WIP Deploy substr

Turn known pubkeys into object with usernames
Merge pull request 'Fix TLS cert updates for kosmos.chat' (#578 ) from chore/fix_cert_updates_kosmos-chat into master
2024-12-09 18:21:55 +04:00 · 2024-12-09 18:21:55 +04:00 · 2024-12-09 14:21:05 +00:00 · 2024-12-09 18:17:10 +04:00 · 2024-12-09 14:14:35 +00:00 · 2024-12-09 18:12:45 +04:00
28 changed files with 1640 additions and 72 deletions
@@ -0,0 +1,4 @@
+{
+  "name": "garage-10",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw2+3Wo+KkXVJCOX1SxT9\nSdwKXgPbCDM3EI9uwoxhMxQfRyN53dxIsBDsQUVOIe1Z8yqm4FenMQlNmeDR+QLE\nvNFf1fisinW+D9VVRm+CjcJy96i/Dyt786Z6YRrDlB860HxCbfTL2Zv5BRtbyIKg\nhz5gO+9PMEpPVR2ij9iue4K6jbM1AAL2ia/P6zDWLJqeIzUocCeHV5N0Z3jXH6qr\nf444v78x35MMJ+3tg5h95SU1/PDCpdSTct4uHEuKIosiN7p4DlYMoM5iSyvVoujr\nflRQPEpGzS9qEt3rDo/F4ltzYMx6bf1tB/0QaBKD+zwPZWTTwf61tSBo5/NkGvJc\nFQIDAQAB\n-----END PUBLIC KEY-----\n"
+}
@@ -0,0 +1,4 @@
+{
+  "name": "garage-11",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzfZcNEQojtmaogd9vGP/\nMsVPhAOlQ4kxKgrUas+p+XT7lXRan6b3M8UZEleIaL1HWsjSVwtFWRnNl8kg8rF8\nNEkLeOX8kHf7IoXDFOQa2TXanY8tSqrfh9/heFunt4Q3DluVt7S3bBdwukbDXm/n\nXJS2EQP33eJT4reL6FpVR0oVlFCzI3Vmf7ieSHIBXrbXy7AIvGC2+NVXvQle6pqp\nx0rqU6Wc6ef/VtIv+vK3YFnt9ue3tC63mexyeNKgRYf1YjDx61wo2bOY2t8rqN8y\nHeZ3dmAN8/Vwjk5VGnZqK7kRQ92G4IcE+mEp7MuwXcLqQ9WB960o+evay+o1R5JS\nhwIDAQAB\n-----END PUBLIC KEY-----\n"
+}
@@ -0,0 +1,4 @@
+{
+  "name": "garage-9",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnMHzKE8JBrsQkmRDeMjX\n71mBzvRzNM90cwA8xtvIkXesdTyGqohX9k/PJbCY5ySGK9PpMaYDPVAnwnUP8LFQ\n3G98aSbLxUjqU/PBzRsnWpihehr05uz9zYcNFzr4LTNvGQZsq47nN9Tk+LG3zHP7\nAZViv2mJ4ZRnukXf6KHlyoVvhuTu+tiBM8QzjTF97iP/aguNPzYHmrecy9Uf5bSA\nZrbNZT+ayxtgswC2OclhRucx7XLSuHXtpwFqsQzSAhiX1aQ3wwCyH9WJtVwpfUsE\nlxTjcQiSM9aPZ8iSC0shpBaKD1j3iF/2K2Jk+88++zMhJJPLermvaJxzsdePgvyk\nKQIDAQAB\n-----END PUBLIC KEY-----\n"
+}
@@ -1,23 +1,23 @@
 {
  "id": "gandi_api",
  "key": {
-    "encrypted_data": "d3/rJMX6B9GuzUt0/mIk/lgQ3qGyQdbNXH6UEm3ZX7DeSl+rbW9FPJCRWg==\n",
-    "iv": "15YVAYla7PqqVOab\n",
-    "auth_tag": "xQSq+ld6SDOAER07N4ZkUQ==\n",
+    "encrypted_data": "Ky1/PdywtEIl5vVXhzu3n2JetqOxnNjpjQ7yCao6qwIAn8oYxnv1c1hFAQ==\n",
+    "iv": "stAc2FxDvUqrh0kt\n",
+    "auth_tag": "rcK4Qt+f2O4Zo5IMmG0fkw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "access_token": {
-    "encrypted_data": "geQwcNosiJZmqbbMpD/I+a2yueBzpV6C8Rb7vrCD8kR161ZRjvqLe+g/1XpT\n2/65wKYDMTrdto1I030=\n",
-    "iv": "1sj58eyooOZ8FTYn\n",
-    "auth_tag": "yBNfgWXaToc06VDLly/HUw==\n",
+    "encrypted_data": "J7zoLhEbPfPjnVWBmFmDdPKRer5GGw2o6Ad0uinznANugfaDiqjyYinOdEDF\nHlAqLmXv4J40rr3F+o4=\n",
+    "iv": "fAxFqVh9QqrfBsPW\n",
+    "auth_tag": "9ugi4frDLv8f7X0X1+k4DA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "domains": {
-    "encrypted_data": "p5rIQTyCE+0d4HIuA4GKEAFekh7qEC4xe9Rm/kP0DyzY83FO0/4uKIvYoZRB\n",
-    "iv": "LWlx98NSS1/ngCH1\n",
-    "auth_tag": "FID+x/LjTZ3cgQV5U2xZLA==\n",
+    "encrypted_data": "X0KOKlJp5GYbKcq/jzmlaMmTXV1U7exWSqi3UxX9Sw==\n",
+    "iv": "9JucnYLlYdQ9N6pd\n",
+    "auth_tag": "sERYPDnVUJwVfSS8/xrPpQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
@@ -1,93 +1,114 @@
 {
  "id": "mastodon",
+  "active_record_encryption_deterministic_key": {
+    "encrypted_data": "2ik8hqK7wrtxyC73DLI8FNezZiWp2rdjwaWZkTUFRj+iwvpSrGVEwMx6uxDI\nWa7zF3p/\n",
+    "iv": "XMp6wqwzStXZx+F3\n",
+    "auth_tag": "vloJOLqEcghfQXOYohVVlg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "active_record_encryption_key_derivation_salt": {
+    "encrypted_data": "Nq/rHayMYmT/82k3tJUKU8YTvDKUKLoK204aT0CMGZertZaAD3dtA9AkprrA\nPK0D9CdL\n",
+    "iv": "tn9C+igusYMH6GyM\n",
+    "auth_tag": "+ReZRNrfpl6ZDwYQpwm6dw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "active_record_encryption_primary_key": {
+    "encrypted_data": "UEDMuKHgZDBhpB9BwbPmtdmIDWHyS9/bSzaEbtTRvLcV8dGOE5q9lDVIIsQp\n2HE0c92p\n",
+    "iv": "tnB0pQ3OGDne3mN/\n",
+    "auth_tag": "kt234ms+bmcxJj/+FH/72Q==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
  "paperclip_secret": {
-    "encrypted_data": "VJn4Yd2N7qFV+nWXPjPA8Y2KEXL/gZs2gK5E3DZZc9ogFXV7RtpDtq+NKGJU\ndpR8ohtEZvkyC+iBkMAlnS1sSVKiLdQ1xXvbzkj04mYgjnLvwsZ19uVpBGwR\nt/DON7Bhe5Fw+OyrBQksqNcZQSpB9sMBfgA1IgCpdVGHQ8PmkMbFTaZZYcoF\n7gg3yUw5/0t3vRdL\n",
-    "iv": "X5atp/KaIurfln/u\n",
-    "auth_tag": "mVnBoUb5HwhXNYUddJbq8Q==\n",
+    "encrypted_data": "AlsnNTRF6GEyHjMHnC4VdzF4swMlppz/Gcp1xr0OuMEgQiOcW1oSZjDRZCRV\nmuGqZXZx64wqZyzTsJZ6ayCLsmWlPq6L21odHWyO+P/C5ubenSXnuCjpUn3/\nHs8WLX3kwVmqCRnVgDl2vEZ5H4XedSLr7R7YM7gQkM0UX4muMDWWnOTR8/x/\ni1ecwBY5RjdewwyR\n",
+    "iv": "RWiLePhFyPekYSl9\n",
+    "auth_tag": "sUq4ZX9CFKPbwDyuKQfNLQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "secret_key_base": {
-    "encrypted_data": "d0sNREFhzQEJhkRzielbCNBJOVAdfThv7zcYTZ1vFZ20i/mzB9GWW2nb+1yn\nNFjAq8wCLpLXn9n3FClE+WOqnAw0jwTlyScRM5lzjKI5SxHKkBQHGyFs2AF8\nqFjEvpiqxhjsc4kNOJGO8DdcyHuulXyaO9fJg8HDnU1ov1vSSuTc0ABKgycY\nMq/Xt10UXnhP8cPw\n",
-    "iv": "HFT7fdGQ2KRJ2NFy\n",
-    "auth_tag": "C55JT2msLQCoI+09VKf+Jw==\n",
+    "encrypted_data": "K5CmIXFa9mS4/dODBQAN9Bw0SFpbLiZAB8ewiYpkB8NDXP6X/BX8aDjW2Y4F\ncMvpFyiFldRBhrh1MSKTVYQEoJ3JhlNL9HCdPsAYbBEW70AuEBpHvOtD5OxH\nqgbH4Reuk6JX5AI8SwDD3zGrdT12mTFVNgSujzuZMvpi1Sro2HtRGAkjmnaa\nMGKrBV21O1CREJJg\n",
+    "iv": "/yMMmz1YtKIs5HSd\n",
+    "auth_tag": "WXgIVWjIdbMFlJhTD5J0JQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "otp_secret": {
-    "encrypted_data": "1iH7mUkaUzyn9dfDwMdiJ8X059qWSUO3DqivsOFfI1f44nMnzllaYPu6nh8O\nNLNCOzvsSAonhhaq1X+foOdyPIG2mGhE/juKveDD57/AdZAayHWsbsQlPC4l\nwdShz/ANrq0YZ/zOhpT2sZj1TZavW+S+JlxJFX2kP24D4dUzwG0vNj7522+Q\n9NAApJdUte1ZYF/b\n",
-    "iv": "00/vs5zTdoC19+pS\n",
-    "auth_tag": "3cjYqebMshnmWkQ3SdRcCQ==\n",
+    "encrypted_data": "OPLnYRySSIDOcVHy2A5V+pCrz9zVIPjdpAGmCdgQkXtJfsS9NzNtxOPwrXo6\nuQlV9iPjr1Y9ljGKYytbF0fPgAa5q6Z1oHMY9vOGs/LGKj8wHDmIvxQ+Gil1\nC+dZEePmqGaySlNSB/gNzcFIvjBH3mDxHJJe9hDxSv5miNS9l9f3UvQeLP2M\nU7/aHKagL9ZHOp/d\n",
+    "iv": "wqJBLdZhJ7M/KRG9\n",
+    "auth_tag": "dv5YyZszZCrRnTleaiGd4A==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "aws_access_key_id": {
-    "encrypted_data": "krcfpxOrAkwZR2GP4glTaFg2dw/COw8BO8I+KICqyl4bvpL5NrB9\n",
-    "iv": "paoDKp6EIU8bjxzF\n",
-    "auth_tag": "p6Pt/tz5dgGXzW5cO06nBg==\n",
+    "encrypted_data": "A1/gfcyrwT6i9W6aGTJ8pH4Dm4o8ACDxvooDroA/2N0szOiNyiYX\n",
+    "iv": "JNvf21KhdM3yoLGt\n",
+    "auth_tag": "2xaZql1ymPYuXuvXzT3ymA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "aws_secret_access_key": {
-    "encrypted_data": "aQySCT7gxeNiMMocq81KtIi+YzrZwMBeTd4LrRSN8iNEikWReJrrfagBwozy\n+Gfdw4bMGzY1dhF1Sl4=\n",
-    "iv": "R/hvvOvmqq/uoKbx\n",
-    "auth_tag": "QBJY/3+OprBXO/FSNwv2OQ==\n",
+    "encrypted_data": "T1tc01nACxhDgygKaiAq3LChGYSgmW8LAwr1aSxXmJ5D2NtypJDikiHrJbFZ\nfWFgm1qe4L8iD/k5+ro=\n",
+    "iv": "FDTPQQDLUMKW7TXx\n",
+    "auth_tag": "msY6PFFYhlwQ0X7gekSDiw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "ldap_bind_dn": {
-    "encrypted_data": "wDPABdL+DlXz2WWV4XwW20kM4EWPSwc/ajBmbdYMnjFau6c76CIBpbFhrFoj\n3mwDbHz8cgOnLNvozXSV4w6N7URCN/mWWTBHNhd3ppw=\n",
-    "iv": "8rQ0M4LT1HbCNpq9\n",
-    "auth_tag": "AuO5R6WCtd75TGJNfgFSCg==\n",
+    "encrypted_data": "C/YNROVyOxmR4O2Cy52TX41EKli2bCOMzwYD+6Hz/SiKkgidnKUHlvHlbTDq\nkWwlRDM2o8esOCKaEAGPNWcNc9IHlaSsfwhr4YWnwe0=\n",
+    "iv": "QCQF0+vH+//+nDxr\n",
+    "auth_tag": "a0PbyO/7wjufqH2acDCqmQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "ldap_password": {
-    "encrypted_data": "y0t8RuptVYiTKmUhaAWsC4c2ZzhQsYeVLeMPiQBn+Q==\n",
-    "iv": "mixYzDKkPSIDQ/l+\n",
-    "auth_tag": "DbLlZG7rlgBmyCdJ3nhSYA==\n",
+    "encrypted_data": "SqwKeiyzfvvZGqH5gi35BdW3W+Fo/AQQjso1Yfp2XA==\n",
+    "iv": "md2/etFJ1r/BKaYg\n",
+    "auth_tag": "OlCCOoYSD7ukdH2yWCd6KA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "smtp_user_name": {
-    "encrypted_data": "Ugc29HUFcirv6jOOlYNs9uvmhfwa2rG41im/MusCx0Vu0AZKcdy0krGi/kCZ\nKg==\n",
-    "iv": "ZlDK854w+vTNmeJe\n",
-    "auth_tag": "Nj95g0JMxrT419OLQIX26g==\n",
+    "encrypted_data": "0kzppmSSUg7lEyYnI5a0nf+xO0vSVx88rbxI+niIdzFOOBKSIL6uVHJ340dw\nMQ==\n",
+    "iv": "lQR77ETTtIIyaG1r\n",
+    "auth_tag": "smF2HRg8WdmD+MWwkT3TqA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "smtp_password": {
-    "encrypted_data": "D1TGjRfmM1ZeUmzwewlKXfQvvqTSzpzNlK5MKIU8dxbAH175UKn5qiemDEWe\nRYPe1LWT\n",
-    "iv": "D1OVfD5bMcefM5DP\n",
-    "auth_tag": "2E/q2gTbdXiLVnOMDeJv9w==\n",
+    "encrypted_data": "1i0m9qiZA/8k8fMKo+04uyndl1UhagtHweBFICIorWALkB68edjb8OhUDxv9\nTubiXYRC\n",
+    "iv": "IU2x4ips9HWmKoxi\n",
+    "auth_tag": "BZJTDfPBvt8cf6/MbKzUJQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "vapid_private_key": {
-    "encrypted_data": "+87bVrbd/XvWhZH1IYusc4Hla7ZZmylptAyJf48CMG/F3SMEO33OqW2I+UWh\nSkqbxai5+GaMhvZHB8U2Clod\n",
-    "iv": "HVhNdFQl0TvCcjsa\n",
-    "auth_tag": "EEQXuQ5keOHXmchhBh+Ixw==\n",
+    "encrypted_data": "+LmySMvzrV3z2z7BmJG9hpvkL06mGc87RG20XQhhdAJ2Z/5uMMjev2pUf7du\ntv2qvDJAimhkZajuDGL9R3eq\n",
+    "iv": "Mg7NhPl31O6Z4P+v\n",
+    "auth_tag": "qYWPInhgoWAjg0zQ+XXt5w==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "vapid_public_key": {
-    "encrypted_data": "nBm1lXbn1+Kzol95+QSEjsUI/n7ObhdEqEyfYcVSP/LiLy57KOBQDu6CjSMz\n+PN9yEP4lOjtscqHS29jTC2vi3PSui9XpOFHRxFBnDuyKxczrnID2KlLCNRQ\n228G3VRgFIMAWMYKACgzUk0=\n",
-    "iv": "xHrVl+4JGkQbfUW3\n",
-    "auth_tag": "rfFoBMocq17YiDSlOCvWqw==\n",
+    "encrypted_data": "NOyc+Cech9qG2HhnhajDaJMWd1OU5Rp6hws6i4xF5mLPePMJ9mJTqzklkuMK\npYSEdtcxA3KmDt1HrFxfezYUc9xO9pvlm0BPA7XAFmF/PU7/AJbFqgPU6pX/\ntSDLSdFuMB3ky+cl4DJi+O4=\n",
+    "iv": "rgUglYiHB/mhqGha\n",
+    "auth_tag": "DEX7hdNsNLi/LIrMkdUe/Q==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_key_id": {
-    "encrypted_data": "pq0+VZhjoxzLuyY34f23wOmuks9Wevt8Wu6muKZAsZMSuU0iJvlRoK/65Qa0\n",
-    "iv": "QTxO+IfYcpI170ON\n",
-    "auth_tag": "4ZHva2iBYgDv6DyhMRRXzA==\n",
+    "encrypted_data": "rPVzrYYIbcM+ssVpdL6wpCTdzLIEKXke1+eMlPLMG2gPuoh+W3eO3nFGb/s2\n",
+    "iv": "/qI8F9cvnfKG7ZXE\n",
+    "auth_tag": "z1+MPdkO/+SCaag2ULelPg==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_secret_key": {
-    "encrypted_data": "YMZqKtOXDPAME8IWWC+lO8TsxHMzawlbTju9z/Hcb5DnQAOy82QufTN90m73\n/xikUboAdKcA5YGn0mkm+Rt/ygVR6DFirYV3kwi2M3qyGVJifug=\n",
-    "iv": "9AwabheRFOgC8IKR\n",
-    "auth_tag": "iU2kkA1q8OsblN5jaZrWGQ==\n",
+    "encrypted_data": "RMnB9kZ+slbQXfpo0udYld6S1QqBxqM1YbszdLfSAdKK9I0J3Kmvh/CQ5Fbx\nyov6LClmsl1rjtH16r7cY32M4Woq+6miERdtecyDrrYkNHz0xkA=\n",
+    "iv": "pO7bm3aOtjuwYjG/\n",
+    "auth_tag": "SRvn4z1+Vd5VAGgjG64s+Q==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
@@ -107,10 +107,12 @@
      "domain": "nostr.kosmos.org",
      "real_ip_header": "x-real-ip",
      "policy_path": "/opt/strfry/strfry-policy.ts",
-      "whitelist_pubkeys": [
-        "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a",
-        "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf"
-      ],
+      "known_pubkeys": {
+        "_": "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf",
+        "accounts": "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a",
+        "bitcoincore": "47750177bb6bb113784e4973f6b2e3dd27ef1eff227d6e38d0046d618969e41a",
+        "fiatjaf": "3bf0c63fcb93463407af97a5e5ee64fa883d107ef9e558472c4eb9aaaefa459d"
+      },
      "info": {
        "name": "Kosmos Relay",
        "description": "Members-only nostr relay for kosmos.org users",
@@ -118,6 +120,11 @@
        "contact": "ops@kosmos.org",
        "icon": "https://assets.kosmos.org/img/app-icon-256px.png"
      }
+    },
+    "substr": {
+      "relay_urls": [
+        "ws://localhost:7777"
+      ]
    }
  }
 }
@@ -0,0 +1,64 @@
+{
+  "name": "garage-10",
+  "chef_environment": "production",
+  "normal": {
+    "knife_zero": {
+      "host": "10.1.1.27"
+    }
+  },
+  "automatic": {
+    "fqdn": "garage-10",
+    "os": "linux",
+    "os_version": "5.4.0-1090-kvm",
+    "hostname": "garage-10",
+    "ipaddress": "192.168.122.70",
+    "roles": [
+      "base",
+      "kvm_guest",
+      "garage_node"
+    ],
+    "recipes": [
+      "kosmos-base",
+      "kosmos-base::default",
+      "kosmos_kvm::guest",
+      "kosmos_garage",
+      "kosmos_garage::default",
+      "kosmos_garage::firewall_rpc",
+      "kosmos_garage::firewall_apis",
+      "apt::default",
+      "timezone_iii::default",
+      "timezone_iii::debian",
+      "ntp::default",
+      "ntp::apparmor",
+      "kosmos-base::systemd_emails",
+      "apt::unattended-upgrades",
+      "kosmos-base::firewall",
+      "kosmos-postfix::default",
+      "postfix::default",
+      "postfix::_common",
+      "postfix::_attributes",
+      "postfix::sasl_auth",
+      "hostname::default",
+      "firewall::default"
+    ],
+    "platform": "ubuntu",
+    "platform_version": "20.04",
+    "cloud": null,
+    "chef_packages": {
+      "chef": {
+        "version": "18.5.0",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
+        "chef_effortless": null
+      },
+      "ohai": {
+        "version": "18.1.11",
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+      }
+    }
+  },
+  "run_list": [
+    "role[base]",
+    "role[kvm_guest]",
+    "role[garage_node]"
+  ]
+}
@@ -0,0 +1,64 @@
+{
+  "name": "garage-11",
+  "chef_environment": "production",
+  "normal": {
+    "knife_zero": {
+      "host": "10.1.1.165"
+    }
+  },
+  "automatic": {
+    "fqdn": "garage-11",
+    "os": "linux",
+    "os_version": "5.15.0-1059-kvm",
+    "hostname": "garage-11",
+    "ipaddress": "192.168.122.9",
+    "roles": [
+      "base",
+      "kvm_guest",
+      "garage_node"
+    ],
+    "recipes": [
+      "kosmos-base",
+      "kosmos-base::default",
+      "kosmos_kvm::guest",
+      "kosmos_garage",
+      "kosmos_garage::default",
+      "kosmos_garage::firewall_rpc",
+      "kosmos_garage::firewall_apis",
+      "apt::default",
+      "timezone_iii::default",
+      "timezone_iii::debian",
+      "ntp::default",
+      "ntp::apparmor",
+      "kosmos-base::systemd_emails",
+      "apt::unattended-upgrades",
+      "kosmos-base::firewall",
+      "kosmos-postfix::default",
+      "postfix::default",
+      "postfix::_common",
+      "postfix::_attributes",
+      "postfix::sasl_auth",
+      "hostname::default",
+      "firewall::default"
+    ],
+    "platform": "ubuntu",
+    "platform_version": "22.04",
+    "cloud": null,
+    "chef_packages": {
+      "chef": {
+        "version": "18.5.0",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
+        "chef_effortless": null
+      },
+      "ohai": {
+        "version": "18.1.11",
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+      }
+    }
+  },
+  "run_list": [
+    "role[base]",
+    "role[kvm_guest]",
+    "role[garage_node]"
+  ]
+}
@@ -0,0 +1,64 @@
+{
+  "name": "garage-9",
+  "chef_environment": "production",
+  "normal": {
+    "knife_zero": {
+      "host": "10.1.1.223"
+    }
+  },
+  "automatic": {
+    "fqdn": "garage-9",
+    "os": "linux",
+    "os_version": "5.4.0-1090-kvm",
+    "hostname": "garage-9",
+    "ipaddress": "192.168.122.21",
+    "roles": [
+      "base",
+      "kvm_guest",
+      "garage_node"
+    ],
+    "recipes": [
+      "kosmos-base",
+      "kosmos-base::default",
+      "kosmos_kvm::guest",
+      "kosmos_garage",
+      "kosmos_garage::default",
+      "kosmos_garage::firewall_rpc",
+      "kosmos_garage::firewall_apis",
+      "apt::default",
+      "timezone_iii::default",
+      "timezone_iii::debian",
+      "ntp::default",
+      "ntp::apparmor",
+      "kosmos-base::systemd_emails",
+      "apt::unattended-upgrades",
+      "kosmos-base::firewall",
+      "kosmos-postfix::default",
+      "postfix::default",
+      "postfix::_common",
+      "postfix::_attributes",
+      "postfix::sasl_auth",
+      "hostname::default",
+      "firewall::default"
+    ],
+    "platform": "ubuntu",
+    "platform_version": "20.04",
+    "cloud": null,
+    "chef_packages": {
+      "chef": {
+        "version": "18.5.0",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
+        "chef_effortless": null
+      },
+      "ohai": {
+        "version": "18.1.11",
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+      }
+    }
+  },
+  "run_list": [
+    "role[base]",
+    "role[kvm_guest]",
+    "role[garage_node]"
+  ]
+}
@@ -63,8 +63,6 @@
      "redisio::disable_os_default",
      "redisio::configure",
      "redisio::enable",
-      "nodejs::npm",
-      "nodejs::install",
      "backup::default",
      "logrotate::default"
    ],
@@ -27,6 +27,7 @@
      "strfry::default",
      "kosmos_strfry::policies",
      "kosmos_strfry::firewall",
+      "kosmos_strfry::substr",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
@@ -5,4 +5,5 @@ run_list %w(
  strfry::default
  kosmos_strfry::policies
  kosmos_strfry::firewall
+  kosmos_strfry::substr
 )
@@ -65,7 +65,7 @@ node.default['rtl']['host'] = '10.1.1.163'
 node.default['rtl']['port'] = '3000'

 node.default['lndhub-go']['repo'] = 'https://github.com/getAlby/lndhub.go.git'
-node.default['lndhub-go']['revision'] = '0.14.0'
+node.default['lndhub-go']['revision'] = '1.0.2'
 node.default['lndhub-go']['source_dir'] = '/opt/lndhub-go'
 node.default['lndhub-go']['port'] = 3026
 node.default['lndhub-go']['domain'] = 'lndhub.kosmos.org'
@@ -73,8 +73,10 @@ node.default['lndhub-go']['postgres']['database'] = 'lndhub'
 node.default['lndhub-go']['postgres']['user'] = 'lndhub'
 node.default['lndhub-go']['postgres']['port'] = 5432
 node.default['lndhub-go']['default_rate_limit'] = 20
-node.default['lndhub-go']['strict_rate_limit'] =  1
-node.default['lndhub-go']['burst_rate_limit'] =  10
+node.default['lndhub-go']['strict_rate_limit'] = 1
+node.default['lndhub-go']['burst_rate_limit'] = 10
+node.default['lndhub-go']['service_fee'] = 1
+node.default['lndhub-go']['no_service_fee_up_to_amount'] = 1000
 node.default['lndhub-go']['branding'] = {
  'title' => 'LndHub - Kosmos Lightning',
  'desc' => 'Kosmos accounts for the Lightning Network',
@@ -66,6 +66,8 @@ template "#{source_dir}/.env" do
    default_rate_limit: node['lndhub-go']['default_rate_limit'],
    strict_rate_limit: node['lndhub-go']['strict_rate_limit'],
    burst_rate_limit: node['lndhub-go']['burst_rate_limit'],
+    service_fee: 1,
+    no_service_fee_up_to_amount: 1000,
    branding: node['lndhub-go']['branding'],
    webhook_url: node['lndhub-go']['webhook_url'],
    sentry_dsn: credentials['sentry_dsn']
@@ -84,6 +84,12 @@ hosts = [
    sql_database: "ejabberd",
    ldap_enabled: true,
    ldap_password: ejabberd_credentials['kosmos_ldap_password'],
+    certfiles: [
+      "/opt/ejabberd/conf/kosmos.org.crt",
+      "/opt/ejabberd/conf/kosmos.org.key",
+      "/opt/ejabberd/conf/kosmos.chat.crt",
+      "/opt/ejabberd/conf/kosmos.chat.key"
+    ],
    append_host_config: <<-EOF
    modules:
      mod_disco:
@@ -114,6 +120,10 @@ hosts = [
    sql_database: "ejabberd_5apps",
    ldap_enabled: true,
    ldap_password: ejabberd_credentials['5apps_ldap_password'],
+    certfiles: [
+      "/opt/ejabberd/conf/5apps.com.crt",
+      "/opt/ejabberd/conf/5apps.com.key"
+    ],
    append_host_config: <<-EOF
    modules:
      mod_disco:
@@ -15,7 +15,7 @@ set -e
 # letsencrypt live folder
 for domain in $RENEWED_DOMAINS; do
  case $domain in
-  kosmos.org|5apps.com)
+  kosmos.org|kosmos.chat|5apps.com)
    cp "${RENEWED_LINEAGE}/privkey.pem" /opt/ejabberd/conf/$domain.key
    cp "${RENEWED_LINEAGE}/fullchain.pem" /opt/ejabberd/conf/$domain.crt
    chown ejabberd:ejabberd /opt/ejabberd/conf/$domain.*
@@ -42,13 +42,20 @@ end

 # Generate a Let's Encrypt cert (only if no cert has been generated before).
 # The systemd timer will take care of renewing
-execute "letsencrypt cert for kosmos xmpp" do
-  command "certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d kosmos.chat -d uploads.xmpp.kosmos.org -n"
+execute "letsencrypt cert for kosmos.org domains" do
+  command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.org\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d uploads.xmpp.kosmos.org -n"
  not_if do
    File.exist?("/etc/letsencrypt/live/kosmos.org/fullchain.pem")
  end
 end

+execute "letsencrypt cert for kosmos.chat" do
+  command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth letsencrypt.kosmos.org\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.org\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.chat -n"
+  not_if do
+    File.exist?("/etc/letsencrypt/live/kosmos.chat/fullchain.pem")
+  end
+end
+
 # Generate a Let's Encrypt cert (only if no cert has been generated before).
 # The systemd timer will take care of renewing
 execute "letsencrypt cert for 5apps xmpp" do
@@ -1,7 +1,8 @@
 # Generated by Chef for <%= @host[:name] %>
 certfiles:
-  - "/opt/ejabberd/conf/<%= @host[:name] %>.crt"
-  - "/opt/ejabberd/conf/<%= @host[:name] %>.key"
+<% @host[:certfiles].each do |certfile| %>
+  - <%= certfile %>
+<% end %>
 host_config:
  "<%= @host[:name] %>":
    sql_type: pgsql
@@ -4,6 +4,7 @@ upstream_host = search(:node, "role:hubot").first["knife_zero"]["host"]

 tls_cert_for domain do
  auth "gandi_dns"
+  acme_domain "letsencrypt.kosmos.org"
  action :create
 end

@@ -5,6 +5,7 @@ upstream_host = search(:node, "role:hubot").first["knife_zero"]["host"]

 tls_cert_for domain do
  auth "gandi_dns"
+  acme_domain "letsencrypt.kosmos.org"
  action :create
 end

@@ -1,5 +1,5 @@
 node.default["kosmos-mastodon"]["repo"]              = "https://gitea.kosmos.org/kosmos/mastodon.git"
-node.default["kosmos-mastodon"]["revision"]          = "production"
+node.default["kosmos-mastodon"]["revision"]          = "production-4.3"
 node.default["kosmos-mastodon"]["directory"]         = "/opt/mastodon"
 node.default["kosmos-mastodon"]["bind_ip"]           = "127.0.0.1"
 node.default["kosmos-mastodon"]["app_port"]          = 3000
@@ -3,7 +3,7 @@
 # Recipe:: default
 #

-node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_16.x"
+node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_18.x"

 include_recipe "kosmos-nodejs"
 include_recipe "java"
@@ -71,11 +71,7 @@ package %w(build-essential imagemagick ffmpeg libxml2-dev libxslt1-dev file git
           curl pkg-config libprotobuf-dev protobuf-compiler libidn11
           libidn11-dev libjemalloc2 libpq-dev)

-npm_package "yarn" do
-  version "1.22.4"
-end
-
-ruby_version = "3.3.0"
+ruby_version = "3.3.5"

 ruby_path = "/opt/ruby_build/builds/#{ruby_version}"
 bundle_path = "#{ruby_path}/bin/bundle"
@@ -194,6 +190,9 @@ template "#{mastodon_path}/.env.#{rails_env}" do
  variables redis_url: node["kosmos-mastodon"]["redis_url"],
            domain: node["kosmos-mastodon"]["domain"],
            alternate_domains: node["kosmos-mastodon"]["alternate_domains"],
+            active_record_encryption_deterministic_key: credentials["active_record_encryption_deterministic_key"],
+            active_record_encryption_key_derivation_salt: credentials["active_record_encryption_key_derivation_salt"],
+            active_record_encryption_primary_key: credentials["active_record_encryption_primary_key"],
            paperclip_secret: credentials['paperclip_secret'],
            secret_key_base: credentials['secret_key_base'],
            otp_secret: credentials['otp_secret'],
@@ -231,7 +230,7 @@ execute "yarn install" do
  environment deploy_env
  user mastodon_user
  cwd mastodon_path
-  command "yarn install --frozen-lockfile"
+  command "corepack prepare && yarn install --immutable"
 end

 execute "rake assets:precompile" do
@@ -12,6 +12,9 @@ LOCAL_HTTPS=true

 # Application secrets
 # Generate each with the `rake secret` task (`docker-compose run --rm web rake secret` if you use docker compose)
+ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=<%= @active_record_encryption_deterministic_key %>
+ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=<%= @active_record_encryption_key_derivation_salt %>
+ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=<%= @active_record_encryption_primary_key %>
 PAPERCLIP_SECRET=<%= @paperclip_secret %>
 SECRET_KEY_BASE=<%= @secret_key_base %>
 OTP_SECRET=<%= @otp_secret %>
@@ -1,2 +1,8 @@
 node.default["strfry"]["ldap_search_dn"] = "ou=kosmos.org,cn=users,dc=kosmos,dc=org"
 node.default["strfry"]["extras_dir"] = "/opt/strfry"
+
+node.default["substr"]["repo"] = "https://gitea.kosmos.org/kosmos/substr.git"
+node.default["substr"]["revision"] = "master"
+node.default["substr"]["workdir"] = "/opt/substr"
+node.default["substr"]["port"] = 30023
+node.default["substr"]["relay_urls"] = ["ws://localhost:7777"]
@@ -24,7 +24,7 @@ env = {
  ldap_bind_dn: ldap_credentials["service_dn"],
  ldap_password: ldap_credentials["service_password"],
  ldap_search_dn: node["strfry"]["ldap_search_dn"],
-  whitelist_pubkeys: node["strfry"]["whitelist_pubkeys"].join(",")
+  whitelist_pubkeys: node["strfry"]["known_pubkeys"].values.join(",")
 }

 template "#{extras_dir}/.env" do
@@ -0,0 +1,99 @@
+#
+# Cookbook:: kosmos_strfry
+# Recipe:: substr
+#
+
+unless platform?("ubuntu")
+  raise "This recipe only supports Ubuntu installs at the moment"
+end
+
+apt_package "imagemagick"
+
+if node["substr"]["download_url"]
+  #
+  # Install by downloading an executable file
+  #
+  remote_file '/usr/local/bin/substr' do
+    source node["substr"]["download_url"]
+    checksum node["substr"]["checksum"]
+    mode '0755'
+    show_progress true
+    notifies :restart, "service[substr]", :delayed
+  end
+else
+  # TODO Install Deno 2
+end
+
+directory node["substr"]["workdir"] do
+  owner node["strfry"]["user"]
+  group node["strfry"]["group"]
+  mode "0755"
+end
+
+git node["substr"]["workdir"] do
+  user node["strfry"]["user"]
+  group node["strfry"]["group"]
+  repository node['substr']['repo']
+  revision node['substr']['revision']
+  action :sync
+  notifies :restart, "service[substr]", :delayed
+end
+
+file "#{node["substr"]["workdir"]}/users.yaml" do
+  mode "0644"
+  owner node["strfry"]["user"]
+  group node["strfry"]["group"]
+  content node["strfry"]["known_pubkeys"].to_yaml
+  notifies :restart, "service[substr]", :delayed
+end
+
+ldap_credentials = Chef::EncryptedDataBagItem.load('credentials', 'dirsrv')
+
+env = {
+  port: node['substr']['port'],
+  base_url: "https://#{node["strfry"]["domain"]}",
+  relay_urls: node['substr']['relay_urls'].join(","),
+  ldap_url: 'ldap://ldap.kosmos.local:389', # requires "ldap_client" role
+  ldap_bind_dn: ldap_credentials["service_dn"],
+  ldap_password: ldap_credentials["service_password"],
+  ldap_search_dn: node["strfry"]["ldap_search_dn"],
+}
+
+template "#{node["substr"]["workdir"]}/.env" do
+  source 'env.erb'
+  owner node["strfry"]["user"]
+  group node["strfry"]["group"]
+  mode 0600
+  sensitive true
+  variables config: env
+  notifies :restart, "service[substr]", :delayed
+end
+
+systemd_unit "substr.service" do
+  content({
+    Unit: {
+      Description: "substr for nostr",
+      Documentation: ["https://gitea.kosmos.org/kosmos/substr"],
+    },
+    Service: {
+      Type: "simple",
+      User: node["strfry"]["user"],
+      WorkingDirectory: node["substr"]["workdir"],
+      ExecStart: "/usr/local/bin/substr",
+      Restart: "on-failure",
+      RestartSec: "5",
+      ProtectHome: "no",
+      NoNewPrivileges: "yes",
+      ProtectSystem: "full"
+    },
+    Install: {
+      WantedBy: "multi-user.target"
+    }
+  })
+  triggers_reload true
+  action :create
+end
+
+service "substr" do
+  action [:enable, :start]
+end
@@ -4,6 +4,12 @@ upstream _strfry {
 <% end %>
 }

+upstream _substr {
+<% @upstream_hosts.each do |host| %>
+  server <%= host %>:30023;
+<% end %>
+}
+
 server {
  server_name <%= @domain %>;
  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
@@ -15,6 +21,16 @@ server {
  ssl_certificate     <%= @ssl_cert %>;
  ssl_certificate_key <%= @ssl_key %>;

+  location = /favicon.ico {
+    alias /var/www/assets.kosmos.org/site/img/favicon.ico;
+  }
+
+  location ~* ^/[@~n]|^/assets {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_pass http://_substr;
+  }
+
  location / {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
@@ -6,6 +6,7 @@
 redirects = [
  {
    domain: "kosmos.chat",
+    acme_domain: "letsencrypt.kosmos.org",
    target: "https://kosmos.org",
    http_status: 307
  },
Author	SHA1	Message	Date
raucao	c878ed1a1e	WIP Deploy substr	2024-12-09 18:21:55 +04:00
raucao	c8160e38c8	Turn known pubkeys into object with usernames	2024-12-09 18:21:55 +04:00
raucao	67cd89b7b8	Merge pull request 'Fix TLS cert updates for kosmos.chat' (#578 ) from chore/fix_cert_updates_kosmos-chat into master Reviewed-on: #578	2024-12-09 14:21:05 +00:00
raucao	e4112a3626	Fix TLS cert updates for kosmos.chat Some recipes weren't updated for the proxy validation yet. Needed to split the ejabberd cert in two, so it can do normal validation on `.org` and proxy validation on `.chat`.	2024-12-09 18:17:10 +04:00
raucao	89813465b2	Merge pull request 'Upgrade Mastodon to 4.3' (#577 ) from chore/upgrade_mastodon into master Reviewed-on: #577	2024-12-09 14:14:35 +00:00
raucaoandgreg	6106e627e2	Upgrade Mastodon to 4.3 Co-authored-by: Greg Karékinian <greg@karekinian.com>	2024-12-09 18:12:45 +04:00
raucao	d8baa41c14	Add new node configs	2024-12-09 18:11:51 +04:00
greg	8405b8df52	Merge pull request 'Upgrade lndhub.go to 1.0.2, add service fee config' (#576 ) from chore/upgrade_lndhub into master Reviewed-on: #576 Reviewed-by: Greg <greg@noreply.kosmos.org>	2024-10-20 19:27:19 +00:00
raucaoandbumi	b4019b224b	Upgrade lndhub.go to 1.0.2, add service fee config Co-authored-by: Michael Bumann <hello@michaelbumann.com>	2024-10-18 12:36:41 +02:00