrets
 2019-10-17 14:58:07 +02:00
greg 185982ff9f Add the initial kosmos-akkounts cookbook to deploy akkounts-api 
Includes a recipe to set up nginx as a reverse proxy with a TLS
certificate for api.accounts.kosmos.org

Closes #18
Closes #20
 2019-10-17 14:56:48 +02:00
greg a32f34b408 Vendor the external cookbooks 
Knife-Zero doesn't include Berkshelf support, so vendoring everything in
the repo is convenient again
 2019-10-13 19:17:42 +02:00
greg f4bfe31ac1 Update the node files after running Knife-Zero 2019-10-10 12:52:10 +02:00
greg ebcb700eaf Add the command to update Chef Client 2019-10-10 12:43:47 +02:00
greg 67c9ea621c Add the latest bootstrap command to the README 2019-10-10 12:37:14 +02:00
greg 8fdafa1484 Set attribute whitelists for Knife-Zero 
This prevents all attributes to be written in the node files. We don't
want that data stored in git.
See https://knife-zero.github.io/40_configuration/
 2019-10-10 12:34:55 +02:00
greg f5858a8a6e Remove unneeded setting 
In Chef 15 local_mode is enough
 2019-10-10 12:34:08 +02:00
greg a7aa38805c Merge branch 'master' into feature/103-chef_15 2019-10-09 13:04:05 +02:00
greg aa66743166 Set a low Java heap size in development 2019-10-08 18:23:27 +02:00
greg bf010b943a Add commented recipes to the run list 2019-10-08 18:22:51 +02:00
greg 7f57caddf9 Update Chef to 15.3.14 in the Vagrant config 
Add the switch to accept the license
 2019-10-08 18:22:11 +02:00
greg 6ea0498490 Get rid of the vagrant-berkshelf plugin 
It has been abandoned by its creators
 2019-10-08 18:20:57 +02:00
greg 585374861d Update the README for Knife-Zero 2019-10-08 18:17:57 +02:00
greg b633205d6d Update poise-javascript to support Chef 15 2019-10-08 18:17:34 +02:00
greg 0b9ab63a61 Update Chef to 15.3.14 2019-10-08 18:17:34 +02:00
greg 20f6e9e04d Delete config for knife-solo 2019-10-08 18:17:34 +02:00
greg 3c05f172de Add the cookbooks dir to the load path for Knife-Zero 2019-10-08 18:17:34 +02:00
greg 2c2ae596ed Don't update chef using the chef_client_updater cookbook 
It only makes sense when using Chef Server, which we don't
 2019-10-08 18:17:34 +02:00
greg 34d69dbca1 Add missing application_javascript dependency 2019-09-27 11:07:15 +02:00
greg 286b9ab574 Add the java cookbook, delete application_ruby 2019-09-27 11:00:01 +02:00
greg 3be9b2fb44 Update yarn to the latest version 2019-09-27 10:57:58 +02:00
greg 438c5ff72d Fix the services restarting every time the recipe is executed 
* Manually send a restart action from the application_git resource
* Do not depend on application_ruby anymore
 2019-09-27 10:57:35 +02:00
greg 4b39ea60dd Set the NODE_ENV variable when running yarn 
The assets precompilation task runs yarn with NODE_ENV=production,
before this change yarn would install a different set of packages, with
this change the run from the assets precompilation is idempotent
 2019-09-27 10:55:32 +02:00
greg b1cfa6f6f7 Install Java for Elasticsearch 
It was missing from the recipe
 2019-09-27 10:51:26 +02:00
greg dace5672e4 Move the java heap size to an attribute 2019-09-27 10:50:56 +02:00
greg 9d68d3c4da Link to the new ops Mastodon account 2019-09-19 16:02:41 +02:00
greg cd9a7dd3dc Use the new kosmos.chat MUC domain on the maintenance page 2019-09-19 16:00:01 +02:00
greg f49dd5e6d4 Switch the MUC host for kosmos.org to kosmos.chat 2019-09-19 15:58:53 +02:00
greg 544f4b78f4 Change the MUC domain for the kosmos.org XMPP server to kosmos.chat 2019-09-19 15:57:54 +02:00
greg 4685b16573 Add kosmos.chat to the list of Kosmos XMPP domains with a TLS cert 2019-09-19 15:56:49 +02:00
greg 2ecc128abd Move the hidden service attributes to the attributes file 
When it is set in the recipe the hidden service dir doesn't get set
correctly (nil), resulting in a broken torrc file
 2019-09-11 13:47:42 +02:00
greg fdb4353ac0 Raise the memory limit for Elasticsearch 2019-09-11 11:21:10 +02:00
greg 245392c4ad Install Elasticsearch 6.8.2 
Version 7 isn't compatible with Mastodon yet
 2019-09-10 12:29:24 +02:00
greg efa958a374 Merge branch 'master' into feature/96-elasticsearch_mastodon 2019-09-09 16:20:46 +02:00
greg 039da3d35a Install Elasticsearch and enable it in Mastodon 
Refs #96
 2019-09-06 17:26:06 +02:00
greg dfa709c9df Update nginx to 1.17.3, enable TLS 1.3 
Uses the current intermediate recommended config from
https://ssl-config.mozilla.org

Closes #92
 2019-08-30 11:57:38 +02:00
greg 1eaffd1309 Update go-ipfs to 0.4.22 
Part of the 0.4.1 version of the ipfs cookbook

Closes #85
 2019-08-14 13:04:08 +02:00
greg 0fa9e6cbb7 Set the uploads dir inside of /opt/ejabberd instead of /var/www 
/var/www is intended for nginx/apache

I have copied over the old directories manually on Andromeda before
running this code

Fixes #80
 2019-07-19 12:47:42 +02:00
greg ab09dd81b4 Update the ipfs cookbook to 0.4.0 2019-07-05 16:02:23 +02:00
greg 666ba1e6f6 Override node attributes for andromeda and barnard 2019-07-05 15:39:47 +02:00
greg 9c8befc179 Move attributes from the ipfs cookbook to kosmos-ipfs 
The default attributes set in the ipfs cookbook do not include
attributes that are specific to Kosmos anymore
 2019-07-05 15:38:30 +02:00
greg cf4e567dcb Get rid of the letsencrypt recipe 
Its content has been moved to the public_gateway recipe
 2019-07-04 10:24:33 +02:00
greg 80526e3396 Switch to our own fork of the poise-javascript cookbook 
Includes passing the `--no-audit` switch to `npm install` to prevent the
`npm_install` resource to consider the command resulted in changes,
causing the service to restart at every Chef run. npm returns the
expected string "up to date" when not performing the security audit

Closes #5
 2019-06-21 17:36:18 +02:00
greg 3a693efcd6 Add email notifications for failed certbot runs 
Based on https://wiki.archlinux.org/index.php/Systemd/Timers#MAILTO

This can easily be used by other services, with one line added to the
[Unit] section of a service:

OnFailure=status-email-ops@%n.service

Refs #3
 2019-06-20 12:46:27 +02:00
greg b01985ec4f Fix the permissions for the ejabberd upload folders 2019-06-14 16:38:49 +02:00
greg 283f623fee Add mastodon role 2019-06-14 15:49:29 +02:00
greg 339f32c957 Simplify the instructions to get the cluster secret 2019-05-28 13:05:52 +02:00
greg 7905ed4402 Remove unused staging node 2019-05-21 15:00:01 +02:00
greg aa79297387 Remove unused data bags and cookbooks 2019-05-21 14:58:01 +02:00
greg b10c53cce8 Remove the database and mysql2_chef_gem cookbooks 2019-05-21 14:57:29 +02:00
greg 12ab8dc33b Stop depending on the mysql cookbook to install mysql-server 
The mysql cookbook is completely broken on 18.04 (both the released version
and the current master, in different ways). Keep it simple and just run
mysql commands
 2019-05-20 18:50:28 +02:00
greg 61959248f3 Run sockethub on barnard 2019-05-16 00:08:15 +02:00
greg 6a0ab0f375 Remove dev server 2019-05-15 13:23:29 +02:00
greg cdcec7d990 Remove sockethub from andromeda 2019-05-15 13:23:12 +02:00
greg 63f9c31632 Add the ejabberd role to andromeda 2019-05-14 17:11:18 +02:00
greg 4cc5f3e6d1 Remove the XMPP firewall rules for andromeda 
They are part of the kosmos-ejabberd cookbook now
 2019-05-14 17:10:33 +02:00
greg 5106ba20fd Add the version to the dpkg package to allow updates 2019-05-14 17:10:15 +02:00
greg d398c167ca Allow to pass extra attributes to backup PostgreSQL databases 2019-05-14 16:39:21 +02:00
greg c9547582b7 Add a role for the ejabberd server 
Includes the backup, letsencrypt and default recipe
 2019-05-14 15:18:05 +02:00
greg f81b7c82de Backup the 5apps ejabberd database and uploads dir 2019-05-14 15:16:28 +02:00
greg bd9491675f Add the missing sql schema 2019-05-14 15:10:07 +02:00
greg 902a013dca Restart the service when the systemd unit changes 2019-05-14 12:18:22 +02:00
greg 44faa1a8df Change the PostgreSQL password for the ejabberd user 2019-05-14 11:40:21 +02:00
greg 0be63e5935 Fix the config file when no TLS certs exist 2019-05-14 11:31:42 +02:00
greg bd720b0189 Use the regular SQL schema (not the new one for all vhosts into one db) 2019-05-14 11:24:08 +02:00
greg d9390a4b92 Don't use a concatenated cert for kosmos.org anymore 2019-05-13 18:53:45 +02:00
greg 5d1aeb7b68 Create a cert for 5apps.com and improve the renewal script 2019-05-13 18:52:39 +02:00
greg 88204ea91b Update the config to the current one running on andromeda 2019-05-13 17:59:04 +02:00
greg ad23530653 Add the firewall rules for ejabberd 
Includes the missing 5223 port in the andromeda_firewall recipe too
 2019-05-13 17:08:21 +02:00
greg b44a226753 Fix the postgresql setup for the ejabberd cookbook 
Create a ejabberd user with a password from an encrypted data bag
 2019-05-10 11:43:52 +02:00
greg 3884f9922e Merge branch 'master' into feature/7-ejabberd_rebased_2 2019-05-10 11:08:09 +02:00
greg 6b38396c3c Remove the 5apps hubots from dev 2019-05-08 17:53:36 +02:00
greg ba8b73a4dd Add mastodon to andromeda 2019-05-08 17:00:23 +02:00
greg 1e7f21bd41 Remove the mastodon recipes from dev 2019-05-08 17:00:07 +02:00
greg 90815bb274 Fix the postgresql credentials for the backup attributes 2019-05-08 16:58:47 +02:00
greg 7271065c5b Add names to the execute resources 2019-05-08 16:58:31 +02:00
greg 81192f7277 Fix the backup config format to work with backup 5 2019-05-08 12:26:47 +02:00
greg c4d5a2c6bb Remove the ipfs cluster recipe from dev's run list 2019-05-07 14:57:47 +02:00
greg 36e8950eba Update ipfs again, to fix a bug in the ipfs_config resource 
It could not handle integers
 2019-05-07 14:56:40 +02:00
greg 14f0fbc7be Use the last commit of the ipfs PR 2019-05-07 14:41:57 +02:00
greg 4b0818177d Use an unreleased version of our ipfs cookbook to lower RAM usage 2019-05-07 14:35:53 +02:00
greg 4fe3b8e8e7 Move botka and hal8000 from dev to barnard 
Refs #51
 2019-05-07 14:10:07 +02:00
greg 37aa87df5e Add a missing dependency on the zlib1g-dev for the backup gem 
Fixes #56
 2019-05-03 10:58:39 +02:00
greg 5bb34554a7 The nginx_certbot_site resource does nothing in the dev environment 
No need to check for the environment in recipes that use the resource

Closes #54
 2019-05-03 10:55:02 +02:00
greg 64a3444c40 Use the kredits_github role on barnard 
This sets up the app and its nginx reverse proxy
 2019-05-02 12:40:38 +02:00
greg 9284b4fe85 Add the missing kredits-web::nginx recipe for barnard 
This was causing the firewall rules for ports 80 and 443 to be deleted

Refs #35
 2019-05-02 11:33:53 +02:00
greg 21987c502e Add initial instructions for joining the IPFS cluster 
Refs #4
 2019-04-30 17:18:43 +02:00
greg 61607f77c4 Update ipfs-cluster to 0.10.1 
ipfs-cluster-ctl commands such as `pin rm` now work

Closes #48
 2019-04-30 12:58:10 +02:00