Verify the TLS server's certificate

Do not proceed if a certificate is invalid

data_bags/credentials/ejabberd.json

@@ -1,9 +1,16 @@
 {
   "id": "ejabberd",
   "5apps_ldap_password": {
-    "encrypted_data": "NjlYL0mMpXmLP2pk1ZSo5mWt+qosx7eh7+duoPc57avQGwPJ6Vxb\n",
-    "iv": "q/py5XYCEXARUEA9\n",
-    "auth_tag": "4xoSjTjLYNzuLvoksf3Thw==\n",
+    "encrypted_data": "LRafA47WMyuQe5KA4oOc6i/pTflwpG8Gq8v7cvsTr51XwJD62i9L\n",
+    "iv": "CSvV2mbofDQP4T42\n",
+    "auth_tag": "PERdYnrFKGs+HaPBD6Um+A==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "admins": {
+    "encrypted_data": "D1fEa5S7ADU4tornw/FdcDifE6CzqM6TrLliWYxQ1AxwAuewdh0G2OfgjKOt\nvvibgIEMkr83FkX4La2wOjW8X6/DpBiyeys9RznVD4s0jmSaCG7qGHask3+R\nFLRl0gcYFCPkQopIAYihjnwvm9t1MwPXPF9c7B7rN5W2VvctQ9OEN3MgboHl\n",
+    "iv": "IgodYNr3muNTfkhX\n",
+    "auth_tag": "OJ42GSFtEp/KCxSIGhdbVg==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }

site-cookbooks/kosmos-ejabberd/recipes/default.rb

@@ -122,14 +122,7 @@ ldap_domain = node['kosmos-dirsrv']['master_hostname']
 ldap_encryption_type = node.chef_environment == "development" ? "none" : "tls"
 ldap_base = "cn=users,dc=kosmos,dc=org"
 
-admin_users = [
-  "greg@5apps.com",
-  "sebastian@5apps.com",
-  "garret@5apps.com",
-  "raucao@kosmos.org",
-  "greg@kosmos.org",
-  "galfert@kosmos.org"
-]
+admin_users = ejabberd_credentials['admins']
 
 template "/opt/ejabberd/conf/ejabberd.yml" do
   source    "ejabberd.yml.erb"

site-cookbooks/kosmos-ejabberd/templates/ejabberd.yml.erb

@@ -25,6 +25,7 @@ host_config:
     ldap_rootdn: "cn=xmpp,ou=<%= host[:name] %>,<%= @ldap_base %>"
     ldap_password: "<%= host[:ldap_password] %>"
     ldap_encrypt: <%= @ldap_encryption_type %>
+    ldap_tls_verify: hard # when TLS is enabled, don't proceed if a cert is invalid
     ldap_base: "ou=<%= host[:name] %>,<%= @ldap_base %>"
     ldap_filter: "(nsRole=cn=xmpp_role,ou=<%= host[:name] %>,<%= @ldap_base %>)"
   <% end -%>