kosmos/chef
8
3
Fork 0
Code Issues 38 Pull Requests 2 Projects 2 Activity
1,285 Commits 9 Branches 0 Tags
e46c8b3e819ebc3014ca3c4958ec2da30e0ee8c0
Commit Graph
67 Commits
Author SHA1 Message Date
basti f6fe3bab0f Connect to IRC bouncer instead of directly 
Changes botka on libera to connect to a bouncer, which also uses SASL,
in order to fix the connection issues and keep a stable connection with
minimal maintenance.
 2022-01-06 08:12:42 -06:00
basti ee0a587dad Upgrade botka, deploy for Libera.Chat to nodejs-2 
Note: Temporarily disables wormhole, because it's still on Freenode,
where its credentials have been deleted by the new "management".
 2021-09-13 18:21:46 +02:00
basti 37873fb881 Add data bag for LND credentials 2021-07-01 13:17:51 +02:00
greg 9415b71965 Deploy hubot with new hubot-kredits 
It includes a script for creating Kredits for reviews

Refs #135
 2021-03-30 12:11:03 +02:00
basti fd901f6e64 Update Zoom JWT 2021-02-18 18:51:36 +01:00
greg 6ec747d416 Add missing credentials for zerotier 2021-01-22 18:43:05 +01:00
basti 2b765e744a Configure and run RTL 
Ride The Lightning is a Web UI for Lightning Network nodes. It is
accessible via the bitcoin VM's private zerotier IP on port 3000.
 2021-01-01 17:42:57 +01:00
basti bbd5500982 Configure and run BTCPay Server 2020-12-21 13:50:28 +01:00
greg 8b1f90c568 Use the same Erlang cookie to enable clustering 
Refs #243
 2020-11-25 16:35:37 +01:00
greg 134493d2d6 Merge branch 'master' into feature/http_upload_service 2020-11-25 09:46:31 +00:00
basti 0e29c930ed Configure subdirectory level for upload.pm 
This allows to post to per-domain subdirectories from XMPP clients.
 2020-11-24 15:33:34 +01:00
basti 9efb9cd78c Configure/deploy HTTP upload service on uploads.kosmos.chat 
https://xmpp.org/extensions/xep-0363.html

(Does not contain the config for ejabberd itself yet.)
 2020-11-23 17:37:14 +01:00
basti d384f69139 Configure/deploy new akkounts app 2020-11-21 15:12:31 +01:00
greg ebf5f405f5 Initial kosmos_drone cookbook 
Closes #235
 2020-11-19 12:59:15 +01:00
basti 9795e77fde Bitcoin source recipe 2020-08-17 10:45:15 +02:00
greg 1e60722ec4 Create an initial encfs cookbook 
Usage: Add the kosmos_encfs::default recipe to the run list of a node.
Creating the encrypted directory will keep it mounted. After a reboot,
start the encfs service and enter the password:

```
$ systemctl start encfs
encfs password:
```

For now postgresql@12-main is a hardcoded dependency of the encfs
Systemd unit that is automatically started once the user inputs the
correct password. This list of dependency will need to be different for
every server, based on the services it is running
 2020-06-04 19:50:20 +02:00
greg eded62a3ec Merge branch 'master' into feature/pg_encfs 2020-06-04 15:13:53 +02:00
greg 27845525da Use the same JWT_SECRET as on our previous Gitea 
A different one breaks 2FA
 2020-06-02 12:12:59 +02:00
greg 51d4d88568 Initial kosmos_gitea cookbook 
The default recipe deploys the gitea binary, generates a config file and
our custom Kosmos label set. The service runs as a Systemd unit.

The pg_db recipe needs to run on the primary PostgreSQL (currently
andromeda).

The backup recipe is empty for now

Refs #147
 2020-05-18 19:39:43 +02:00
greg d0daa9cee7 Add the encryption password for encfs to the data bag 2020-05-15 18:46:24 +02:00
greg 8d2ab785fc Use a self-signed TLS certificate for PostgreSQL 2020-05-13 19:10:14 +02:00
greg f3f8e47cce Add replication_password to the postgresql credentials 2020-05-13 15:35:34 +02:00
basti cc4c8fb903 Add hubot-kredits Zoom config 2020-04-16 17:52:28 +02:00
greg d7ad95fb3f Switch the mediawiki LDAP setup to a new application account 
Needs the new directory structure:

```
dn: cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalRole
cn: users

dn: ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
ou: kosmos.org

dn: ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: top
objectClass: organizationalUnit
description: 5apps
ou: 5apps.com

dn: uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: wiki
userPassword: [snip]

dn: uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]

dn: uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org
objectClass: simpleSecurityObject
objectClass: account
uid: xmpp
userPassword: [snip]
```

And the new ACIs:

```
dn: ou=5apps.com,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=5apps.com,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-5apps-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=5apps.com,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-5apps-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=5apps.com,cn=applications,dc=kosmos,dc=org";)

dn: ou=kosmos.org,cn=users,dc=kosmos,dc=org
changetype: modify
replace: aci
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///cn=wiki,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///cn=xmpp,ou=kosmos.org,cn=users,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || nsRole || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="cn || sn || uid || mail || userPassword || objectClass") (version 3.0; acl "xmpp-kosmos-read-search"; allow (read,search) userdn="ldap:///uid=wiki,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
aci: (target="ldap:///cn=*,ou=kosmos.org,cn=users,dc=kosmos,dc=org")(targetattr="userPassword") (version 3.0; acl "xmpp-kosmos-change-password"; allow (write) userdn="ldap:///uid=xmpp,ou=kosmos.org,cn=applications,dc=kosmos,dc=org";)
```

Refs #140
 2020-02-21 18:04:48 +01:00
greg c4fdf1779f Remove the CleanTalk Antispam extension 
It is not needed anymore now that registration is closed and only LDAP
accounts can edit or create pages

Closes #130
 2020-02-20 14:31:39 +01:00
greg 90a0e6be9f Enable LDAP on the kosmos.org vhost 2020-02-19 12:30:55 +01:00
greg 276daf0ed7 Switch the Mediawiki config to the new LDAP dir structure 
* Use a new read-only account instead of the admin LDAP account
* Disable the LDAPAuthorization plugin. The LDAPAuthentication2 plugin
is still used to authenticate users, but every kosmos.org user has
access to the wiki. See
https://www.mediawiki.org/wiki/Extension:PluggableAuth for the
distinction between authentication and authorization

Refs #127
 2020-02-19 12:29:14 +01:00
greg dc1226073c Move the admin users to the ejabberd encrypted data bag 2020-02-14 13:56:17 +01:00
greg 49d01991fd Enable LDAP on the XMPP 5apps.com vhost 
Refactor the ejabberd config file to remove hardcoded values about the
vhosts

Refs #123
 2020-02-12 17:40:38 +01:00
greg dc91128eca Use a custom resource to create a 389 Directory Server instance 
This replaces the default recipe and will make it much easier to create
other types of instances, for example for replication
 2019-11-29 14:34:52 +01:00
greg 9e4685a743 Initial version of the kosmos-dirsrv cookbook 
It sets up 389 Directory Server, including a TLS cert acquired using
Let's Encrypt in production (that requires ldap.kosmos.org pointing to
the server's IP)
 2019-11-15 15:41:30 +01:00
basti f8af66a532 Add/fix akkounts credentials 2019-10-18 13:10:43 +02:00
greg 9ecf40e72a Add dummy encrypted data bag secret 
TODO: replace them with the actual secrets
 2019-10-17 14:58:07 +02:00
basti 070a1d1889 Configure Kredits signup for hal8000_xmpp 2019-09-01 17:15:56 +02:00
basti c50c68b50c Configure hubot/wormhole deployment 
Adding another node.js hubot app. Wormhole is our new IRC/XMPP bridge.
 2019-07-30 09:09:19 +02:00
greg aa79297387 Remove unused data bags and cookbooks 2019-05-21 14:58:01 +02:00
greg 44faa1a8df Change the PostgreSQL password for the ejabberd user 2019-05-14 11:40:21 +02:00
basti 36cfeab15d Remove obsolete credential item 
rs-logger is run by botka, not hal8000.
 2019-05-09 23:44:28 +02:00
basti 584aab76a7 Add hal8000_xmpp recipe 
Also, configure express ports in attributes, so they are both easy to
see at once, as well as override per node/env.
 2019-05-09 23:44:18 +02:00
basti 1d98bf14fe Configure kosmos-github 
closes #35
 2019-04-19 18:45:13 +01:00
greg 126b5f8dd5 Update the kosmos-mastodon cookbook to use the new postgresql cookbook 
Don't depend on the deprecated database cookbook to create the database
 2019-04-10 11:49:26 +02:00
greg 6b9ce81212 Set postgresql password from an encrypted data bag 2019-04-03 11:34:59 +02:00
greg 81c68a9609 Merge branch 'master' into feature/5apps_xmpp_certs 2018-11-08 14:13:09 +01:00
greg 4a42fc4ae3 Merge branch 'master' into feature/25-ipfs_cluster 2018-10-26 16:46:44 +02:00
greg d236d138dc Set the S3 credentials to write the new oncall file 2018-10-26 13:38:12 +02:00
greg 185649a5f9 Automatically generate a Let's Encrypt cert for all 5apps xmpp domains 
Uses the Gandi LiveDNS API
 2018-09-04 17:38:17 +02:00
greg 7a8042e356 Add initial IPFS Cluster support 
It uses an encrypted data bag to store the cluster secret that has to be
the same on all members of a cluster. It installs ipfs-cluster-service
and ipfs-cluster-ctl and starts the cluster

Refs #25
 2018-08-06 18:05:44 +02:00
basti 0e974182de Configure botka for web push notifications 2018-05-07 19:34:56 +02:00
basti 69b38552c6 Add vapid keys 2017-07-31 13:00:20 +02:00
basti 025eb77441 Update some kredits data 2017-05-12 13:46:06 +02:00