kosmos/chef
8
3
Fork 0
Code Issues 38 Pull Requests 2 Projects 2 Activity
699 Commits 9 Branches 0 Tags
db8bb44c8bd3694fb8937a18889e2f1db301bac9
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
greg db8bb44c8b Update ejabberd to 20.03 
The download URL has changed, they removed a prefix

Closes #153
 2020-04-20 14:53:08 +02:00
greg f5dd2c7de9 Fix the command importing the schema on db creation 
It had an extra }, but this only fails when creating the databases
 2020-04-20 14:52:11 +02:00
greg d7363d662b Switch the Mediawiki extensions to GitHub zips 
This fixes the annoying issue of Mediawiki only keeping one revision of
each branch
 2020-03-04 16:03:12 +01:00
greg a68ae78689 Update ejabberd to 20.02 
It includes a fix to the reload_config command that prevented us from
running a version newer than 19.05

Closes #136
 2020-03-04 13:28:13 +01:00
greg 6cd0fa039e Restart ejabberd service when changing a vhost config 
I have ran into an issue, changes to the LDAP config for a host are
currently only loaded on startup, not on reload

https://github.com/processone/ejabberd/issues/3181

This should be fixed once
https://github.com/processone/ejabberd/commit/b39a1e2d74cd4d400a7f062e31056057573298e8
is part of the next release
 2020-03-04 13:23:54 +01:00
greg d7ad95fb3f Switch the mediawiki LDAP setup to a new application account 
Needs the new directory structure:

```
dn: cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalRole
cn: users

dn: ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
ou: kosmos.org

dn: ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
description: 5apps
ou: 5apps.com

dn: uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: wiki
userPassword: [snip]

dn: uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]

dn: uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]
```

And the new ACIs:

```
dn: ou=5apps.com,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)

dn: ou=kosmos.org,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=wiki,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
```

Refs #140
 2020-02-21 18:04:48 +01:00
greg 6fa89b3c25 Switch the ejabberd LDAP setup to a new application account 
Needs the new directory structure:

```
dn: cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalRole
cn: users

dn: ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
ou: kosmos.org

dn: ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
description: 5apps
ou: 5apps.com

dn: uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: wiki
userPassword: [snip]

dn: uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]

dn: uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]

```

And the new ACIs:

```
dn: ou=5apps.com,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)

dn: ou=kosmos.org,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=wiki,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
```

Refs #140
 2020-02-21 18:03:58 +01:00
greg c4fdf1779f Remove the CleanTalk Antispam extension 
It is not needed anymore now that registration is closed and only LDAP
accounts can edit or create pages

Closes #130
 2020-02-20 14:31:39 +01:00
greg 6f7474b4d1 Update the Mediawiki extensions 2020-02-20 14:30:25 +01:00
greg 90a0e6be9f Enable LDAP on the kosmos.org vhost 2020-02-19 12:30:55 +01:00
greg 276daf0ed7 Switch the Mediawiki config to the new LDAP dir structure 
* Use a new read-only account instead of the admin LDAP account
* Disable the LDAPAuthorization plugin. The LDAPAuthentication2 plugin
is still used to authenticate users, but every kosmos.org user has
access to the wiki. See
https://www.mediawiki.org/wiki/Extension:PluggableAuth for the
distinction between authentication and authorization

Refs #127
 2020-02-19 12:29:14 +01:00
greg 56adfa37fb Fix a warning in the config 
Migrate the web admin to a request handler
 2020-02-17 17:26:55 +01:00
greg 0f9b2777a3 Update ejabberd to 19.05 
Versions from 19.08 to 20.01 contains a blocking bug in the
reload_config command
(https://github.com/processone/ejabberd/issues/3170)

Closes #134
 2020-02-17 17:26:45 +01:00
greg c2b2b6f08b Fix the vhost template 
hosts must be defined in the main config file
 2020-02-17 15:04:08 +01:00
greg 72cc6342f1 Remove the unused LDAP variables from the main config file 2020-02-17 13:27:14 +01:00
greg 38f39af2a4 Move each vhost to its own config file 2020-02-17 13:20:54 +01:00
greg 463664448c Merge branch 'master' into feature/123-ejabberd_5apps 2020-02-17 12:21:16 +01:00
greg 55eb95ae73 Verify the TLS server's certificate 
Do not proceed if a certificate is invalid
 2020-02-14 13:56:52 +01:00
greg dc1226073c Move the admin users to the ejabberd encrypted data bag 2020-02-14 13:56:17 +01:00
greg 49d01991fd Enable LDAP on the XMPP 5apps.com vhost 
Refactor the ejabberd config file to remove hardcoded values about the
vhosts

Refs #123
 2020-02-12 17:40:38 +01:00
greg e56faab5b1 Set the ACIs on the base DN 
Allow users to change their own password, but nothing else (no search,
no read, no write)

This will only run when setting up the 389-dirsrv instance for the first
time, this has been applied on barnard by editing the dn (see
#128 (comment))

Closes #128
 2020-02-12 16:13:45 +01:00
greg 396cc344fb Switch the ipfs cookbook from GitHub to Gitlab 2020-02-04 16:26:31 +01:00
greg 2a66ff6146 Enable the Cite extension in the MediaWiki config 
This is used to create references as footnotes.
See https://www.mediawiki.org/wiki/Extension:Cite

Closes #124
 2020-01-29 14:30:39 +01:00
greg 9ece855902 Remove the config.rb at the root, it interferes with knife-zero 2020-01-28 14:02:34 +01:00
greg a06ea47e58 Update the LDAPProvider extension 2020-01-28 13:54:57 +01:00
greg a69192a863 Enable LDAP support on mediawiki 
Users can log in using their LDAP account (in the
ou=users,dc=kosmos,dc=org group and with the wiki attribute set to
enabled)

Add an attribute for the ldap master server, so it can be overridden in
the development environment

Refs #107
 2020-01-24 13:45:17 +01:00
greg d029ee91be Move the generate options to config.rb at the root of the repo 
This has been the only way I managed to make `chef generate cookbook
COOKBOOK_NAME` set the default values

This is not documented, there is an issue open about it:
https://github.com/chef/chef-cli/issues/54
 2019-12-27 11:33:05 +01:00
greg 9828b867ba Disable anonymous binds 
See https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.2/html/Administration_Guide/configuring-special-binds.html#disabling-anonymous-binds
 2019-12-20 16:46:03 +01:00
greg 0a96c31e12 Add initial LDAP documentation 2019-12-06 10:54:10 +01:00
greg 1240ed9da8 Move the dirsrv cert generation to a certbot deploy hook 2019-12-05 15:47:10 +01:00
greg 0d192f536f Add the empty nginx vhost template 2019-12-05 15:05:37 +01:00
greg 0dbf350540 Restart the server after importing the TLS cert 2019-12-04 17:40:27 +01:00
greg 5ba700cd00 Add the kosmos-dirsrv recipe to barnard 2019-12-04 17:34:15 +01:00
greg 4e7d453942 Move the firewall and backup recipes outside of the custom resource 
See the comment for more details
 2019-12-04 17:33:41 +01:00
greg e24cd01287 Add an empty template because the nginx_certbot_site resource needs one 2019-12-04 17:33:13 +01:00
greg 632cb38aab Pass an empty passphrase on the command line for the p12 cert 2019-12-04 17:32:40 +01:00
greg 9d9493af0d Add a missing dependency on the kosmos-nginx cookbook 2019-12-04 17:32:03 +01:00
greg 9e4f12b1b1 Merge branch 'master' into feature/107-ldap_server 2019-12-04 15:52:08 +01:00
greg dc91128eca Use a custom resource to create a 389 Directory Server instance 
This replaces the default recipe and will make it much easier to create
other types of instances, for example for replication
 2019-11-29 14:34:52 +01:00
greg 65eca52b75 Delete file committed by accident 2019-11-22 17:44:47 +01:00
greg db4e2777d4 Fix a bug preventing nginx from being reloaded after generating a cert 
Change the notifies property to :immediately in nginx_certbot_site. This
way the vhost template is recreated and then triggers a reload of the
nginx service. The previous code resulted in nginx not being reloaded,
as the action had already been queued earlier.
 2019-11-22 14:37:29 +01:00
greg 9e4685a743 Initial version of the kosmos-dirsrv cookbook 
It sets up 389 Directory Server, including a TLS cert acquired using
Let's Encrypt in production (that requires ldap.kosmos.org pointing to
the server's IP)
 2019-11-15 15:41:30 +01:00
greg 0b579b1fea Remove the redirection from HTTP to HTTPS from the mastodon vhost 
This is already done in the certbot vhost
(https://gitea.kosmos.org/kosmos/chef/src/branch/master/site-cookbooks/kosmos-nginx/templates/default/nginx_conf_certbot.erb)
and it redirects every request to HTTPS, breaking Let's Encrypt
validation

Fixes #110
 2019-10-28 11:18:31 +01:00
greg 2c20fa4a2f Fix the nginx vhost for akkounts-api 
Listening on port 80 when there is no TLS cert prevented Let's Encrypt
to generate a cert
 2019-10-18 13:26:04 +02:00
greg 2104e81250 Add the kosmos-akkounts::nginx recipe to kosmos-akkounts::default 2019-10-18 12:30:26 +02:00
greg 6bb93eb5f5 Fix the path to index.js 2019-10-18 12:27:33 +02:00
greg c5eeab3606 Remove typescript and the compilation step 
The app is now compiled during the release phase:
https://github.com/67P/akkounts-api/pull/6
 2019-10-18 12:24:47 +02:00
greg 9ecf40e72a Add dummy encrypted data bag secret 
TODO: replace them with the actual secrets
 2019-10-17 14:58:07 +02:00
greg 185982ff9f Add the initial kosmos-akkounts cookbook to deploy akkounts-api 
Includes a recipe to set up nginx as a reverse proxy with a TLS
certificate for api.accounts.kosmos.org

Closes #18
Closes #20
 2019-10-17 14:56:48 +02:00
greg a32f34b408 Vendor the external cookbooks 
Knife-Zero doesn't include Berkshelf support, so vendoring everything in
the repo is convenient again
 2019-10-13 19:17:42 +02:00
greg f4bfe31ac1 Update the node files after running Knife-Zero 2019-10-10 12:52:10 +02:00
greg ebcb700eaf Add the command to update Chef Client 2019-10-10 12:43:47 +02:00
greg 67c9ea621c Add the latest bootstrap command to the README 2019-10-10 12:37:14 +02:00
greg 8fdafa1484 Set attribute whitelists for Knife-Zero 
This prevents all attributes to be written in the node files. We don't
want that data stored in git.
See https://knife-zero.github.io/40_configuration/
 2019-10-10 12:34:55 +02:00
greg f5858a8a6e Remove unneeded setting 
In Chef 15 local_mode is enough
 2019-10-10 12:34:08 +02:00
greg a7aa38805c Merge branch 'master' into feature/103-chef_15 2019-10-09 13:04:05 +02:00
greg aa66743166 Set a low Java heap size in development 2019-10-08 18:23:27 +02:00
greg bf010b943a Add commented recipes to the run list 2019-10-08 18:22:51 +02:00
greg 7f57caddf9 Update Chef to 15.3.14 in the Vagrant config 
Add the switch to accept the license
 2019-10-08 18:22:11 +02:00
greg 6ea0498490 Get rid of the vagrant-berkshelf plugin 
It has been abandoned by its creators
 2019-10-08 18:20:57 +02:00
greg 585374861d Update the README for Knife-Zero 2019-10-08 18:17:57 +02:00
greg b633205d6d Update poise-javascript to support Chef 15 2019-10-08 18:17:34 +02:00
greg 0b9ab63a61 Update Chef to 15.3.14 2019-10-08 18:17:34 +02:00
greg 20f6e9e04d Delete config for knife-solo 2019-10-08 18:17:34 +02:00
greg 3c05f172de Add the cookbooks dir to the load path for Knife-Zero 2019-10-08 18:17:34 +02:00
greg 2c2ae596ed Don't update chef using the chef_client_updater cookbook 
It only makes sense when using Chef Server, which we don't
 2019-10-08 18:17:34 +02:00
greg 34d69dbca1 Add missing application_javascript dependency 2019-09-27 11:07:15 +02:00
greg 286b9ab574 Add the java cookbook, delete application_ruby 2019-09-27 11:00:01 +02:00
greg 3be9b2fb44 Update yarn to the latest version 2019-09-27 10:57:58 +02:00
greg 438c5ff72d Fix the services restarting every time the recipe is executed 
* Manually send a restart action from the application_git resource
* Do not depend on application_ruby anymore
 2019-09-27 10:57:35 +02:00
greg 4b39ea60dd Set the NODE_ENV variable when running yarn 
The assets precompilation task runs yarn with NODE_ENV=production,
before this change yarn would install a different set of packages, with
this change the run from the assets precompilation is idempotent
 2019-09-27 10:55:32 +02:00
greg b1cfa6f6f7 Install Java for Elasticsearch 
It was missing from the recipe
 2019-09-27 10:51:26 +02:00
greg dace5672e4 Move the java heap size to an attribute 2019-09-27 10:50:56 +02:00
greg 9d68d3c4da Link to the new ops Mastodon account 2019-09-19 16:02:41 +02:00
greg cd9a7dd3dc Use the new kosmos.chat MUC domain on the maintenance page 2019-09-19 16:00:01 +02:00
greg f49dd5e6d4 Switch the MUC host for kosmos.org to kosmos.chat 2019-09-19 15:58:53 +02:00
greg 544f4b78f4 Change the MUC domain for the kosmos.org XMPP server to kosmos.chat 2019-09-19 15:57:54 +02:00
greg 4685b16573 Add kosmos.chat to the list of Kosmos XMPP domains with a TLS cert 2019-09-19 15:56:49 +02:00
greg 2ecc128abd Move the hidden service attributes to the attributes file 
When it is set in the recipe the hidden service dir doesn't get set
correctly (nil), resulting in a broken torrc file
 2019-09-11 13:47:42 +02:00
greg fdb4353ac0 Raise the memory limit for Elasticsearch 2019-09-11 11:21:10 +02:00
greg 245392c4ad Install Elasticsearch 6.8.2 
Version 7 isn't compatible with Mastodon yet
 2019-09-10 12:29:24 +02:00
greg efa958a374 Merge branch 'master' into feature/96-elasticsearch_mastodon 2019-09-09 16:20:46 +02:00
greg 039da3d35a Install Elasticsearch and enable it in Mastodon 
Refs #96
 2019-09-06 17:26:06 +02:00
greg dfa709c9df Update nginx to 1.17.3, enable TLS 1.3 
Uses the current intermediate recommended config from
https://ssl-config.mozilla.org

Closes #92
 2019-08-30 11:57:38 +02:00
greg 1eaffd1309 Update go-ipfs to 0.4.22 
Part of the 0.4.1 version of the ipfs cookbook

Closes #85
 2019-08-14 13:04:08 +02:00
greg 0fa9e6cbb7 Set the uploads dir inside of /opt/ejabberd instead of /var/www 
/var/www is intended for nginx/apache

I have copied over the old directories manually on Andromeda before
running this code

Fixes #80
 2019-07-19 12:47:42 +02:00
greg ab09dd81b4 Update the ipfs cookbook to 0.4.0 2019-07-05 16:02:23 +02:00
greg 666ba1e6f6 Override node attributes for andromeda and barnard 2019-07-05 15:39:47 +02:00
greg 9c8befc179 Move attributes from the ipfs cookbook to kosmos-ipfs 
The default attributes set in the ipfs cookbook do not include
attributes that are specific to Kosmos anymore
 2019-07-05 15:38:30 +02:00
greg cf4e567dcb Get rid of the letsencrypt recipe 
Its content has been moved to the public_gateway recipe
 2019-07-04 10:24:33 +02:00
greg 80526e3396 Switch to our own fork of the poise-javascript cookbook 
Includes passing the `--no-audit` switch to `npm install` to prevent the
`npm_install` resource to consider the command resulted in changes,
causing the service to restart at every Chef run. npm returns the
expected string "up to date" when not performing the security audit

Closes #5
 2019-06-21 17:36:18 +02:00
greg 3a693efcd6 Add email notifications for failed certbot runs 
Based on https://wiki.archlinux.org/index.php/Systemd/Timers#MAILTO

This can easily be used by other services, with one line added to the
[Unit] section of a service:

OnFailure=status-email-ops@%n.service

Refs #3
 2019-06-20 12:46:27 +02:00
greg b01985ec4f Fix the permissions for the ejabberd upload folders 2019-06-14 16:38:49 +02:00
greg 283f623fee Add mastodon role 2019-06-14 15:49:29 +02:00
greg 339f32c957 Simplify the instructions to get the cluster secret 2019-05-28 13:05:52 +02:00
greg 7905ed4402 Remove unused staging node 2019-05-21 15:00:01 +02:00
greg aa79297387 Remove unused data bags and cookbooks 2019-05-21 14:58:01 +02:00
greg b10c53cce8 Remove the database and mysql2_chef_gem cookbooks 2019-05-21 14:57:29 +02:00
greg 12ab8dc33b Stop depending on the mysql cookbook to install mysql-server 
The mysql cookbook is completely broken on 18.04 (both the released version
and the current master, in different ways). Keep it simple and just run
mysql commands
 2019-05-20 18:50:28 +02:00
greg 61959248f3 Run sockethub on barnard 2019-05-16 00:08:15 +02:00