Compare commits
29 Commits
21de964e1b
...
jammy_jell
| Author | SHA1 | Date | |
|---|---|---|---|
|
401b03cc1e
|
||
| f843a31e03 | |||
|
ff313525c8
|
|||
|
cfb379741e
|
|||
|
0c29fad404
|
|||
| 416935d8b5 | |||
|
2b6f81c5d6
|
|||
| 18496bb0da | |||
|
d878b4208e
|
|||
|
d31440d235
|
|||
|
6f287f14ef
|
|||
|
b77df3d0db
|
|||
| f7f5a0069d | |||
|
989185f951
|
|||
|
4cbda69a6b
|
|||
|
6931fe05d0
|
|||
|
b248ef70db
|
|||
|
45159ad4e7
|
|||
| 612cd0c55e | |||
|
83380047bb
|
|||
|
8aebb386a4
|
|||
| a8c4f0bd0e | |||
|
12b4fb37fa
|
|||
|
263eb88b72
|
|||
|
25ee38fe27
|
|||
| e701938442 | |||
| 309bc45791 | |||
|
82a4af05ef
|
|||
|
4a8ab3abe3
|
@@ -1,65 +1,72 @@
|
||||
{
|
||||
"id": "akkounts",
|
||||
"postgresql_username": {
|
||||
"encrypted_data": "l00Lmdbl5xNq07XU4XmcnRxXsIJaYyMQQ6xI\n",
|
||||
"iv": "yxvL6hKwlVWmdMzl\n",
|
||||
"auth_tag": "mMCV9ewJW/0TfVE76WBSZw==\n",
|
||||
"encrypted_data": "bDlOkEmhvMgyVzPeTNUzYnzRLf3T9cc0cDxt\n",
|
||||
"iv": "GCCUoqU5pxQ7fGkv\n",
|
||||
"auth_tag": "Q7mrSHIBluMe3CGVmoR86Q==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"postgresql_password": {
|
||||
"encrypted_data": "Q6xWsH6bmI1GfMzme3mBRYrt3XmDwFJ7E4FjYg2Rrw==\n",
|
||||
"iv": "jcQmuT7Jz3g3XE8d\n",
|
||||
"auth_tag": "nNMvf9UmP6ikf1BW93QZIw==\n",
|
||||
"encrypted_data": "wD0HtdsNe/hl4ZaOy8hyr2k4z8TXQrrSja3KNVE47w==\n",
|
||||
"iv": "tb5yz8WDer0CsGvJ\n",
|
||||
"auth_tag": "/+K2anuCff/6M7Pu70Smqw==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"sentry_dsn": {
|
||||
"encrypted_data": "V7cqlH2baN1Ix/ggQFeo9PY6dNKKpnDECaB1cO3XuCfy74oN2ot44nbpCQTA\nUl0+1LQv/qNn/L4gmJkqZfdIXZQqhR+iTc06UJxe3aTKJDw=\n",
|
||||
"iv": "HJtdKYcApwaxhTXI\n",
|
||||
"auth_tag": "qyIYK9h6nciJTFXBWOjVOA==\n",
|
||||
"encrypted_data": "jCz681x0WVixHYZUb62TO+1cgyJMiJ2UMqWcaztx57yDBOIiKW3oSZjuXdhP\n9WCesfXQF/lgzITZno3IKDqzlKjWgbGLC75y8FLguxidCHI=\n",
|
||||
"iv": "IRNOzN/hLwg1iqax\n",
|
||||
"auth_tag": "eg9dWnEK04JDb94e4CFa9Q==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"rails_master_key": {
|
||||
"encrypted_data": "KAl2Kgq1TXjOm4TNxGwZkPwJeOSNLbLLKiRdb4fTyBFfUhIGGeCS9VvV9kIb\n9sQZ6HLU\n",
|
||||
"iv": "BBPvDNs6nBXDti5I\n",
|
||||
"auth_tag": "yjM/0nyUwt+5SSGuLC5qWA==\n",
|
||||
"encrypted_data": "nUB77VLRp41rluH7hLBwQqPtnh/HsmfLr2VbcIZHWawL3o2TGuY+mj648f9L\n7XsEpgqY\n",
|
||||
"iv": "fpdbDitqTRHxEKiv\n",
|
||||
"auth_tag": "I44fn8Ott3L/Y5LYr56U/Q==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"discourse_connect_secret": {
|
||||
"encrypted_data": "YHkZGzXeK3nDHaXt3JKmGtCcvMfgvv3yHbvS2C+CLKagOIOe+0+2/CiNuh4U\nxO1Pug==\n",
|
||||
"iv": "SnUxDpIMQum8ySfN\n",
|
||||
"auth_tag": "Ny6I+3EoCA1s74JLjjbbyQ==\n",
|
||||
"encrypted_data": "ENtMn+1XTVFmdEZw7LU6WGoMbSZY654ggm3vPACGfFgqo6r0LhG60c5OTdqv\nZvT5/Q==\n",
|
||||
"iv": "bL1BmvRhgxFqSM1P\n",
|
||||
"auth_tag": "sEBZzGWwwYFHn+4B4SsyCA==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"lndhub_admin_token": {
|
||||
"encrypted_data": "dJHxB80Enwkm+2aNuIrp7lILAy2J5tQaChPJCl/BHwMo\n",
|
||||
"iv": "zHLtD1jTIwvjMt1l\n",
|
||||
"auth_tag": "IC0adEzsS5YF5YHqabWw2A==\n",
|
||||
"encrypted_data": "4LPGFoARzI8UYnsJPIk8sax/rAA16pUULEZWn86e2C7L\n",
|
||||
"iv": "nvjXrOwgfgutwEVw\n",
|
||||
"auth_tag": "A89RUf1sdcS3FVscNPWYLg==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"btcpay_auth_token": {
|
||||
"encrypted_data": "YbM0HvgIijluKQBcgfKn6hmWvdbhr0ijR1xKc+BRZCZJsRaJBHTjCbwhH8T9\nVnBESruyjhxphtBetcc=\n",
|
||||
"iv": "3107v/c2Tonx6/cP\n",
|
||||
"auth_tag": "jnO9fvoXJW5gbDMRjkdMPA==\n",
|
||||
"encrypted_data": "ky5iWYF06os0Ek6vIRzWqMTekqJhCOh/Q9DTDIeKhSyk8TnT3O71lCNEt1F5\nXCNq6ux3V6oyHVLWj0o=\n",
|
||||
"iv": "zk6WnxsY89oNW1F9\n",
|
||||
"auth_tag": "FAIMXKvQ1T7QKezVSNJbwQ==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"s3_access_key": {
|
||||
"encrypted_data": "PFjQKe1us12SNHlReQ4f0qctulPp4d2F3t5t+AGocp87PS/kZx77rtHQtruK\n",
|
||||
"iv": "BGD8+XchqwPmhhwi\n",
|
||||
"auth_tag": "XefaZKCVs8hotszALN+kxQ==\n",
|
||||
"encrypted_data": "KfhfEGwPjOonlz6rpnNTinXFPqX/sIbqQn/aby0UDi/G/7cvEcOiNcCkfuSz\n",
|
||||
"iv": "Q3rg06v6K9pUDLDY\n",
|
||||
"auth_tag": "G5ugdlJ896KtYtObKLclJA==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"s3_secret_key": {
|
||||
"encrypted_data": "ziO35x8P1YMaSeenMNQoTWug62b5ZVLFlkMlJEFGnYjHK5qTAn6ir06WnMJC\n0zErzTZsPpcr7KpE/ipWgWHRy7qVbGnd6iVO4t9tf5NjiU2OXfA=\n",
|
||||
"iv": "S3syCCxh2m+mylLu\n",
|
||||
"auth_tag": "ZMkyBqXMXr3K3LGqxWvbtA==\n",
|
||||
"encrypted_data": "N8s1OoDrYXHjqSydQA0kY7dd68Aelq4+/cgmJlYfP92u4YA17V4TR7fsvQZL\nkqjuUSClNYPc0XiCwf/5gxVirE9AO6OmmvSV7lUyu4hcEY6unrU=\n",
|
||||
"iv": "bXzIVWnX6V0P6PRb\n",
|
||||
"auth_tag": "1EOjCfsX9P6ETjUsgBvBsA==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"nostr_private_key": {
|
||||
"encrypted_data": "Sf8PEyQ0sqcgxddSlIDxLOVzPjOkTFObsYuTgcxkbEV7igrati4e8QVVUEBD\n1yoLJXelp8jlCr28Ectci29jc53gYSMTLSQsw97uYas2R0dGCqQ=\n",
|
||||
"iv": "+1CIUyvIUOveLrY4\n",
|
||||
"auth_tag": "GDqS+IuAIfMBmHIeFXaV7A==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
}
|
||||
|
||||
24
data_bags/credentials/gandi_api.json
Normal file
24
data_bags/credentials/gandi_api.json
Normal file
@@ -0,0 +1,24 @@
|
||||
{
|
||||
"id": "gandi_api",
|
||||
"key": {
|
||||
"encrypted_data": "d3/rJMX6B9GuzUt0/mIk/lgQ3qGyQdbNXH6UEm3ZX7DeSl+rbW9FPJCRWg==\n",
|
||||
"iv": "15YVAYla7PqqVOab\n",
|
||||
"auth_tag": "xQSq+ld6SDOAER07N4ZkUQ==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"access_token": {
|
||||
"encrypted_data": "geQwcNosiJZmqbbMpD/I+a2yueBzpV6C8Rb7vrCD8kR161ZRjvqLe+g/1XpT\n2/65wKYDMTrdto1I030=\n",
|
||||
"iv": "1sj58eyooOZ8FTYn\n",
|
||||
"auth_tag": "yBNfgWXaToc06VDLly/HUw==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"domains": {
|
||||
"encrypted_data": "p5rIQTyCE+0d4HIuA4GKEAFekh7qEC4xe9Rm/kP0DyzY83FO0/4uKIvYoZRB\n",
|
||||
"iv": "LWlx98NSS1/ngCH1\n",
|
||||
"auth_tag": "FID+x/LjTZ3cgQV5U2xZLA==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
}
|
||||
}
|
||||
@@ -1,9 +0,0 @@
|
||||
{
|
||||
"id": "gandi_api_5apps",
|
||||
"key": {
|
||||
"encrypted_data": "+tcD9x5MkNpf2Za5iLM7oTGrmAXxuWFEbyg4xrcWypSkSTjdIncOfD1UoIoS\nGzy1\n",
|
||||
"iv": "ymls2idI/PdiRZCgsulwrA==\n",
|
||||
"version": 1,
|
||||
"cipher": "aes-256-cbc"
|
||||
}
|
||||
}
|
||||
@@ -1,79 +1,93 @@
|
||||
{
|
||||
"id": "mastodon",
|
||||
"paperclip_secret": {
|
||||
"encrypted_data": "orOIbqFANPCkd4sUTCyyoh4z1o6SBudgH4wKJudTo9dANaHGhWcBUFKrhZi1\nMJTBQx/d0hiDI1P2XN3h+hROCg3JJ8OClUSJH9CfN5GlbWvXh0Nhq7hqy8L3\nLAPL+uigiXI6ObrnKQoD8LeJIB46233uwaCA/7zB6gah0ExJ2DXGH6qq9JSS\nqmTFiy+hT+VHGrUo\n",
|
||||
"iv": "U4E4NLYLkP0/tTTs\n",
|
||||
"auth_tag": "WKQ+pDPZp7B791lhC5j3iQ==\n",
|
||||
"encrypted_data": "VJn4Yd2N7qFV+nWXPjPA8Y2KEXL/gZs2gK5E3DZZc9ogFXV7RtpDtq+NKGJU\ndpR8ohtEZvkyC+iBkMAlnS1sSVKiLdQ1xXvbzkj04mYgjnLvwsZ19uVpBGwR\nt/DON7Bhe5Fw+OyrBQksqNcZQSpB9sMBfgA1IgCpdVGHQ8PmkMbFTaZZYcoF\n7gg3yUw5/0t3vRdL\n",
|
||||
"iv": "X5atp/KaIurfln/u\n",
|
||||
"auth_tag": "mVnBoUb5HwhXNYUddJbq8Q==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"secret_key_base": {
|
||||
"encrypted_data": "vweClhdY8SqQkK+p0OYUL2B6Fsz5eQDpEYWCtd/eRJfwwYAObbLcMWRC6MwE\neQVMw59bOqYc3RBuv/+WPLtENazA1bYCXBXQr1J6xqjJAz0Mo6KbRyxy5n78\nv8q6RSiao1VVIUXohtFlQgWeV6x5sz34bJxjlHinKvKsgiGXiuVBxYUUfzWQ\nuzrGug09cpZBqfpc\n",
|
||||
"iv": "Z0/csEBH5/X1+MR+\n",
|
||||
"auth_tag": "fTvBN6eovi3JVEK0ZX97Nw==\n",
|
||||
"encrypted_data": "d0sNREFhzQEJhkRzielbCNBJOVAdfThv7zcYTZ1vFZ20i/mzB9GWW2nb+1yn\nNFjAq8wCLpLXn9n3FClE+WOqnAw0jwTlyScRM5lzjKI5SxHKkBQHGyFs2AF8\nqFjEvpiqxhjsc4kNOJGO8DdcyHuulXyaO9fJg8HDnU1ov1vSSuTc0ABKgycY\nMq/Xt10UXnhP8cPw\n",
|
||||
"iv": "HFT7fdGQ2KRJ2NFy\n",
|
||||
"auth_tag": "C55JT2msLQCoI+09VKf+Jw==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"otp_secret": {
|
||||
"encrypted_data": "o1ts1bUgPIzFQXjJ2MpBMLntWkyPxDaJAaU1K3WzmNMXnw5MVlkKKCEFVccd\nPss/MwDuBkbNPhri3ZkH48m9SiayWETVYvw5GZzcVsw4TeMu915O44lfl9tX\nW3XHU+DBps1BVH9535R4X9M1aFW4W4XfwHtS5wcrZqtVhNhS3NSgE4JpN/Dz\nFdcFAOhflnt8fIAN\n",
|
||||
"iv": "QLsxmIlX1NpxMyHz\n",
|
||||
"auth_tag": "j1h/PvIoqshTBN5c5IaAsA==\n",
|
||||
"encrypted_data": "1iH7mUkaUzyn9dfDwMdiJ8X059qWSUO3DqivsOFfI1f44nMnzllaYPu6nh8O\nNLNCOzvsSAonhhaq1X+foOdyPIG2mGhE/juKveDD57/AdZAayHWsbsQlPC4l\nwdShz/ANrq0YZ/zOhpT2sZj1TZavW+S+JlxJFX2kP24D4dUzwG0vNj7522+Q\n9NAApJdUte1ZYF/b\n",
|
||||
"iv": "00/vs5zTdoC19+pS\n",
|
||||
"auth_tag": "3cjYqebMshnmWkQ3SdRcCQ==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"aws_access_key_id": {
|
||||
"encrypted_data": "YQHUx0GugKu0AtlbGLRGocFEhTGAghWA0DUs1Nxs4Hd3bTIp4lyM\n",
|
||||
"iv": "54zt2tkQhHtpY7sO\n",
|
||||
"auth_tag": "ofBJx3QDsjHe66ga3nji8g==\n",
|
||||
"encrypted_data": "krcfpxOrAkwZR2GP4glTaFg2dw/COw8BO8I+KICqyl4bvpL5NrB9\n",
|
||||
"iv": "paoDKp6EIU8bjxzF\n",
|
||||
"auth_tag": "p6Pt/tz5dgGXzW5cO06nBg==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"aws_secret_access_key": {
|
||||
"encrypted_data": "FAz6xZ+wsCz/KFA+DK6f4V04rxJt+9U/yXUGF9tvce0VqB3scH+T0KDDn1/n\nZ/0G0Tbxt2urRPbPUdI=\n",
|
||||
"iv": "iapSpeM6lfDMIfNk\n",
|
||||
"auth_tag": "HlkwUnNeJlOUrZ3ieN5xAQ==\n",
|
||||
"encrypted_data": "aQySCT7gxeNiMMocq81KtIi+YzrZwMBeTd4LrRSN8iNEikWReJrrfagBwozy\n+Gfdw4bMGzY1dhF1Sl4=\n",
|
||||
"iv": "R/hvvOvmqq/uoKbx\n",
|
||||
"auth_tag": "QBJY/3+OprBXO/FSNwv2OQ==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"ldap_bind_dn": {
|
||||
"encrypted_data": "wDPABdL+DlXz2WWV4XwW20kM4EWPSwc/ajBmbdYMnjFau6c76CIBpbFhrFoj\n3mwDbHz8cgOnLNvozXSV4w6N7URCN/mWWTBHNhd3ppw=\n",
|
||||
"iv": "8rQ0M4LT1HbCNpq9\n",
|
||||
"auth_tag": "AuO5R6WCtd75TGJNfgFSCg==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"ldap_password": {
|
||||
"encrypted_data": "y0t8RuptVYiTKmUhaAWsC4c2ZzhQsYeVLeMPiQBn+Q==\n",
|
||||
"iv": "mixYzDKkPSIDQ/l+\n",
|
||||
"auth_tag": "DbLlZG7rlgBmyCdJ3nhSYA==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"smtp_user_name": {
|
||||
"encrypted_data": "ivB09/mCRrUaz9X4NFRBiqytjgy/vxN5Nha7gopFq5eSu9v4K9MkaLRqHh1I\nYw==\n",
|
||||
"iv": "a8WKhRKsUjqBtfmn\n",
|
||||
"auth_tag": "ib5WJNNaO7bRIspdACmOLw==\n",
|
||||
"encrypted_data": "Ugc29HUFcirv6jOOlYNs9uvmhfwa2rG41im/MusCx0Vu0AZKcdy0krGi/kCZ\nKg==\n",
|
||||
"iv": "ZlDK854w+vTNmeJe\n",
|
||||
"auth_tag": "Nj95g0JMxrT419OLQIX26g==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"smtp_password": {
|
||||
"encrypted_data": "FxPz2e7fUNqcAu+DDJKlqn8rcSBLmnzigTFf5moZlQ1zz4YVl6pqHisa22Qz\nbfUx9rjU\n",
|
||||
"iv": "GvRlNDV/b1WawtOP\n",
|
||||
"auth_tag": "kyRCGfSJQelIwThDT4iQQQ==\n",
|
||||
"encrypted_data": "D1TGjRfmM1ZeUmzwewlKXfQvvqTSzpzNlK5MKIU8dxbAH175UKn5qiemDEWe\nRYPe1LWT\n",
|
||||
"iv": "D1OVfD5bMcefM5DP\n",
|
||||
"auth_tag": "2E/q2gTbdXiLVnOMDeJv9w==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"vapid_private_key": {
|
||||
"encrypted_data": "DlbEAhd+SkSJoOSuwGhd5bdFlJADnT0w4u0+6m8AJoWJjoSCGAnzzmdHWT/k\nVUDkwiBCkqmEPK0oTvxnl/a8\n",
|
||||
"iv": "6e0Gay7GVrQad1rI\n",
|
||||
"auth_tag": "jjVundJ/ITxP/oYgEgzElg==\n",
|
||||
"encrypted_data": "+87bVrbd/XvWhZH1IYusc4Hla7ZZmylptAyJf48CMG/F3SMEO33OqW2I+UWh\nSkqbxai5+GaMhvZHB8U2Clod\n",
|
||||
"iv": "HVhNdFQl0TvCcjsa\n",
|
||||
"auth_tag": "EEQXuQ5keOHXmchhBh+Ixw==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"vapid_public_key": {
|
||||
"encrypted_data": "+m37w/eWYqdEjsEYQw27FvQC+37ucruOFjZAjo0OgCwA0SoVz4VHX2eSA2AK\njX4CnM91cY4e/WG/ZHKlOMN1PftyQn2bdGaw35nXDanep8z0ROa01JEEi5DE\nUFRKvBmPInTeR6xvemuj7GM=\n",
|
||||
"iv": "loYbGrAsWGLUZ+BK\n",
|
||||
"auth_tag": "lAfpEEVQq+n7MLLm/kpmIA==\n",
|
||||
"encrypted_data": "nBm1lXbn1+Kzol95+QSEjsUI/n7ObhdEqEyfYcVSP/LiLy57KOBQDu6CjSMz\n+PN9yEP4lOjtscqHS29jTC2vi3PSui9XpOFHRxFBnDuyKxczrnID2KlLCNRQ\n228G3VRgFIMAWMYKACgzUk0=\n",
|
||||
"iv": "xHrVl+4JGkQbfUW3\n",
|
||||
"auth_tag": "rfFoBMocq17YiDSlOCvWqw==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"s3_key_id": {
|
||||
"encrypted_data": "4B8OQ0iVCCna4FvC+EuS5prEUWaHRm1+tzXGmFoCQ4WZfhUA1HwT3x651e/R\n",
|
||||
"iv": "1/zGwcQPQQQCiXIs\n",
|
||||
"auth_tag": "siK9ph1q3/VVEycy91wkqQ==\n",
|
||||
"encrypted_data": "pq0+VZhjoxzLuyY34f23wOmuks9Wevt8Wu6muKZAsZMSuU0iJvlRoK/65Qa0\n",
|
||||
"iv": "QTxO+IfYcpI170ON\n",
|
||||
"auth_tag": "4ZHva2iBYgDv6DyhMRRXzA==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"s3_secret_key": {
|
||||
"encrypted_data": "BSAc8dE/rQUiVvTGV6Ee/ZUDpq4HZlpoaCZ+lbQAbcnxui4ib0OTLPFwhVJ9\n4OQWahtSzkqxMc6MKWpadLT1a3oTnvnae9b3u40X5b2P3VyZYCM=\n",
|
||||
"iv": "bqw8GTqLMTs5vD5n\n",
|
||||
"auth_tag": "+e48L1lYVNda7VE3uLOAHA==\n",
|
||||
"encrypted_data": "YMZqKtOXDPAME8IWWC+lO8TsxHMzawlbTju9z/Hcb5DnQAOy82QufTN90m73\n/xikUboAdKcA5YGn0mkm+Rt/ygVR6DFirYV3kwi2M3qyGVJifug=\n",
|
||||
"iv": "9AwabheRFOgC8IKR\n",
|
||||
"auth_tag": "iU2kkA1q8OsblN5jaZrWGQ==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
}
|
||||
|
||||
@@ -3,6 +3,7 @@
|
||||
"override_attributes": {
|
||||
"akkounts": {
|
||||
"btcpay": {
|
||||
"public_url": "https://btcpay.kosmos.org",
|
||||
"store_id": "FNJVVsrVkKaduPDAkRVchdegjwzsNhpceAdonCaXAwBX"
|
||||
},
|
||||
"ejabberd": {
|
||||
@@ -11,6 +12,9 @@
|
||||
"lndhub": {
|
||||
"public_url": "https://lndhub.kosmos.org",
|
||||
"public_key": "024cd3be18617f39cf645851e3ba63f51fc13f0bb09e3bb25e6fd4de556486d946"
|
||||
},
|
||||
"nostr": {
|
||||
"public_key": "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a"
|
||||
}
|
||||
},
|
||||
"discourse": {
|
||||
@@ -33,8 +37,7 @@
|
||||
"hostmaster@kosmos.org": "mail@kosmos.org",
|
||||
"postmaster@kosmos.org": "mail@kosmos.org",
|
||||
"abuse@kosmos.org": "mail@kosmos.org",
|
||||
"mail@kosmos.org": "foundation@kosmos.org",
|
||||
"hackerhouse@kosmos.org": "mail@lagrange6.com"
|
||||
"mail@kosmos.org": "foundation@kosmos.org"
|
||||
}
|
||||
},
|
||||
"garage": {
|
||||
@@ -73,6 +76,7 @@
|
||||
},
|
||||
"kosmos-mastodon": {
|
||||
"domain": "kosmos.social",
|
||||
"user_address_domain": "kosmos.social",
|
||||
"s3_endpoint": "http://localhost:3900",
|
||||
"s3_region": "garage",
|
||||
"s3_bucket": "kosmos-social",
|
||||
|
||||
@@ -14,6 +14,7 @@
|
||||
"ipaddress": "192.168.122.161",
|
||||
"roles": [
|
||||
"kvm_guest",
|
||||
"ldap_client",
|
||||
"garage_gateway",
|
||||
"mastodon",
|
||||
"postgresql_client"
|
||||
@@ -22,6 +23,7 @@
|
||||
"kosmos-base",
|
||||
"kosmos-base::default",
|
||||
"kosmos_kvm::guest",
|
||||
"kosmos-dirsrv::hostsfile",
|
||||
"kosmos_garage",
|
||||
"kosmos_garage::default",
|
||||
"kosmos_garage::firewall_rpc",
|
||||
@@ -84,6 +86,7 @@
|
||||
"run_list": [
|
||||
"recipe[kosmos-base]",
|
||||
"role[kvm_guest]",
|
||||
"role[ldap_client]",
|
||||
"role[garage_gateway]",
|
||||
"role[mastodon]"
|
||||
]
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
node.default['akkounts']['repo'] = 'https://gitea.kosmos.org/kosmos/akkounts.git'
|
||||
node.default['akkounts']['revision'] = 'master'
|
||||
node.default['akkounts']['revision'] = 'live'
|
||||
node.default['akkounts']['port'] = 3000
|
||||
node.default['akkounts']['domain'] = 'accounts.kosmos.org'
|
||||
node.default['akkounts']['primary_domain'] = 'kosmos.org'
|
||||
@@ -11,6 +11,7 @@ node.default['akkounts']['smtp']['domain'] = 'kosmos.org'
|
||||
node.default['akkounts']['smtp']['auth_method'] = 'plain'
|
||||
node.default['akkounts']['smtp']['enable_starttls'] = 'auto'
|
||||
|
||||
node.default['akkounts']['btcpay']['public_url'] = nil
|
||||
node.default['akkounts']['btcpay']['store_id'] = nil
|
||||
|
||||
node.default['akkounts']['ejabberd']['admin_url'] = nil
|
||||
@@ -20,6 +21,8 @@ node.default['akkounts']['lndhub']['public_url'] = nil
|
||||
node.default['akkounts']['lndhub']['public_key'] = nil
|
||||
node.default['akkounts']['lndhub']['postgres_db'] = 'lndhub'
|
||||
|
||||
node.default['akkounts']['nostr']['public_key'] = nil
|
||||
|
||||
node.default['akkounts']['s3_enabled'] = true
|
||||
node.default['akkounts']['s3_endpoint'] = "https://s3.kosmos.org"
|
||||
node.default['akkounts']['s3_region'] = "garage"
|
||||
|
||||
@@ -75,6 +75,7 @@ end
|
||||
|
||||
if btcpay_host
|
||||
env[:btcpay_api_url] = "http://#{btcpay_host}:23001/api/v1"
|
||||
env[:btcpay_public_url] = node['akkounts']['btcpay']['public_url']
|
||||
env[:btcpay_store_id] = node['akkounts']['btcpay']['store_id']
|
||||
env[:btcpay_auth_token] = credentials["btcpay_auth_token"]
|
||||
end
|
||||
@@ -148,6 +149,7 @@ end
|
||||
#
|
||||
|
||||
env[:mastodon_public_url] = "https://#{node['kosmos-mastodon']['domain']}"
|
||||
env[:mastodon_address_domain] = node['kosmos-mastodon']['user_address_domain']
|
||||
|
||||
#
|
||||
# MediaWiki
|
||||
@@ -155,6 +157,13 @@ env[:mastodon_public_url] = "https://#{node['kosmos-mastodon']['domain']}"
|
||||
|
||||
env[:mediawiki_public_url] = node['mediawiki']['url']
|
||||
|
||||
#
|
||||
# Nostr
|
||||
#
|
||||
|
||||
env[:nostr_private_key] = credentials['nostr_private_key']
|
||||
env[:nostr_public_key] = node['akkounts']['nostr']['public_key']
|
||||
|
||||
#
|
||||
# remoteStorage / Liquor Cabinet
|
||||
#
|
||||
|
||||
@@ -2,27 +2,6 @@
|
||||
# Cookbook Name:: kosmos-base
|
||||
# Recipe:: letsencrypt
|
||||
#
|
||||
# The MIT License (MIT)
|
||||
#
|
||||
# Copyright:: 2019, Kosmos Developers
|
||||
#
|
||||
# Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
# of this software and associated documentation files (the "Software"), to deal
|
||||
# in the Software without restriction, including without limitation the rights
|
||||
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||
# copies of the Software, and to permit persons to whom the Software is
|
||||
# furnished to do so, subject to the following conditions:
|
||||
#
|
||||
# The above copyright notice and this permission notice shall be included in
|
||||
# all copies or substantial portions of the Software.
|
||||
#
|
||||
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
||||
# THE SOFTWARE.
|
||||
|
||||
unless platform?('ubuntu')
|
||||
raise "This recipe only supports Ubuntu installs"
|
||||
|
||||
@@ -3,6 +3,8 @@ provides :tls_cert_for
|
||||
|
||||
property :domain, [String, Array], name_property: true
|
||||
property :auth, [String, NilClass], default: nil
|
||||
property :deploy_hook, [String, NilClass], default: nil
|
||||
property :acme_domain, [String, NilClass], default: nil
|
||||
|
||||
default_action :create
|
||||
|
||||
@@ -17,13 +19,35 @@ action :create do
|
||||
|
||||
case new_resource.auth
|
||||
when "gandi_dns"
|
||||
gandi_api_data_bag_item = data_bag_item('credentials', 'gandi_api_5apps')
|
||||
gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
|
||||
|
||||
hook_path = "/root/gandi_dns_certbot_hook.sh"
|
||||
hook_auth_command = "#{hook_path} auth"
|
||||
hook_cleanup_command = "#{hook_path} cleanup"
|
||||
|
||||
if new_resource.acme_domain
|
||||
hook_auth_command += " #{new_resource.acme_domain}"
|
||||
hook_cleanup_command += " #{new_resource.acme_domain}"
|
||||
end
|
||||
|
||||
template hook_path do
|
||||
cookbook "kosmos-base"
|
||||
variables gandi_api_key: gandi_api_data_bag_item["key"]
|
||||
mode 0770
|
||||
variables access_token: gandi_api_credentials["access_token"]
|
||||
mode 0700
|
||||
sensitive true
|
||||
end
|
||||
|
||||
if new_resource.deploy_hook
|
||||
deploy_hook_path = "/etc/letsencrypt/renewal-hooks/#{domains.first}"
|
||||
|
||||
file deploy_hook_path do
|
||||
content new_resource.deploy_hook
|
||||
mode 0755
|
||||
owner "root"
|
||||
group "root"
|
||||
end
|
||||
elsif node.run_list.roles.include?("openresty_proxy")
|
||||
deploy_hook_path = "/etc/letsencrypt/renewal-hooks/post/openresty"
|
||||
end
|
||||
|
||||
# Generate a Let's Encrypt cert (only if no cert has been generated before).
|
||||
@@ -34,10 +58,10 @@ action :create do
|
||||
--preferred-challenges dns \
|
||||
--manual-public-ip-logging-ok \
|
||||
--agree-tos \
|
||||
--manual-auth-hook '#{hook_path} auth' \
|
||||
--manual-cleanup-hook '#{hook_path} cleanup' \
|
||||
--manual-auth-hook '#{hook_auth_command}' \
|
||||
--manual-cleanup-hook '#{hook_cleanup_command}' \
|
||||
--email ops@kosmos.org \
|
||||
#{node.run_list.roles.include?("openresty_proxy") ? '--deploy-hook /etc/letsencrypt/renewal-hooks/post/openresty' : nil } \
|
||||
#{"--deploy-hook #{deploy_hook_path}" if defined?(deploy_hook_path)} \
|
||||
#{domains.map {|d| "-d #{d}" }.join(" ")}
|
||||
CMD
|
||||
not_if do
|
||||
|
||||
@@ -1,21 +1,16 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
|
||||
set -euf -o pipefail
|
||||
|
||||
# ************** USAGE **************
|
||||
#
|
||||
# Example usage (with this hook file saved in /root/):
|
||||
# Example usage:
|
||||
#
|
||||
# sudo su -
|
||||
# certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos -d "5apps.com" -d muc.5apps.com -d "xmpp.5apps.com" \
|
||||
# --manual-auth-hook "/root/letsencrypt_hook.sh auth" --manual-cleanup-hook "/root/letsencrypt_hook.sh cleanup"
|
||||
#
|
||||
# This hook requires configuration, continue reading.
|
||||
#
|
||||
# ************** CONFIGURATION **************
|
||||
#
|
||||
# GANDI_API_KEY: Your Gandi Live API key
|
||||
# ACCESS_TOKEN: Your Gandi Live API key
|
||||
#
|
||||
# PROVIDER_UPDATE_DELAY:
|
||||
# How many seconds to wait after updating your DNS records. This may be required,
|
||||
@@ -25,10 +20,16 @@ set -euf -o pipefail
|
||||
#
|
||||
# Defaults to 30 seconds.
|
||||
#
|
||||
GANDI_API_KEY="<%= @gandi_api_key %>"
|
||||
# VALIDATION_DOMAIN:
|
||||
# Domain to create ACME DNS entries on. Use this when redirecting ACME subdomains
|
||||
# from the original domain to a proxy validation domain that we control.
|
||||
#
|
||||
ACCESS_TOKEN="<%= @access_token %>"
|
||||
PROVIDER_UPDATE_DELAY=10
|
||||
VALIDATION_DOMAIN="${2:-}"
|
||||
|
||||
regex='.*\.(.*\..*)'
|
||||
|
||||
if [[ $CERTBOT_DOMAIN =~ $regex ]]
|
||||
then
|
||||
DOMAIN="${BASH_REMATCH[1]}"
|
||||
@@ -36,25 +37,41 @@ else
|
||||
DOMAIN="${CERTBOT_DOMAIN}"
|
||||
fi
|
||||
|
||||
if [[ -n "$VALIDATION_DOMAIN" ]]
|
||||
then
|
||||
if [[ $VALIDATION_DOMAIN =~ $regex ]]
|
||||
then
|
||||
ACME_BASE_DOMAIN="${BASH_REMATCH[1]}"
|
||||
else
|
||||
echo "Validation domain has to be a subdomain, but it is not: \"${VALIDATION_DOMAIN}\""
|
||||
exit 1
|
||||
fi
|
||||
ACME_DOMAIN="${CERTBOT_DOMAIN}.${VALIDATION_DOMAIN}"
|
||||
else
|
||||
ACME_BASE_DOMAIN="${DOMAIN}"
|
||||
ACME_DOMAIN="_acme-challenge.${CERTBOT_DOMAIN}"
|
||||
fi
|
||||
|
||||
# To be invoked via Certbot's --manual-auth-hook
|
||||
function auth {
|
||||
curl -s -D- -H "Content-Type: application/json" \
|
||||
-H "X-Api-Key: ${GANDI_API_KEY}" \
|
||||
-d "{\"rrset_name\": \"_acme-challenge.${CERTBOT_DOMAIN}.\",
|
||||
\"rrset_type\": \"TXT\",
|
||||
\"rrset_ttl\": 3600,
|
||||
\"rrset_values\": [\"${CERTBOT_VALIDATION}\"]}" \
|
||||
"https://dns.api.gandi.net/api/v5/domains/${DOMAIN}/records"
|
||||
curl -s -D- \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
||||
-d "{\"rrset_name\": \"${ACME_DOMAIN}.\",
|
||||
\"rrset_type\": \"TXT\",
|
||||
\"rrset_ttl\": 300,
|
||||
\"rrset_values\": [\"${CERTBOT_VALIDATION}\"]}" \
|
||||
"https://api.gandi.net/v5/livedns/domains/${ACME_BASE_DOMAIN}/records"
|
||||
|
||||
|
||||
sleep ${PROVIDER_UPDATE_DELAY}
|
||||
sleep ${PROVIDER_UPDATE_DELAY}
|
||||
}
|
||||
|
||||
# To be invoked via Certbot's --manual-cleanup-hook
|
||||
function cleanup {
|
||||
curl -s -X DELETE -H "Content-Type: application/json" \
|
||||
-H "X-Api-Key: ${GANDI_API_KEY}" \
|
||||
https://dns.api.gandi.net/api/v5/domains/${DOMAIN}/records/_acme-challenge.${CERTBOT_DOMAIN}./TXT
|
||||
curl -s -X DELETE \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
||||
"https://api.gandi.net/v5/livedns/domains/${ACME_BASE_DOMAIN}/records/${ACME_DOMAIN}./TXT"
|
||||
}
|
||||
|
||||
HANDLER=$1; shift;
|
||||
|
||||
@@ -154,6 +154,11 @@ admin_users = ejabberd_credentials['admins']
|
||||
|
||||
hosts.each do |host|
|
||||
ldap_rootdn = "uid=service,ou=#{host[:name]},cn=applications,dc=kosmos,dc=org"
|
||||
if host[:name] == "kosmos.org"
|
||||
ldap_filter = "(&(objectClass=person)(serviceEnabled=xmpp))"
|
||||
else
|
||||
ldap_filter = "(objectClass=person)"
|
||||
end
|
||||
|
||||
template "/opt/ejabberd/conf/#{host[:name]}.yml" do
|
||||
source "vhost.yml.erb"
|
||||
@@ -167,7 +172,8 @@ hosts.each do |host|
|
||||
ldap_base: ldap_base,
|
||||
ldap_server: ldap_domain,
|
||||
ldap_rootdn: ldap_rootdn,
|
||||
ldap_encryption_type: ldap_encryption_type
|
||||
ldap_encryption_type: ldap_encryption_type,
|
||||
ldap_filter: ldap_filter
|
||||
notifies :reload, "service[ejabberd]", :delayed
|
||||
end
|
||||
end
|
||||
|
||||
@@ -33,11 +33,11 @@ file "/etc/letsencrypt/renewal-hooks/post/ejabberd" do
|
||||
group "root"
|
||||
end
|
||||
|
||||
gandi_api_data_bag_item = data_bag_item('credentials', 'gandi_api_5apps')
|
||||
gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
|
||||
|
||||
template "/root/gandi_dns_certbot_hook.sh" do
|
||||
variables gandi_api_key: gandi_api_data_bag_item["key"]
|
||||
mode 0770
|
||||
variables access_token: gandi_api_credentials["access_token"]
|
||||
mode 0700
|
||||
end
|
||||
|
||||
# Generate a Let's Encrypt cert (only if no cert has been generated before).
|
||||
@@ -52,7 +52,7 @@ end
|
||||
# Generate a Let's Encrypt cert (only if no cert has been generated before).
|
||||
# The systemd timer will take care of renewing
|
||||
execute "letsencrypt cert for 5apps xmpp" do
|
||||
command "certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@5apps.com -d 5apps.com -d muc.5apps.com -d xmpp.5apps.com -d uploads.xmpp.5apps.com -n"
|
||||
command "certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth letsencrypt.kosmos.chat\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.chat\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@5apps.com -d 5apps.com -d muc.5apps.com -d xmpp.5apps.com -d uploads.xmpp.5apps.com -n"
|
||||
not_if do
|
||||
File.exist?("/etc/letsencrypt/live/5apps.com/fullchain.pem")
|
||||
end
|
||||
|
||||
@@ -1,21 +1,16 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
|
||||
set -euf -o pipefail
|
||||
|
||||
# ************** USAGE **************
|
||||
#
|
||||
# Example usage (with this hook file saved in /root/):
|
||||
# Example usage:
|
||||
#
|
||||
# sudo su -
|
||||
# certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos -d "5apps.com" -d muc.5apps.com -d "xmpp.5apps.com" \
|
||||
# --manual-auth-hook "/root/letsencrypt_hook.sh auth" --manual-cleanup-hook "/root/letsencrypt_hook.sh cleanup"
|
||||
#
|
||||
# This hook requires configuration, continue reading.
|
||||
#
|
||||
# ************** CONFIGURATION **************
|
||||
#
|
||||
# GANDI_API_KEY: Your Gandi Live API key
|
||||
# ACCESS_TOKEN: Your Gandi Live API key
|
||||
#
|
||||
# PROVIDER_UPDATE_DELAY:
|
||||
# How many seconds to wait after updating your DNS records. This may be required,
|
||||
@@ -25,10 +20,16 @@ set -euf -o pipefail
|
||||
#
|
||||
# Defaults to 30 seconds.
|
||||
#
|
||||
GANDI_API_KEY="<%= @gandi_api_key %>"
|
||||
PROVIDER_UPDATE_DELAY=30
|
||||
# VALIDATION_DOMAIN:
|
||||
# Domain to create ACME DNS entries on. Use this when redirecting ACME subdomains
|
||||
# from the original domain to a proxy validation domain that we control.
|
||||
#
|
||||
ACCESS_TOKEN="<%= @access_token %>"
|
||||
PROVIDER_UPDATE_DELAY=10
|
||||
VALIDATION_DOMAIN="${2:-}"
|
||||
|
||||
regex='.*\.(.*\..*)'
|
||||
|
||||
if [[ $CERTBOT_DOMAIN =~ $regex ]]
|
||||
then
|
||||
DOMAIN="${BASH_REMATCH[1]}"
|
||||
@@ -36,25 +37,41 @@ else
|
||||
DOMAIN="${CERTBOT_DOMAIN}"
|
||||
fi
|
||||
|
||||
if [[ -n "$VALIDATION_DOMAIN" ]]
|
||||
then
|
||||
if [[ $VALIDATION_DOMAIN =~ $regex ]]
|
||||
then
|
||||
ACME_BASE_DOMAIN="${BASH_REMATCH[1]}"
|
||||
else
|
||||
echo "Validation domain has to be a subdomain, but it is not: \"${VALIDATION_DOMAIN}\""
|
||||
exit 1
|
||||
fi
|
||||
ACME_DOMAIN="${CERTBOT_DOMAIN}.${VALIDATION_DOMAIN}"
|
||||
else
|
||||
ACME_BASE_DOMAIN="${DOMAIN}"
|
||||
ACME_DOMAIN="_acme-challenge.${CERTBOT_DOMAIN}"
|
||||
fi
|
||||
|
||||
# To be invoked via Certbot's --manual-auth-hook
|
||||
function auth {
|
||||
curl -s -D- -H "Content-Type: application/json" \
|
||||
-H "X-Api-Key: ${GANDI_API_KEY}" \
|
||||
-d "{\"rrset_name\": \"_acme-challenge.${CERTBOT_DOMAIN}.\",
|
||||
\"rrset_type\": \"TXT\",
|
||||
\"rrset_ttl\": 3600,
|
||||
\"rrset_values\": [\"${CERTBOT_VALIDATION}\"]}" \
|
||||
"https://dns.api.gandi.net/api/v5/domains/${DOMAIN}/records"
|
||||
curl -s -D- \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
||||
-d "{\"rrset_name\": \"${ACME_DOMAIN}.\",
|
||||
\"rrset_type\": \"TXT\",
|
||||
\"rrset_ttl\": 300,
|
||||
\"rrset_values\": [\"${CERTBOT_VALIDATION}\"]}" \
|
||||
"https://api.gandi.net/v5/livedns/domains/${ACME_BASE_DOMAIN}/records"
|
||||
|
||||
|
||||
sleep ${PROVIDER_UPDATE_DELAY}
|
||||
sleep ${PROVIDER_UPDATE_DELAY}
|
||||
}
|
||||
|
||||
# To be invoked via Certbot's --manual-cleanup-hook
|
||||
function cleanup {
|
||||
curl -s -X DELETE -H "Content-Type: application/json" \
|
||||
-H "X-Api-Key: ${GANDI_API_KEY}" \
|
||||
https://dns.api.gandi.net/api/v5/domains/${DOMAIN}/records/_acme-challenge.${CERTBOT_DOMAIN}./TXT
|
||||
curl -s -X DELETE \
|
||||
-H "Content-Type: application/json" \
|
||||
-H "Authorization: Bearer ${ACCESS_TOKEN}" \
|
||||
"https://api.gandi.net/v5/livedns/domains/${ACME_BASE_DOMAIN}/records/${ACME_DOMAIN}./TXT"
|
||||
}
|
||||
|
||||
HANDLER=$1; shift;
|
||||
|
||||
@@ -16,7 +16,7 @@ host_config:
|
||||
ldap_password: "<%= @host[:ldap_password] %>"
|
||||
ldap_encrypt: <%= @ldap_encryption_type %>
|
||||
ldap_base: "ou=<%= @host[:name] %>,<%= @ldap_base %>"
|
||||
ldap_filter: "(objectClass=person)"
|
||||
ldap_filter: "<%= @ldap_filter %>"
|
||||
<% end -%>
|
||||
|
||||
append_host_config:
|
||||
|
||||
@@ -62,4 +62,4 @@ node.default['kosmos-ipfs']['ipfs']['config'] = {
|
||||
node.default['kosmos-ipfs']['nginx']['domain'] = "ipfs.kosmos.org"
|
||||
node.default['kosmos-ipfs']['nginx']['external_api_port'] = 5444
|
||||
|
||||
node.default['kosmos-ipfs']['kredits-pinner']['revision'] = "v2.2.0"
|
||||
node.default['kosmos-ipfs']['kredits-pinner']['revision'] = "v2.3.0"
|
||||
|
||||
@@ -44,7 +44,7 @@ end
|
||||
|
||||
elasticsearch_service 'elasticsearch'
|
||||
|
||||
postgresql_data_bag_item = data_bag_item('credentials', 'postgresql')
|
||||
postgresql_credentials = data_bag_item('credentials', 'postgresql')
|
||||
|
||||
mastodon_path = node["kosmos-mastodon"]["directory"]
|
||||
mastodon_user = "mastodon"
|
||||
@@ -168,7 +168,22 @@ execute "restart mastodon services" do
|
||||
notifies :restart, "service[mastodon-streaming]", :delayed
|
||||
end
|
||||
|
||||
mastodon_credentials = data_bag_item('credentials', 'mastodon')
|
||||
credentials = data_bag_item('credentials', 'mastodon')
|
||||
|
||||
ldap_config = {
|
||||
host: "ldap.kosmos.local",
|
||||
port: 389,
|
||||
method: "plain",
|
||||
base: "ou=kosmos.org,cn=users,dc=kosmos,dc=org",
|
||||
bind_dn: credentials["ldap_bind_dn"],
|
||||
password: credentials["ldap_password"],
|
||||
uid: "cn",
|
||||
mail: "mail",
|
||||
search_filter: "(&(|(cn=%{email})(mail=%{email}))(serviceEnabled=mastodon))",
|
||||
uid_conversion_enabled: "true",
|
||||
uid_conversion_search: "-",
|
||||
uid_conversion_replace: "_"
|
||||
}
|
||||
|
||||
template "#{mastodon_path}/.env.#{rails_env}" do
|
||||
source "env.erb"
|
||||
@@ -178,21 +193,22 @@ template "#{mastodon_path}/.env.#{rails_env}" do
|
||||
variables redis_url: node["kosmos-mastodon"]["redis_url"],
|
||||
domain: node["kosmos-mastodon"]["domain"],
|
||||
alternate_domains: node["kosmos-mastodon"]["alternate_domains"],
|
||||
paperclip_secret: mastodon_credentials['paperclip_secret'],
|
||||
secret_key_base: mastodon_credentials['secret_key_base'],
|
||||
otp_secret: mastodon_credentials['otp_secret'],
|
||||
smtp_login: mastodon_credentials['smtp_user_name'],
|
||||
smtp_password: mastodon_credentials['smtp_password'],
|
||||
paperclip_secret: credentials['paperclip_secret'],
|
||||
secret_key_base: credentials['secret_key_base'],
|
||||
otp_secret: credentials['otp_secret'],
|
||||
ldap: ldap_config,
|
||||
smtp_login: credentials['smtp_user_name'],
|
||||
smtp_password: credentials['smtp_password'],
|
||||
smtp_from_address: "mail@#{node['kosmos-mastodon']['domain']}",
|
||||
s3_endpoint: node["kosmos-mastodon"]["s3_endpoint"],
|
||||
s3_region: node["kosmos-mastodon"]["s3_region"],
|
||||
s3_bucket: node["kosmos-mastodon"]["s3_bucket"],
|
||||
s3_alias_host: node["kosmos-mastodon"]["s3_alias_host"],
|
||||
aws_access_key_id: mastodon_credentials['s3_key_id'],
|
||||
aws_secret_access_key: mastodon_credentials['s3_secret_key'],
|
||||
vapid_private_key: mastodon_credentials['vapid_private_key'],
|
||||
vapid_public_key: mastodon_credentials['vapid_public_key'],
|
||||
db_pass: postgresql_data_bag_item['mastodon_user_password'],
|
||||
aws_access_key_id: credentials['s3_key_id'],
|
||||
aws_secret_access_key: credentials['s3_secret_key'],
|
||||
vapid_private_key: credentials['vapid_private_key'],
|
||||
vapid_public_key: credentials['vapid_public_key'],
|
||||
db_pass: postgresql_credentials['mastodon_user_password'],
|
||||
db_host: "pg.kosmos.local",
|
||||
default_locale: node["kosmos-mastodon"]["default_locale"],
|
||||
allowed_private_addresses: node["kosmos-mastodon"]["allowed_private_addresses"],
|
||||
|
||||
@@ -34,6 +34,7 @@ end
|
||||
|
||||
tls_cert_for server_name do
|
||||
auth "gandi_dns"
|
||||
acme_domain "letsencrypt.kosmos.org"
|
||||
action :create
|
||||
end
|
||||
|
||||
|
||||
@@ -29,6 +29,23 @@ SMTP_LOGIN=<%= @smtp_login %>
|
||||
SMTP_PASSWORD=<%= @smtp_password %>
|
||||
SMTP_FROM_ADDRESS=<%= @smtp_from_address %>
|
||||
|
||||
<% if @ldap %>
|
||||
# LDAP configuration
|
||||
LDAP_ENABLED=true
|
||||
LDAP_HOST=<%= @ldap[:host] %>
|
||||
LDAP_PORT=<%= @ldap[:port] %>
|
||||
LDAP_METHOD='<%= @ldap[:method] %>'
|
||||
LDAP_BASE='<%= @ldap[:base] %>'
|
||||
LDAP_BIND_DN='<%= @ldap[:bind_dn] %>'
|
||||
LDAP_PASSWORD='<%= @ldap[:password] %>'
|
||||
LDAP_UID=<%= @ldap[:uid] %>
|
||||
LDAP_MAIL=<%= @ldap[:mail] %>
|
||||
LDAP_SEARCH_FILTER='<%= @ldap[:search_filter] %>'
|
||||
LDAP_UID_CONVERSION_ENABLED=<%= @ldap[:uid_conversion_enabled] %>
|
||||
LDAP_UID_CONVERSION_SEARCH=<%= @ldap[:uid_conversion_search] %>
|
||||
LDAP_UID_CONVERSION_REPLACE=<%= @ldap[:uid_conversion_replace] %>
|
||||
<% end %>
|
||||
|
||||
# Optional asset host for multi-server setups
|
||||
# CDN_HOST=assets.example.com
|
||||
|
||||
|
||||
@@ -32,6 +32,12 @@ server {
|
||||
<% if @onion_address %>
|
||||
add_header Onion-Location https://mastodon.<%= @onion_address %>$request_uri;
|
||||
<% end %>
|
||||
|
||||
location ~ ^/.well-known/(lnurlp|keysend) {
|
||||
add_header 'Access-Control-Allow-Origin' '*';
|
||||
proxy_ssl_server_name on;
|
||||
proxy_pass https://accounts.kosmos.org;
|
||||
}
|
||||
}
|
||||
|
||||
<% if @onion_address %>
|
||||
|
||||
@@ -7,6 +7,7 @@ domain = node["email"]["domain"]
|
||||
hostname = node["email"]["hostname"]
|
||||
root_dir = node["email"]["root_directory"]
|
||||
ip_addr = node["knife_zero"]["host"]
|
||||
extra_hostnames = ["smtp.#{domain}", "imap.#{domain}"]
|
||||
|
||||
node.override["set_fqdn"] = hostname
|
||||
include_recipe "hostname"
|
||||
@@ -23,7 +24,9 @@ directory root_dir do
|
||||
end
|
||||
|
||||
tls_cert_for hostname do
|
||||
domain ([hostname]+extra_hostnames)
|
||||
auth "gandi_dns"
|
||||
deploy_hook "systemctl reload postfix.service && systemctl reload dovecot.service"
|
||||
action :create
|
||||
end
|
||||
|
||||
|
||||
@@ -3,6 +3,8 @@
|
||||
# Recipe:: nginx_web
|
||||
#
|
||||
|
||||
gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
|
||||
|
||||
file "#{node['openresty']['dir']}/conf.d/garage.conf" do
|
||||
content <<-EOF
|
||||
upstream garage_web {
|
||||
@@ -40,8 +42,12 @@ end
|
||||
#
|
||||
|
||||
node['garage']['s3_web_domains'].each do |domain_name|
|
||||
second_level_domain = domain_name.match(/(?:.*\.)?([^.]+\.[^.]+)$/) { $1 }
|
||||
proxy_validation = !gandi_api_credentials["domains"].include?(second_level_domain)
|
||||
|
||||
tls_cert_for domain_name do
|
||||
auth "gandi_dns"
|
||||
acme_domain "letsencrypt.kosmos.org" if proxy_validation
|
||||
action :create
|
||||
end
|
||||
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
node.default["gitea"]["version"] = "1.21.7"
|
||||
node.default["gitea"]["checksum"] = "fa88e6404d3d34136bdd50c990a8c390d5e05f4cb2e31641559d14234e022bd6"
|
||||
node.default["gitea"]["version"] = "1.22.0"
|
||||
node.default["gitea"]["checksum"] = "a31086f073cb9592d28611394b2de3655db515d961e4fdcf5b549cb40753ef3d"
|
||||
node.default["gitea"]["working_directory"] = "/var/lib/gitea"
|
||||
node.default["gitea"]["port"] = 3000
|
||||
node.default["gitea"]["postgresql_host"] = "localhost:5432"
|
||||
|
||||
@@ -112,3 +112,7 @@ MINIO_USE_SSL=<%= c["use_ssl"] %>
|
||||
[actions]
|
||||
ENABLED = true
|
||||
<% end %>
|
||||
|
||||
[other]
|
||||
SHOW_FOOTER_VERSION = false
|
||||
SHOW_FOOTER_TEMPLATE_LOAD_TIME = false
|
||||
|
||||
@@ -1,9 +1,9 @@
|
||||
ubuntu_server_cloud_image_release = "20230506"
|
||||
release = "20240514"
|
||||
|
||||
node.default["kosmos_kvm"]["host"]["qemu_base_image"] = {
|
||||
"url" => "https://cloud-images.ubuntu.com/releases/focal/release-#{ubuntu_server_cloud_image_release}/ubuntu-20.04-server-cloudimg-amd64-disk-kvm.img",
|
||||
"checksum" => "27d2b91fd2b715729d739e2a3155dce70d1aaae4f05c177f338b9d4b60be638c",
|
||||
"path" => "/var/lib/libvirt/images/base/ubuntu-20.04-server-cloudimg-amd64-disk-kvm-#{ubuntu_server_cloud_image_release}.qcow2"
|
||||
"url" => "https://cloud-images.ubuntu.com/releases/jammy/release-#{release}/ubuntu-22.04-server-cloudimg-amd64-disk-kvm.img",
|
||||
"checksum" => "2e7698b3ebd7caead06b08bd3ece241e6ce294a6db01f92ea12bcb56d6972c3f",
|
||||
"path" => "/var/lib/libvirt/images/base/ubuntu-22.04-server-cloudimg-amd64-disk-kvm-#{release}.qcow2"
|
||||
}
|
||||
|
||||
# A systemd.timer OnCalendar config value
|
||||
|
||||
@@ -22,8 +22,5 @@ borg create -v $REPOSITORY::$1_$(date +%F_%H-%M) \
|
||||
/var/lib/libvirt/images/$1.qcow2 \
|
||||
/root/backups/vm_meta/$1.xml
|
||||
|
||||
echo "Pivoting base image back to original"
|
||||
virsh blockcommit $1 vda --pivot --base=/var/lib/libvirt/images/$1.qcow2
|
||||
|
||||
echo "Removing snapshot image"
|
||||
rm /var/lib/libvirt/images/$1.hotswap.qcow2
|
||||
echo "Pivoting base image back to original, and removing the snapshot image"
|
||||
virsh blockcommit $1 vda --pivot --base=/var/lib/libvirt/images/$1.qcow2 && rm /var/lib/libvirt/images/$1.hotswap.qcow2
|
||||
|
||||
@@ -17,7 +17,7 @@ DISKSIZE=${4:-10} # 10GB default
|
||||
# Directory where image files will be stored
|
||||
IMAGE_DIR=/var/lib/libvirt/images
|
||||
IMAGE_PATH=$IMAGE_DIR/${VMNAME}.qcow2
|
||||
CIDATA_PATH=${IMAGE_DIR}/cidata-${VMNAME}.iso
|
||||
CIDATA_PATH=${IMAGE_DIR}/${VMNAME}-cloudinit
|
||||
BASE_FILE=<%= @base_image_path %>
|
||||
|
||||
# Create the VM image if it does not already exist
|
||||
@@ -38,9 +38,8 @@ qemu-img info "$IMAGE_PATH"
|
||||
# Check if the cloud-init metadata file exists
|
||||
# if not, generate it
|
||||
if [ ! -r $CIDATA_PATH ]; then
|
||||
pushd $(dirname $CIDATA_PATH)
|
||||
mkdir -p $VMNAME
|
||||
cd $VMNAME
|
||||
mkdir -p $CIDATA_PATH
|
||||
pushd $CIDATA_PATH
|
||||
|
||||
cat > user-data <<-EOS
|
||||
#cloud-config
|
||||
@@ -62,25 +61,19 @@ instance-id: $VMNAME
|
||||
local-hostname: $VMNAME
|
||||
EOS
|
||||
|
||||
genisoimage -output "$CIDATA_PATH" -volid cidata -joliet -rock user-data meta-data
|
||||
chown libvirt-qemu:kvm "$CIDATA_PATH"
|
||||
chmod 600 "$CIDATA_PATH"
|
||||
popd
|
||||
fi
|
||||
|
||||
# setting --os-variant to ubuntu20.04 and ubuntu18.04 breaks SSH and networking
|
||||
virt-install \
|
||||
--name "$VMNAME" \
|
||||
--ram "$RAM" \
|
||||
--vcpus "$CPUS" \
|
||||
--cpu host \
|
||||
--arch x86_64 \
|
||||
--os-type linux \
|
||||
--os-variant ubuntu16.04 \
|
||||
--osinfo detect=on,name=ubuntujammy \
|
||||
--hvm \
|
||||
--virt-type kvm \
|
||||
--disk "$IMAGE_PATH" \
|
||||
--cdrom "$CIDATA_PATH" \
|
||||
--boot hd \
|
||||
--network=bridge=virbr0,model=virtio \
|
||||
--graphics none \
|
||||
@@ -88,4 +81,5 @@ virt-install \
|
||||
--console pty \
|
||||
--channel unix,mode=bind,path=/var/lib/libvirt/qemu/$VMNAME.guest_agent.0,target_type=virtio,name=org.qemu.guest_agent.0 \
|
||||
--autostart \
|
||||
--import
|
||||
--import \
|
||||
--cloud-init root-password-generate=off,disable=on,meta-data=$CIDATA_PATH/meta-data,user-data=$CIDATA_PATH/user-data
|
||||
|
||||
@@ -24,10 +24,10 @@ file "/etc/letsencrypt/renewal-hooks/post/nginx" do
|
||||
group "root"
|
||||
end
|
||||
|
||||
gandi_api_data_bag_item = data_bag_item('credentials', 'gandi_api_5apps')
|
||||
gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
|
||||
|
||||
template "/root/gandi_dns_certbot_hook.sh" do
|
||||
variables gandi_api_key: gandi_api_data_bag_item["key"]
|
||||
variables gandi_api_key: gandi_api_credentials["key"]
|
||||
mode 0770
|
||||
end
|
||||
|
||||
|
||||
Reference in New Issue
Block a user