kosmos/chef
8
3
Fork 0
Code Issues 38 Pull Requests 2 Projects 2 Activity
782 Commits 9 Branches 0 Tags
e3e726097f105004f45a634467c57452e00f8dfa
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
greg e3e726097f Do not enable the postgresql@12-main service 
We want it to run only once the encrypted data directory has been
mounted
 2020-06-10 14:41:07 +02:00
greg dba6629869 Use the attribute from the encfs recipe for the data directory 2020-06-10 14:41:03 +02:00
greg 229e9cfbd2 Add the kosmos_encfs recipe to centaurus 2020-06-10 14:40:01 +02:00
greg 1e60722ec4 Create an initial encfs cookbook 
Usage: Add the kosmos_encfs::default recipe to the run list of a node.
Creating the encrypted directory will keep it mounted. After a reboot,
start the encfs service and enter the password:

```
$ systemctl start encfs
encfs password:
```

For now postgresql@12-main is a hardcoded dependency of the encfs
Systemd unit that is automatically started once the user inputs the
correct password. This list of dependency will need to be different for
every server, based on the services it is running
 2020-06-04 19:50:20 +02:00
greg eded62a3ec Merge branch 'master' into feature/pg_encfs 2020-06-04 15:13:53 +02:00
greg ccd49aefa4 Add Gitea to the run lists for Andromeda and Centaurus 2020-06-02 16:19:21 +02:00
greg 759fa52e03 Enable the certbot resource 2020-06-02 16:19:05 +02:00
greg 0f10723c81 Enable secure cookies 2020-06-02 16:18:48 +02:00
greg 55865c526c Add the Let's Encrypt hook dir to the config 
Only enabled when there is no TLS cert. This is already part of the
certbot nginx vhost
 2020-06-02 16:17:34 +02:00
greg 0c502580c2 Fix the condition for the Let's Encrypt cert in the template 
The line contained an extra !
 2020-06-02 16:16:30 +02:00
greg 27845525da Use the same JWT_SECRET as on our previous Gitea 
A different one breaks 2FA
 2020-06-02 12:12:59 +02:00
greg c8e50fd226 Install git, it is a required dependency for Gitea 
I didn't catch it because git is installed by default in the Vagrant box
I used to write the cookbook
 2020-06-02 11:41:19 +02:00
greg 2d6c514257 Add the gitea role 2020-06-02 11:22:10 +02:00
greg 94330f2052 Comment out the COOKIE_SECURE config for now 
We will enable it again after we have a valid TLS cert generated with
Let's Encrypt. It prevents logins using http, and we will need that as
an admin account
 2020-05-28 18:43:31 +02:00
greg baaae695af Merge branch 'master' into feature/147-gitea_cookbook 2020-05-28 15:44:44 +02:00
greg baa0739936 Add the backup recipe 
Also move the Gitea data dir to an attribute
 2020-05-26 15:21:26 +02:00
greg 3332a1b2e8 Write initial README 2020-05-26 15:21:07 +02:00
greg 210c76c479 Fix the name of the Let's Encrypt cert execute resource 
The resource in the notification was invalid, missing the type of
resource (execute)

Fixes #171
 2020-05-26 14:10:47 +02:00
greg 1f0e2ccbdd Move the binary URL to an attribute 2020-05-21 11:51:06 +02:00
greg 51d4d88568 Initial kosmos_gitea cookbook 
The default recipe deploys the gitea binary, generates a config file and
our custom Kosmos label set. The service runs as a Systemd unit.

The pg_db recipe needs to run on the primary PostgreSQL (currently
andromeda).

The backup recipe is empty for now

Refs #147
 2020-05-18 19:39:43 +02:00
greg 20cbc678bc Add a method that returns the PostgreSQL service 2020-05-18 19:38:37 +02:00
greg d0daa9cee7 Add the encryption password for encfs to the data bag 2020-05-15 18:46:24 +02:00
greg d79cdf087b Move the PGPASS environment variable to the execute resource 
That way it does not appear in the list of running processes while the
command is running
 2020-05-15 18:45:12 +02:00
greg 31dc14e88c Fix the firewall rules for PostgreSQL 
I got the source and destination mixed up.
 2020-05-15 18:44:42 +02:00
greg 55b1cbc1d7 Encrypt the Postgresql data dir on the replica (centaurus) 
encfs always runs a configuration assistant when creating a new
volume, so this needs to be done manually:

   systemctl stop postgresql@12-main
   mv /var/lib/postgresql /var/lib/postgresql.old
   encfs /var/lib/postgresql_encrypted /var/lib/postgresql --public
Pick p (paranoia mode) and enter the password from the data bag twice

   mv /var/lib/postgresql/* /var/lib/postgresql/
   systemctl start postgresql@12-main

This is running on centaurus and is mounted automatically on boot by a
system unit

Refs #129
 2020-05-15 18:41:31 +02:00
greg 57f46c6c61 Merge branch 'master' into bugfix/enable_dirsrv 2020-05-15 17:24:04 +02:00
greg b4209fa294 Fix the invalid ACIs on initial creation (for real) 
Follow-up to #156

I found another issue with the initial ACI creation, while creating a
fresh VM. I thought I had fixed it in #156 but I was wrong. This time
the ACIs are really set and the code runs successfully.

The ACIs are set on the suffix, so modifying it is needed

This won't be executed on a server that is already running, this is only
done on the initial setup
 2020-05-15 14:05:35 +02:00
greg 10f0460fd5 Fix startup of the dirsrv@master Systemd unit on boot 
The symlink created by Chef's service resource was wrong. Creating the
correct symlink fixes the automatic startup on boot
 2020-05-15 13:54:34 +02:00
greg bf60f9fca8 Add the Chef client public keys for andromeda and barnard 2020-05-14 15:34:10 +02:00
greg da278822f6 Use the new postgresql_primary role on andromeda 2020-05-14 15:09:33 +02:00
greg 18973fe4f6 Remove the deleted tls property from the resources 2020-05-14 15:09:15 +02:00
greg fbf610a643 Merge branch 'master' into feature/160-postgres_replication 2020-05-14 15:06:00 +02:00
greg 069090bf44 Remove TODOs 
Access rules will not be part of this cookbook, they need to be added to
the cookbooks that use a PostgreSQL database
 2020-05-14 13:15:47 +02:00
greg dd92d6cdb7 Remove deploying the root cert to clients from the README 
We do not want to verify the root cert so this is not needed
 2020-05-14 13:14:42 +02:00
greg 124ee5e6f3 Update the README 2020-05-14 12:36:20 +02:00
greg 0063776297 Remove unused dependencies 2020-05-13 19:11:00 +02:00
greg 8d2ab785fc Use a self-signed TLS certificate for PostgreSQL 2020-05-13 19:10:14 +02:00
greg 84cb3de4a0 Remove outdated comment 
This was the case when the code lived inside of the custom resource
 2020-05-13 19:04:12 +02:00
greg f3f8e47cce Add replication_password to the postgresql credentials 2020-05-13 15:35:34 +02:00
greg 51b23c2f47 Add postgresql roles 2020-05-13 15:35:15 +02:00
greg eb98aa1bac Clarify the firewall and client authentication rules 2020-05-12 16:04:58 +02:00
greg 0180da1aa6 Fix a typo in the README 2020-05-12 15:59:55 +02:00
greg 254f9020ae Enable firewall rules to allow primary/replica to connect 2020-05-12 12:10:10 +02:00
greg 80c7263a72 Upgrade PostgreSQL from 10 to 12 
Refs #160
 2020-05-11 18:26:57 +02:00
greg b22a7e3c0f Update the postgresql upstream cookbook 2020-05-11 18:26:35 +02:00
greg 21119fff08 Add a custom resource to set up PostgreSQL 12 
Supports both primary and replica. The access rules and firewall have to
be set up outside of the custom resource, so they are part of the
recipes instead

Refs #160
 2020-05-11 18:23:11 +02:00
greg 1c920a8cb2 Remove the encryption keys after TLS cert renewal 
This is done with awk, this was the best way I found to perform the
multi-line deletion. It deletes both the AES AND 3DES sections

The keys will be recreated on service restart

https://access.redhat.com/documentation/en-us/red_hat_directory_server/9.0/html/administration_guide/ssl-and-attr-encryption

Closes #152
 2020-04-20 19:11:34 +02:00
greg 5e3c8066f9 Add the missing certbot command to generate the LDAP TLS cert 
This had been done manually on barnard. This will not be executed on
barnard again since the cert exists
 2020-04-20 19:10:15 +02:00
greg d01c9a4d0a Fix the name of the deploy certbot hook 2020-04-20 19:09:43 +02:00
greg 3ca8ab45da Fix the invalid ACIs on initial creation 
This is only executed on initial creation of the instance, the
production one is using these fixed ACIs, this was only an issue with
the setup

The issue was the ACI was set at the wrong level
 2020-04-20 19:00:28 +02:00
greg db8bb44c8b Update ejabberd to 20.03 
The download URL has changed, they removed a prefix

Closes #153
 2020-04-20 14:53:08 +02:00
greg f5dd2c7de9 Fix the command importing the schema on db creation 
It had an extra }, but this only fails when creating the databases
 2020-04-20 14:52:11 +02:00
greg d7363d662b Switch the Mediawiki extensions to GitHub zips 
This fixes the annoying issue of Mediawiki only keeping one revision of
each branch
 2020-03-04 16:03:12 +01:00
greg a68ae78689 Update ejabberd to 20.02 
It includes a fix to the reload_config command that prevented us from
running a version newer than 19.05

Closes #136
 2020-03-04 13:28:13 +01:00
greg 6cd0fa039e Restart ejabberd service when changing a vhost config 
I have ran into an issue, changes to the LDAP config for a host are
currently only loaded on startup, not on reload

https://github.com/processone/ejabberd/issues/3181

This should be fixed once
https://github.com/processone/ejabberd/commit/b39a1e2d74cd4d400a7f062e31056057573298e8
is part of the next release
 2020-03-04 13:23:54 +01:00
greg d7ad95fb3f Switch the mediawiki LDAP setup to a new application account 
Needs the new directory structure:

```
dn: cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalRole
cn: users

dn: ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
ou: kosmos.org

dn: ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
description: 5apps
ou: 5apps.com

dn: uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: wiki
userPassword: [snip]

dn: uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]

dn: uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]
```

And the new ACIs:

```
dn: ou=5apps.com,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)

dn: ou=kosmos.org,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=wiki,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
```

Refs #140
 2020-02-21 18:04:48 +01:00
greg 6fa89b3c25 Switch the ejabberd LDAP setup to a new application account 
Needs the new directory structure:

```
dn: cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalRole
cn: users

dn: ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
ou: kosmos.org

dn: ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
description: 5apps
ou: 5apps.com

dn: uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: wiki
userPassword: [snip]

dn: uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]

dn: uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]

```

And the new ACIs:

```
dn: ou=5apps.com,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)

dn: ou=kosmos.org,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=wiki,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
```

Refs #140
 2020-02-21 18:03:58 +01:00
greg c4fdf1779f Remove the CleanTalk Antispam extension 
It is not needed anymore now that registration is closed and only LDAP
accounts can edit or create pages

Closes #130
 2020-02-20 14:31:39 +01:00
greg 6f7474b4d1 Update the Mediawiki extensions 2020-02-20 14:30:25 +01:00
greg 90a0e6be9f Enable LDAP on the kosmos.org vhost 2020-02-19 12:30:55 +01:00
greg 276daf0ed7 Switch the Mediawiki config to the new LDAP dir structure 
* Use a new read-only account instead of the admin LDAP account
* Disable the LDAPAuthorization plugin. The LDAPAuthentication2 plugin
is still used to authenticate users, but every kosmos.org user has
access to the wiki. See
https://www.mediawiki.org/wiki/Extension:PluggableAuth for the
distinction between authentication and authorization

Refs #127
 2020-02-19 12:29:14 +01:00
greg 56adfa37fb Fix a warning in the config 
Migrate the web admin to a request handler
 2020-02-17 17:26:55 +01:00
greg 0f9b2777a3 Update ejabberd to 19.05 
Versions from 19.08 to 20.01 contains a blocking bug in the
reload_config command
(https://github.com/processone/ejabberd/issues/3170)

Closes #134
 2020-02-17 17:26:45 +01:00
greg c2b2b6f08b Fix the vhost template 
hosts must be defined in the main config file
 2020-02-17 15:04:08 +01:00
greg 72cc6342f1 Remove the unused LDAP variables from the main config file 2020-02-17 13:27:14 +01:00
greg 38f39af2a4 Move each vhost to its own config file 2020-02-17 13:20:54 +01:00
greg 463664448c Merge branch 'master' into feature/123-ejabberd_5apps 2020-02-17 12:21:16 +01:00
greg 55eb95ae73 Verify the TLS server's certificate 
Do not proceed if a certificate is invalid
 2020-02-14 13:56:52 +01:00
greg dc1226073c Move the admin users to the ejabberd encrypted data bag 2020-02-14 13:56:17 +01:00
greg 49d01991fd Enable LDAP on the XMPP 5apps.com vhost 
Refactor the ejabberd config file to remove hardcoded values about the
vhosts

Refs #123
 2020-02-12 17:40:38 +01:00
greg e56faab5b1 Set the ACIs on the base DN 
Allow users to change their own password, but nothing else (no search,
no read, no write)

This will only run when setting up the 389-dirsrv instance for the first
time, this has been applied on barnard by editing the dn (see
#128 (comment))

Closes #128
 2020-02-12 16:13:45 +01:00
greg 396cc344fb Switch the ipfs cookbook from GitHub to Gitlab 2020-02-04 16:26:31 +01:00
greg 2a66ff6146 Enable the Cite extension in the MediaWiki config 
This is used to create references as footnotes.
See https://www.mediawiki.org/wiki/Extension:Cite

Closes #124
 2020-01-29 14:30:39 +01:00
greg 9ece855902 Remove the config.rb at the root, it interferes with knife-zero 2020-01-28 14:02:34 +01:00
greg a06ea47e58 Update the LDAPProvider extension 2020-01-28 13:54:57 +01:00
greg a69192a863 Enable LDAP support on mediawiki 
Users can log in using their LDAP account (in the
ou=users,dc=kosmos,dc=org group and with the wiki attribute set to
enabled)

Add an attribute for the ldap master server, so it can be overridden in
the development environment

Refs #107
 2020-01-24 13:45:17 +01:00
greg d029ee91be Move the generate options to config.rb at the root of the repo 
This has been the only way I managed to make `chef generate cookbook
COOKBOOK_NAME` set the default values

This is not documented, there is an issue open about it:
https://github.com/chef/chef-cli/issues/54
 2019-12-27 11:33:05 +01:00
greg 9828b867ba Disable anonymous binds 
See https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/8.2/html/Administration_Guide/configuring-special-binds.html#disabling-anonymous-binds
 2019-12-20 16:46:03 +01:00
greg 0a96c31e12 Add initial LDAP documentation 2019-12-06 10:54:10 +01:00
greg 1240ed9da8 Move the dirsrv cert generation to a certbot deploy hook 2019-12-05 15:47:10 +01:00
greg 0d192f536f Add the empty nginx vhost template 2019-12-05 15:05:37 +01:00
greg 0dbf350540 Restart the server after importing the TLS cert 2019-12-04 17:40:27 +01:00
greg 5ba700cd00 Add the kosmos-dirsrv recipe to barnard 2019-12-04 17:34:15 +01:00
greg 4e7d453942 Move the firewall and backup recipes outside of the custom resource 
See the comment for more details
 2019-12-04 17:33:41 +01:00
greg e24cd01287 Add an empty template because the nginx_certbot_site resource needs one 2019-12-04 17:33:13 +01:00
greg 632cb38aab Pass an empty passphrase on the command line for the p12 cert 2019-12-04 17:32:40 +01:00
greg 9d9493af0d Add a missing dependency on the kosmos-nginx cookbook 2019-12-04 17:32:03 +01:00
greg 9e4f12b1b1 Merge branch 'master' into feature/107-ldap_server 2019-12-04 15:52:08 +01:00
greg dc91128eca Use a custom resource to create a 389 Directory Server instance 
This replaces the default recipe and will make it much easier to create
other types of instances, for example for replication
 2019-11-29 14:34:52 +01:00
greg 65eca52b75 Delete file committed by accident 2019-11-22 17:44:47 +01:00
greg db4e2777d4 Fix a bug preventing nginx from being reloaded after generating a cert 
Change the notifies property to :immediately in nginx_certbot_site. This
way the vhost template is recreated and then triggers a reload of the
nginx service. The previous code resulted in nginx not being reloaded,
as the action had already been queued earlier.
 2019-11-22 14:37:29 +01:00
greg 9e4685a743 Initial version of the kosmos-dirsrv cookbook 
It sets up 389 Directory Server, including a TLS cert acquired using
Let's Encrypt in production (that requires ldap.kosmos.org pointing to
the server's IP)
 2019-11-15 15:41:30 +01:00
greg 0b579b1fea Remove the redirection from HTTP to HTTPS from the mastodon vhost 
This is already done in the certbot vhost
(https://gitea.kosmos.org/kosmos/chef/src/branch/master/site-cookbooks/kosmos-nginx/templates/default/nginx_conf_certbot.erb)
and it redirects every request to HTTPS, breaking Let's Encrypt
validation

Fixes #110
 2019-10-28 11:18:31 +01:00
greg 2c20fa4a2f Fix the nginx vhost for akkounts-api 
Listening on port 80 when there is no TLS cert prevented Let's Encrypt
to generate a cert
 2019-10-18 13:26:04 +02:00
greg 2104e81250 Add the kosmos-akkounts::nginx recipe to kosmos-akkounts::default 2019-10-18 12:30:26 +02:00
greg 6bb93eb5f5 Fix the path to index.js 2019-10-18 12:27:33 +02:00
greg c5eeab3606 Remove typescript and the compilation step 
The app is now compiled during the release phase:
https://github.com/67P/akkounts-api/pull/6
 2019-10-18 12:24:47 +02:00
greg 9ecf40e72a Add dummy encrypted data bag secret 
TODO: replace them with the actual secrets
 2019-10-17 14:58:07 +02:00
greg 185982ff9f Add the initial kosmos-akkounts cookbook to deploy akkounts-api 
Includes a recipe to set up nginx as a reverse proxy with a TLS
certificate for api.accounts.kosmos.org

Closes #18
Closes #20
 2019-10-17 14:56:48 +02:00
greg a32f34b408 Vendor the external cookbooks 
Knife-Zero doesn't include Berkshelf support, so vendoring everything in
the repo is convenient again
 2019-10-13 19:17:42 +02:00