Merge branch 'master' into feature/postgres_vms

Merge pull request 'Re-enable and improve Tor access for kosmos.social' (#292 ) from feature/mastodon_tor into master
Reviewed-on: #292
2021-01-23 14:43:58 +01:00 · 2021-01-23 13:32:57 +00:00 · 2021-01-23 14:22:34 +01:00 · 2021-01-23 11:07:38 +00:00 · 2021-01-22 13:49:23 +01:00 · 2021-01-14 21:25:35 +01:00
6 changed files with 28 additions and 2 deletions
--- a/site-cookbooks/kosmos-bitcoin/attributes/default.rb
+++ b/site-cookbooks/kosmos-bitcoin/attributes/default.rb
@@ -42,7 +42,7 @@ node.default['lnd']['alias'] = 'ln2.kosmos.org'
 node.default['lnd']['color'] = '#5e0c99'
 node.default['lnd']['log_level'] = 'info'
 node.default['lnd']['public_ip'] = '148.251.237.111'
-node.default['lnd']['public_port'] = '9375'
+node.default['lnd']['public_port'] = '9735'
 node.default['lnd']['port'] = '9736'
 node.default['lnd']['minchansize'] = '1000000'
 node.default['lnd']['basefee'] = '500'
--- a/site-cookbooks/kosmos-bitcoin/recipes/c-lightning.rb
+++ b/site-cookbooks/kosmos-bitcoin/recipes/c-lightning.rb
@@ -92,3 +92,9 @@ systemd_unit 'lightningd.service' do
  triggers_reload true
  action [:create, :enable, :start]
 end
+
+firewall_rule 'lightningd' do
+  port     [9735] # TODO use attribute
+  protocol :tcp
+  command  :allow
+end
--- a/site-cookbooks/kosmos-bitcoin/recipes/lnd.rb
+++ b/site-cookbooks/kosmos-bitcoin/recipes/lnd.rb
@@ -89,3 +89,9 @@ systemd_unit 'lnd.service' do
  triggers_reload true
  action [:create, :enable, :start]
 end
+
+firewall_rule 'lnd' do
+  port     [node['lnd']['port']]
+  protocol :tcp
+  command  :allow
+end
--- a/site-cookbooks/kosmos-mastodon/attributes/default.rb
+++ b/site-cookbooks/kosmos-mastodon/attributes/default.rb
@@ -8,5 +8,5 @@ node.default["kosmos-mastodon"]["sidekiq_threads"] = 25
 node.default["kosmos-mastodon"]["elasticsearch"]["allocated_memory"] = "1536m"

 node.override["tor"]["HiddenServices"]["mastodon"] = {
-  "HiddenServicePorts" => ["80 127.0.0.1:80"]
+  "HiddenServicePorts" => ["80 127.0.0.1:80", "443 127.0.0.1:443"]
 }
--- a/site-cookbooks/kosmos-mastodon/recipes/nginx.rb
+++ b/site-cookbooks/kosmos-mastodon/recipes/nginx.rb
@@ -6,6 +6,7 @@
 mastodon_path = node["kosmos-mastodon"]["directory"]
 server_name   = node["kosmos-mastodon"]["server_name"]

+node.override['nginx']['server_names_hash_bucket_size'] = 128
 include_recipe "kosmos-nginx"

 directory "#{node['nginx']['dir']}/snippets" do
--- a/site-cookbooks/kosmos-mastodon/templates/default/nginx_conf_mastodon.erb
+++ b/site-cookbooks/kosmos-mastodon/templates/default/nginx_conf_mastodon.erb
@@ -24,3 +24,16 @@ server {
  add_header Strict-Transport-Security "max-age=31536000";
 }
 <% end %>
+
+<% if @onion_address %>
+server {
+  listen 443 ssl http2;
+  server_name mastodon.<%= @onion_address %>;
+  include <%= @shared_config_path %>;
+
+  ssl_certificate     <%= @ssl_cert %>;
+  ssl_certificate_key <%= @ssl_key %>;
+
+  add_header Strict-Transport-Security "max-age=31536000";
+}
+<% end %>
Author	SHA1	Message	Date
Greg Karékinian	41ca5938a2	Merge branch 'master' into feature/postgres_vms	2021-01-23 14:43:58 +01:00
greg	e31f9ced96	Merge pull request 'Re-enable and improve Tor access for kosmos.social' (#292 ) from feature/mastodon_tor into master Reviewed-on: #292	2021-01-23 13:32:57 +00:00
Sebastian Kippe	05cd38a5b9	Re-enable and improve Tor access for kosmos.social	2021-01-23 14:22:34 +01:00
raucao	d1929fcc9c	Merge pull request 'Fix LN nodes not being accessible from the outside' (#289 ) from bugfix/lnd_externalip into master Reviewed-on: #289	2021-01-23 11:07:38 +00:00
Greg Karékinian	ab422155e4	Add the ability to pass a disk size to the create_vm script Defaults to 10GB	2021-01-22 13:49:23 +01:00
Sebastian Kippe	775ec691ef	Add firewall rules for LND and c-lightning	2021-01-14 21:25:35 +01:00
Sebastian Kippe	6c6026958b	Fix typo in port number of externalip config	2021-01-14 21:23:03 +01:00
greg	d1ab4c24ea	Merge pull request 'Set up new Mastodon VM, fix/improve Chef recipes' (#284 ) from chore/move_mastodon_to_vm into master Reviewed-on: #284	2021-01-14 15:17:19 +00:00
greg	e7fbd57189	Merge branch 'master' into chore/move_mastodon_to_vm	2021-01-14 15:16:17 +00:00
Sebastian Kippe	12a3fa5b4e	Use default Redis database now	2021-01-13 17:06:36 +01:00
Sebastian Kippe	9224aa9d97	Update node data	2021-01-13 17:06:25 +01:00
greg	a27b6a1601	Merge pull request 'Fix ejabberd API permission for akkounts VMs' (#283 ) from bugfix/ejabberd_api_permission into master Reviewed-on: #283	2021-01-13 10:40:29 +00:00
greg	ab3ca92228	Merge branch 'master' into bugfix/ejabberd_api_permission	2021-01-13 10:40:06 +00:00
Sebastian Kippe	62320106cb	Set up mastodon-1 VM	2021-01-13 09:50:37 +01:00
Sebastian Kippe	c622f81572	Remove extra license header	2021-01-13 09:50:10 +01:00
Sebastian Kippe	047526e0fc	Don't configure HTTPS site when certs missing	2021-01-13 09:49:49 +01:00
Sebastian Kippe	9d13acd41a	Don't fail on first run, when Tor hostname missing	2021-01-13 09:49:36 +01:00
Sebastian Kippe	4d0259493f	Update system package dependencies for 20.04	2021-01-13 09:48:23 +01:00
Sebastian Kippe	c4fa9e6ec1	Remove extra license headers And update year in LICENSE file	2021-01-12 18:42:14 +01:00
Sebastian Kippe	74cf26846e	Fix ejabberd API permission for akkounts VMs It should have been using a /32, not a /8 subnet, in order to only allow the akkounts VM(s) to use the API endpoints without further authorization.	2021-01-12 18:06:16 +01:00