kosmos/chef
8
3
Fork 0
Code Issues 38 Pull Requests 2 Projects 2 Activity
1,064 Commits 9 Branches 0 Tags
b1fea4b09ffe87c48b5b1d8b524cb0968c13fabf
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
greg b1fea4b09f Update the postgres-3 node after Chef run 2021-01-23 19:25:49 +01:00
greg 7ce8b7d461 Enable PostgreSQL service 2021-01-23 19:14:55 +01:00
greg 112eb903ec Add a script to switch the primary PostgreSQL server 
Usage: scripts/postgresql/switch_primary.sh <old_primary_hostname> <new_primary_hostname>
 2021-01-23 19:13:54 +01:00
greg 7e61e9cb45 Promote a new PostgreSQL primary: postgres-2 2021-01-23 19:09:41 +01:00
greg a7116b8fe5 Switch the TLS mode to disabled for Gitea 
We connect through a Zerotier private IP
 2021-01-23 19:08:06 +01:00
greg a4a35da0ff Replace the hardcoded primary pg IP with a hostname 2021-01-23 17:34:58 +01:00
greg 5cb390f340 Remove the postgresql_replica from centaurus, run Chef 
I have also deleted the data directory (in /mnt/data)
 2021-01-23 17:11:45 +01:00
greg 4e1bd458f3 Update the mastodon-1 node after Chef run 2021-01-23 17:11:45 +01:00
greg 40fde8a861 Update the ejabberd nodes after Chef run 2021-01-23 17:11:45 +01:00
greg 39d0304ab4 Update the akkounts-1 node after Chef run 2021-01-23 17:11:45 +01:00
greg ee7b3626be Generate a host entry for the current PostgreSQL primary 2021-01-23 17:11:45 +01:00
greg 286cd2f2a3 Move the postgresql_client role to the top 
We want the host file to be written before database connections happen
 2021-01-23 17:11:45 +01:00
greg 1e3a2b40d4 Add the postgresql_client role to the akkounts role 2021-01-23 17:11:45 +01:00
greg bb0e73d1b9 Switch ejabberd, mastodon and gitea to a hostname for Postgres 2021-01-23 17:11:45 +01:00
greg fdd70d1872 Remove postgres-1 server 
It was created with an encfs volume inside a VM, we want full disk encryption
instead. I have deleted the VM from centaurus as well as its disk and
have also unauthorized its id from the zerotier controller
 2021-01-23 17:11:45 +01:00
greg 41ca5938a2 Merge branch 'master' into feature/postgres_vms 2021-01-23 14:43:58 +01:00
greg 6ec747d416 Add missing credentials for zerotier 2021-01-22 18:43:05 +01:00
greg cbcb50bc86 Create a zerotier_controller role 2021-01-22 18:41:46 +01:00
greg eba7d63b43 Delete the test-2 client and node file 2021-01-22 18:41:46 +01:00
greg 5fa23fe872 Remove the andromeda client and node files 2021-01-22 18:41:46 +01:00
greg 0e1a73b18f Set the private Zerotier IP for draco in the node file 2021-01-22 18:41:46 +01:00
greg 9b4756441a Add a recipe to join the private Zerotier network 2021-01-22 18:41:45 +01:00
greg dd78b8cf7e Use the PG primary private Zerotier IP if it exists 2021-01-22 18:41:45 +01:00
greg 88e52607e3 Add a recipe to set up a hosts entry for the PG primary 2021-01-22 18:41:45 +01:00
greg 511400a7b8 Update hostsfile and add zerotier cookbook 2021-01-22 18:41:45 +01:00
greg 9a4420fc11 Add the ability to pass a disk size to the create_vm script 
Defaults to 10GB
 2021-01-22 18:41:45 +01:00
greg ab422155e4 Add the ability to pass a disk size to the create_vm script 
Defaults to 10GB
 2021-01-22 13:49:23 +01:00
greg af54777250 Create postgresql-1 VM 
Refs #280
 2021-01-07 12:04:52 +01:00
greg f6086e2f6a Add the firewall rules to the postgresql role 2021-01-07 12:02:35 +01:00
greg 456639bdf8 Fix a syntax error in certbot dirsrv hook 
The newline was not escaped and rendered as an actual newline

Fixes #272
 2020-12-31 11:38:49 +01:00
greg 87388ac69d Add the postgresql_client role to the mastodon role 
This will add the firewall rule and pg_hba access rule on the PostgreSQL
servers
 2020-12-18 17:54:31 +01:00
greg c700f98976 Add a firewall rule to allow clients to connect 
Previously it was not an issue because services that connected to the
PostgreSQL primary were also on the same server as a standby server.
 2020-12-18 17:53:28 +01:00
greg f75aeaf9b5 Always set the promote trigger file config 
Only setting it for standby servers isn't useful, as we need to be able
to touch this file to trigger the promotion of a new primary server
after running Chef on it.
 2020-12-18 17:02:13 +01:00
greg 1551fe6d1b Update the ipfs-1 node file after running chef 2020-12-11 19:29:56 +01:00
greg 83736d2a85 Update the bitcoin-2 node file after running chef 2020-12-11 19:28:34 +01:00
greg ebfd36bab8 Add nodejs-1 client and node file 
Refs #259
 2020-12-11 19:02:04 +01:00
greg a92205bd65 Fix the VM creation script 
Also join the zerotier network
 2020-12-09 16:29:15 +01:00
greg 77ab77afe8 Update the centaurus and draco nodes after Chef run 2020-12-09 15:42:49 +01:00
greg 6273271d40 Remove kosmos-bitcoin::source from draco 
Bitcoind runs inside a VM, not directly on the host
 2020-12-09 15:42:19 +01:00
greg 7ceb9af3ed Rename the kosmos_kvm default recipe to host 
It makes it clear it is meant for KVM hosts
 2020-12-09 11:19:13 +01:00
greg 6c907419aa Set the VM name from the script argument 2020-12-08 17:10:40 +01:00
greg 8f304d00ce Remove unused kitchen.yml files 2020-12-08 16:34:24 +01:00
greg 94a34e4758 Add arguments for RAM and number of CPUs 2020-12-08 16:33:27 +01:00
greg b3c1f81ec6 Set the description of the kosmos_zerotier cookbook 2020-12-08 16:26:14 +01:00
greg 6f7b493173 Create the base Ubuntu 20.04 cloud image with code 2020-12-08 16:25:32 +01:00
greg 176083497c Install the libvirt-daemon-system package 
It creates the libvirt-qemu user
 2020-12-08 16:25:04 +01:00
greg 89c8f42a46 Set the description for the kosmos_kvm cookbook 2020-12-08 16:03:18 +01:00
greg 1837285b79 Add the kosmos_kvm recipe and the firewall rules 
... to the KVM hosts, centaurus and draco

Refs #244
 2020-12-04 16:33:18 +01:00
greg ee7a117d63 Add initial kosmos_zerotier cookbook 
For now it only includes the firewall rule

Refs #244
 2020-12-04 16:29:22 +01:00
greg e6b7794e20 Extract firewall definitions to their own recipe 
This allows us to use them for KVM hosts as well. Until now we had set
up ufw rules manually on the two KVM hosts (draco and centaurus)

Refs #244
 2020-12-04 16:27:42 +01:00
greg 9dbe5bcfcb Deploy a script to create new VMs 
It uses `virt-install` with the official Ubuntu 20.04 cloud image as a
starting point, with cloud-init to add our SSH keys to the ubuntu user
and set up Zerotier.

USAGE: create_vm VMNAME

Closes #244
 2020-12-04 16:21:52 +01:00
greg bbf01711f8 Add ejabberd-1 client and node file 2020-11-25 16:42:23 +01:00
greg fbd71204c2 Use the production run list when no Chef environment was set 2020-11-25 16:41:43 +01:00
greg 613b316588 Add comment about needing to run Chef a second time... 
... after the TLS certs are generated
 2020-11-25 16:36:07 +01:00
greg 3a8af26b5f Remove firewall rule for an unused port 2020-11-25 16:36:07 +01:00
greg 23ca3552d2 Remove the absolute path of certbot to use the new package 2020-11-25 16:36:07 +01:00
greg ddb706b61c Add a missing dependency on kosmos-dirsrv 2020-11-25 16:36:07 +01:00
greg 085bd8abd5 Move TURN port to a different range 
It landed on a port used by PostgreSQL. Also switch STUN/TURN to TCP
because HAProxy does not support UDP.

Closes #240
 2020-11-25 16:36:07 +01:00
greg 7636f6ed19 Move the Gandi DNS certbot hook to kosmos-ejabberd 2020-11-25 16:36:07 +01:00
greg 8b1f90c568 Use the same Erlang cookie to enable clustering 
Refs #243
 2020-11-25 16:35:37 +01:00
greg df4c92b64e Update the centaurus node after adding drone to it 2020-11-19 12:59:24 +01:00
greg d7e54bf7ce Add drone role 2020-11-19 12:59:24 +01:00
greg ebf5f405f5 Initial kosmos_drone cookbook 
Closes #235
 2020-11-19 12:59:15 +01:00
greg 255e43c680 Fix the Systemd unit for discourse 
Switch the systemd unit to a oneshot type
 2020-10-23 09:28:31 +02:00
greg 5062392c71 Fix the undefined variable in the instance resource 2020-10-20 19:53:11 +02:00
greg dc2fe38e10 Add the discourse role to centaurus 2020-10-20 12:22:07 +02:00
greg 07e6da4d33 Add a role for discourse 2020-10-20 12:22:07 +02:00
greg 429b609ac2 Initial kosmos_discourse cookbook 
The systemd unit does not work

Refs #222
 2020-10-20 12:21:53 +02:00
greg 7eaf177bb2 Set the autocreate permission for Mediawiki users 
This allows LDAP sign ins to create an account automatically

Fixes #219
 2020-10-06 15:51:01 +02:00
greg 2119c11243 Do not include kosmos-postgresql in kosmos-ejabberd default recipe 
It will install PostgreSQL, and we do not want that on the ejabberd
server
 2020-09-25 16:29:01 +02:00
greg a8b303af4a Fix the search command for Kosmos LDAP users 2020-09-16 11:36:29 +02:00
gregandbasti e31f480f27 Fix the attribute name 2020-08-16 16:14:18 +02:00
gregandbasti aedf7bcb62 Create the snap mount directory in the user's home 2020-08-16 16:14:18 +02:00
gregandbasti 069246cf41 Create the bitcoind user and its home directory 2020-08-16 16:14:18 +02:00
gregandbasti 1b9a4aad17 Work around a bug in Chef's snap_package resource 
https://github.com/chef/chef/issues/8827

`snap install` returns 0 when a package is already installed, so no need
for a guard clause
 2020-08-16 16:14:17 +02:00
greg 41fd1576ad Override the header template to remove the Roboto font 
Using the system font instead
 2020-07-30 12:33:09 +02:00
greg 924f67d8a8 Update Gitea to 1.12.3 
Closes #189
 2020-07-30 12:16:31 +02:00
greg 5e5bbe07dc Restart gitea after upgrading it 2020-07-30 12:16:04 +02:00
greg 3f7894bd46 Run Chef again after upgrading centaurus to Ubuntu 20.04 
Closes #195
 2020-07-30 11:59:30 +02:00
greg 44b49ddd57 Upgrade nginx to the latest mainline version 2020-07-30 11:58:52 +02:00
greg d2126f6153 Use the right variable for the TLS cert's domain 
`domain` was undefined. `new_resource.hostname` is ldap.kosmos.org and
is what we need

Fixes #193
 2020-07-22 15:59:27 +02:00
greg 4583421597 Connect to the PostgreSQL primary server instead of localhost 
Move the db and user creation to its own recipe

Refs #186
 2020-06-26 15:22:14 +02:00
greg 004a6913b4 Remove dependency to an old PostgreSQL in the Systemd unit 
Refs #186
 2020-06-26 15:22:05 +02:00
greg fb8687b63c Add the postgresql_replica role to draco 2020-06-19 17:33:06 +02:00
greg f7dfffd967 Add the kosmos_encfs recipe to draco 2020-06-19 17:33:06 +02:00
greg 8386dae46f Add the new Hetzner server, draco.kosmos.org 2020-06-19 17:33:06 +02:00
greg 84cf008bac Install vim 2020-06-19 17:30:02 +02:00
greg b4357df471 Enable unattended-upgrades (security and updates repositories) 
... with email notifications on failure and logging with syslog
 2020-06-19 17:30:02 +02:00
greg e7edb5a464 Update apt to 7.3.0 
It now includes unattended-upgrades support
 2020-06-19 17:30:02 +02:00
greg 5e483240c3 Set the Gitea root URL to HTTPS 
It fixes U2F security keys support, that was broken because the protocol
did not match

Fixes #182
 2020-06-12 17:22:34 +02:00
greg ee9c241a4d Add a postgresql_client role 
The role is empty but is used to explicitly define servers that have
access rights to all PostgreSQL databases and users
 2020-06-12 16:54:58 +02:00
greg 6f696d7634 Define access rules in the PostgreSQL primary recipe 
Access is done for the IP of a server for all users and all databases
for ejabberd and gitea
 2020-06-11 18:20:04 +02:00
greg 26097a7584 Use the correct database name for the access rights 2020-06-11 09:00:50 +02:00
greg 1a6ce44758 Create a minimalist ejabberd role for development 
No Let's Encrypt, no backups
 2020-06-10 18:43:34 +02:00
greg 2c21d6255b Add PostgreSQL primary support to the kosmos-ejabberd cookbook 
* Move the PostgreSQL user and database creation to a pg_db recipe
* Generate access rights for the ejabberd servers in the pg_db recipe
* Connect to the PostgreSQL primary instead of localhost

Refs #180
 2020-06-10 18:38:40 +02:00
greg 091a46e972 Do not pass the pgsql_password variable to ejabberd.yml 
The password is only used in the config files for the vhosts
 2020-06-10 18:37:36 +02:00
greg a0db6adaf2 Pass the data_directory to the postgresql_server_conf resource 
Previously we were passing it as an additional config, but it is set by
default. The last value was used, the custom one, so the server still
used the correct file
 2020-06-10 14:41:07 +02:00
greg e3e726097f Do not enable the postgresql@12-main service 
We want it to run only once the encrypted data directory has been
mounted
 2020-06-10 14:41:07 +02:00
greg dba6629869 Use the attribute from the encfs recipe for the data directory 2020-06-10 14:41:03 +02:00
greg 229e9cfbd2 Add the kosmos_encfs recipe to centaurus 2020-06-10 14:40:01 +02:00