.chef/config.rb

@@ -26,7 +26,8 @@ knife[:automatic_attribute_whitelist] = %w[
   chef_packages
 ]
 
-# Added to /etc/chef/client.rb on node bootstrap
+knife[:default_attribute_whitelist] = []
-# https://docs.chef.io/attribute_persistence/
+knife[:normal_attribute_whitelist] = ['knife_zero', 'kosmos_kvm', 'kosmos-ejabberd', 'openresty']
-knife[:normal_attribute_allowlist] = ['knife_zero', 'kosmos_kvm', 'kosmos-ejabberd', 'openresty']
+knife[:override_attribute_whitelist] = []
+
 knife[:allowed_normal_attributes] = ['knife_zero', 'kosmos_kvm', 'kosmos-ejabberd', 'openresty']

Gemfile.lock

@@ -306,7 +306,6 @@ GEM
 
 PLATFORMS
   x86_64-darwin-18
-  x86_64-darwin-19
   x86_64-linux
 
 DEPENDENCIES

nodes/draco.kosmos.org.json

@@ -1,6 +1,5 @@
 {
   "name": "draco.kosmos.org",
-  "chef_environment": "production",
   "normal": {
     "knife_zero": {
       "host": "10.1.1.167"
@@ -9,9 +8,6 @@
       "backup": {
         "schedule": "0/3:55"
       }
-    },
-    "openresty": {
-      "listen_ip": "148.251.237.111"
     }
   },
   "automatic": {
@@ -21,8 +17,7 @@
     "hostname": "draco",
     "ipaddress": "148.251.237.73",
     "roles": [
-      "openresty_proxy",
+
-      "openresty"
     ],
     "recipes": [
       "kosmos-base",
@@ -35,10 +30,7 @@
       "kosmos-ipfs::firewall_swarm",
       "kosmos-bitcoin::firewall",
       "kosmos_zerotier::firewall",
-      "kosmos_openresty",
+      "kosmos-nginx::firewall",
-      "kosmos_openresty::default",
-      "kosmos_openresty::firewall",
-      "kosmos_assets::nginx_site",
       "sockethub::firewall",
       "apt::default",
       "timezone_iii::default",
@@ -55,30 +47,19 @@
       "postfix::sasl_auth",
       "hostname::default",
       "firewall::default",
-      "openresty::apt_package",
+      "chef-sugar::default"
-      "openresty::ohai_plugin",
-      "openresty::commons_user",
-      "openresty::commons_dir",
-      "openresty::commons_script",
-      "openresty::commons_conf",
-      "logrotate::default",
-      "openresty::luarocks",
-      "git::default",
-      "git::package",
-      "kosmos-base::letsencrypt"
     ],
     "platform": "ubuntu",
     "platform_version": "20.04",
     "cloud": null,
     "chef_packages": {
-      "chef": {
-        "version": "18.2.7",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.2.7/lib",
-        "chef_effortless": null
-      },
       "ohai": {
-        "version": "18.1.4",
+        "version": "15.12.0",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/2.6.0/gems/ohai-15.12.0/lib/ohai"
+      },
+      "chef": {
+        "version": "15.17.4",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/2.6.0/gems/chef-15.17.4/lib"
       }
     }
   },
@@ -91,7 +72,7 @@
     "recipe[kosmos-ipfs::firewall_swarm]",
     "recipe[kosmos-bitcoin::firewall]",
     "recipe[kosmos_zerotier::firewall]",
-    "role[openresty_proxy]",
+    "recipe[kosmos-nginx::firewall]",
     "recipe[sockethub::firewall]"
   ]
 }

roles/openresty.rb

@@ -1,17 +1,11 @@
 name "openresty"
 
-development_run_list = %w(
-  kosmos_openresty::default
-  kosmos_openresty::hello_world
-)
-
 default_run_list = %w(
   kosmos_openresty::default
-  kosmos_openresty::firewall
 )
 
 env_run_lists(
   '_default' => default_run_list,
-  'development' => development_run_list,
+  'development' => default_run_list,
   'production' => default_run_list
 )

roles/openresty_proxy.rb

@@ -14,12 +14,9 @@ override_attributes(
 )
 
 development_run_list = %w(
-  role[openresty]
   kosmos_assets::nginx_site
 )
-
 default_run_list = %w(
-  role[openresty]
   tor-full
   kosmos_assets::nginx_site
   kosmos_discourse::nginx
@@ -42,13 +39,8 @@ default_run_list = %w(
   remotestorage_discourse::nginx
 )
 
-production_run_list = %w(
-  role[openresty]
-  kosmos_assets::nginx_site
-)
-
 env_run_lists(
   '_default' => default_run_list,
   'development' => development_run_list,
-  'production' => production_run_list
+  'production' => default_run_list
 )

site-cookbooks/kosmos-base/resources/tls_cert_for.rb

@@ -6,13 +6,9 @@ property :auth, [String, NilClass], default: nil
 
 default_action :create
 
-def initialize(*args)
-  super
-
-  @run_context.include_recipe 'kosmos-base::letsencrypt'
-end
-
 action :create do
+  include_recipe 'kosmos-base::letsencrypt'
+
   domains = Array(new_resource.domain)
 
   case new_resource.auth

site-cookbooks/kosmos_assets/recipes/nginx_site.rb

@@ -3,7 +3,6 @@
 # Recipe:: openresty_site
 #
 
-include_recipe "git"
 include_recipe "kosmos_openresty"
 
 domain = node["kosmos_assets"]["domain"]

site-cookbooks/kosmos_assets/templates/nginx_conf_assets.erb

@@ -8,8 +8,7 @@ server {
 
   root /var/www/<%= @domain %>/site;
 
-  access_log <%= node['openresty']['log_dir'] %>/<%= @domain %>.access.log;
+  access_log off;
-  error_log <%= node['openresty']['log_dir'] %>/<%= @domain %>.error.log;
   gzip_static on;
   gzip_comp_level 5;
 

site-cookbooks/kosmos_openresty/metadata.rb

@@ -2,9 +2,8 @@ name 'kosmos_openresty'
 maintainer 'Kosmos'
 maintainer_email 'mail@kosmos.org'
 license 'MIT'
-description 'Installs/Configures openresty'
+description 'Installs/Configures kosmos_openresty'
 version '0.1.0'
-chef_version '>= 18.0'
+chef_version '>= 16.0'
 
-depends 'kosmos-base'
 depends 'openresty'

site-cookbooks/kosmos_openresty/recipes/default.rb

@@ -5,3 +5,8 @@
 
 # Install openresty from official packages
 include_recipe 'openresty::apt_package'
+
+openresty_site 'hello_world' do
+  template 'hello_world.conf.erb'
+  action :enable
+end

site-cookbooks/kosmos_openresty/recipes/firewall.rb

@@ -1,11 +0,0 @@
-#
-# Cookbook Name:: kosmos_openresty
-# Recipe:: firewall
-
-include_recipe "kosmos-base::firewall"
-
-firewall_rule "http/https" do
-  port     [80, 443]
-  protocol :tcp
-  command  :allow
-end

site-cookbooks/kosmos_openresty/recipes/hello_world.rb

@@ -1,9 +0,0 @@
-#
-# Cookbook:: kosmos_openresty
-# Recipe:: hello_world
-#
-
-openresty_site 'hello_world' do
-  template 'hello_world.conf.erb'
-  action :enable
-end

site-cookbooks/openresty

@@ -1 +1 @@
-Subproject commit 867046cbd1e120f7b2cb842114dcc725cdf0c2b2
+Subproject commit f48675c7f6aa03498dcd966a21f38d8f8f25f9f4