5 changed files with 93 additions and 110 deletions
--- a/data_bags/credentials/akkounts.json
+++ b/data_bags/credentials/akkounts.json
@ -1,93 +1,72 @@
 {
  "id": "akkounts",
-  "rails_master_key": {
-    "encrypted_data": "q/0BtGuFZJQhw+iG4ZmFG12DPaWQDGTb/nCmRoxOnsACkANqMv/zZ39CoNFe\nLPtZiItY\n",
-    "iv": "JV8R0iu6TrqcZRxL\n",
-    "auth_tag": "YxZIhEUnrd3XrwR6f9wO4A==\n",
+  "postgresql_username": {
+    "encrypted_data": "v2QoNkkxXGflxEdspIpfJdBjQVraMyF9yHq7\n",
+    "iv": "du8wubB9xQjOVeOS\n",
+    "auth_tag": "gDZLYz5/XBCQDlDaFoP6mQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
-  "rails_secret_key_base": {
-    "encrypted_data": "JmDQew3+OR6+yJ1xErwXeTn6jw8N2HwTc9yvAVJ3G+7w1s3N7rKDM6+M50ez\n2zP4Lm/eXzH4WTsTZlQcodlyNpi66pvUCGAkNM36rwTN5yvnhqPUmuSQi7AG\nDTBronBwr9ENvwA/gRuugyyhrRB1iuStpzpYKCMhZ2ae9Mrxdux0+ezfSLn4\nuP22uUrEqdQ/BWsW\n",
-    "iv": "U/+YncCk13U6bYMz\n",
-    "auth_tag": "2wPYJ/uVPv4jLKpAW/x6sw==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "rails_encryption_primary_key": {
-    "encrypted_data": "u/7z91Og/2eM7PWi2JWYAQMhYX4S5+bMMeVpkFPu778Gqj6Td9pagsWIak/d\nb7AU1zjF\n",
-    "iv": "wYhrJWcuWbY8yo8S\n",
-    "auth_tag": "WEoEdNy6VBvB2d5gb8DTXw==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "rails_encryption_key_derivation_salt": {
-    "encrypted_data": "noOwTZuxfhsH94bjOT9rWCKS9rb3wAoXELGrc4nJZeNrb/B9XnOLTuK/wen8\nfmtoym0P\n",
-    "iv": "jiFWs3VXhJdQBNqk\n",
-    "auth_tag": "XDpJFgadYp7LyRqU7SO+Fg==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "postgresql": {
-    "encrypted_data": "Xorg8R8COxE/Swivu8MqZiwstD6rD+8FmgDx70pFscZ/CTb6WQRpyqGSrGZt\nZ7oL9WrqZs+mQgBb30odU+Sgdr6x\n",
-    "iv": "6QWZc3+MY0hBCc/s\n",
-    "auth_tag": "ZM+7OYyx5E9PciNG2OILhg==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "ldap": {
-    "encrypted_data": "mr2Z7hXF1GOn8RmqeZMMdaUcmiVP4ZeKtTX6RYW1cR+FQiUwoITwTPBE9XUx\n2cqZ9Mcd8uJicmf9vd+PfwPtRtoZFwqHQ4LDRFLW64hBZyiEkZWxWW+HzgPr\n",
-    "iv": "k1AkyEplnJ4IZO1Z\n",
-    "auth_tag": "zAOcrPex3VLDfRFq38n7fA==\n",
+  "postgresql_password": {
+    "encrypted_data": "Naz4R5oOCUS/S/CZmW5eoil8BpJ3K1WLUIc3mAihhA==\n",
+    "iv": "0S9Sb1MUoBVWbW9t\n",
+    "auth_tag": "L2yGzVMKiKAzfpA+HADRqA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "sentry_dsn": {
-    "encrypted_data": "51cAERaRBCRg/sMb5c13EcnJzsz6VEf7jx6X3ooUSzm9wHoEfC5Hs/qakr/D\nqm9x3s3aGURRzyLUIEoe9jCohGguh6ehrXYVrun0B6pghVU=\n",
-    "iv": "hJsiiW6dFQMEQ+2p\n",
-    "auth_tag": "TOIahNrUhhsdQGlzp6UV5g==\n",
+    "encrypted_data": "OXiAeg6lIqEnbplAnKlkwb3o3DTfMJbLC0wnxmguQ8GZiP0RcpPOwUAa9Q3U\naA44f36BCKgHtCxdlVB59TTFA9W24ecU5KWb/jIc7mueSoc=\n",
+    "iv": "86cAncfc1K4d43ql\n",
+    "auth_tag": "0i04Y/eFIN+b+5F605d7Dg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "rails_master_key": {
+    "encrypted_data": "Ypv4g33evnuutOWmGl49kq3Ca3SmfWIswyxGIZA0J/o1ZMGpMOfySim/e7r8\nzdAM/PFo\n",
+    "iv": "w2bflz2KIbu/vRT1\n",
+    "auth_tag": "tpemUQJly8Ft9lN6rP+W4w==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "discourse_connect_secret": {
-    "encrypted_data": "pvKcwuZgUJsAvClQ4V0BwhwEg09EUEWVxoSx+mFlfG1KpvZE4Cu3u3PalPSD\nldyKsw==\n",
-    "iv": "ED85d6PKyaKB3Wlv\n",
-    "auth_tag": "XVCU/WigC97tNe0bUK6okQ==\n",
+    "encrypted_data": "DUK6G5SyRiehJh3iHtCKQj8Ki5+suk9Ds5/ZMp6OP1EshdbpziQ4XNey2x+R\nHCTSVg==\n",
+    "iv": "kfhA3apCUAHcNlwH\n",
+    "auth_tag": "BqRV+CiF9rFrqEToJeisoQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "lndhub_admin_token": {
-    "encrypted_data": "LvCgahQblsKOxK9iNbwDd31atBfemVppHqV7s3K/sR4j\n",
-    "iv": "zObzh2jEsqXk2vD2\n",
-    "auth_tag": "n9m/sBYBfzggwQLWrGpR2Q==\n",
+    "encrypted_data": "C3aKQIEwcQNCrr+uyLiOY2KAHZh5dUvTZ9IdANPqkGlr\n",
+    "iv": "qrhJJzmmced9lNF1\n",
+    "auth_tag": "CH1fOwMWsidmWBwX2+4nJg==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "btcpay_auth_token": {
-    "encrypted_data": "M4kGd6+jresm90nWrJG25mX6rfhaU+VlJlIVd/IjOAUsDABryyulJul3GZFh\nFPSI4uEhgIWtn56I0bA=\n",
-    "iv": "hvqHm7A/YfUOJwRJ\n",
-    "auth_tag": "DhtT6IeixD1MSRX+D7JxZA==\n",
+    "encrypted_data": "0vRq3ZeYPtNcdlCUQI0ip6YOaQZKBeK/dODL7IxdrAK9pHz+u53aL8LW92nJ\nmHW2DYcv+eX3ltnwu88=\n",
+    "iv": "5HenMAvE1Uu5l7jJ\n",
+    "auth_tag": "rJzkZPRYar1qw4dauSNV2w==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_access_key": {
-    "encrypted_data": "FPRpLZoIbLcVWPJhOlX7ZeXGv6TZIWYAD+BKTsJOyOHxDG3eRULqQc89cGWi\n",
-    "iv": "f9WiiGLmDxtygp60\n",
-    "auth_tag": "lGnq4itmByuF/Yp20/6coQ==\n",
+    "encrypted_data": "QB7XpwhzCvLczUojhcjXy+KX26rEDQHSSw983KP8W7Nud1SNbheU1PrDEQv/\n",
+    "iv": "DTtUXHNQ2g04E+oE\n",
+    "auth_tag": "0XSkHE+MG4AnVT4XJR9tzw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_secret_key": {
-    "encrypted_data": "JnnwISbHJ+d7JZB/C0NH0fb8p+bDSwoq5t5knSi+bSTltSxKcq6PRX9K6bov\nEbo0GTdWePbuc5NCsyYxfrkzCtpLXTIxeCROtinRmFIgMFNwaOA=\n",
-    "iv": "pKPCaANDqGtbFV3V\n",
-    "auth_tag": "S//hn2HOhuZH8+UfCNBWDg==\n",
+    "encrypted_data": "IEUzFfOBuOwjzD1DbRyk07+jFlZhQVY+a7riDJ3QU1cNYZ3OTJUgJkowA/u5\nrZ6jqehGIzvPlDuzIezxQwN+Dy0ZJueB/ZEdRqhfkXUxgzkqb2s=\n",
+    "iv": "gs9Igisu2EH+dAC/\n",
+    "auth_tag": "gDFuQCwlCL5mvys83CGv+w==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "nostr_private_key": {
-    "encrypted_data": "AKfFiLow+veDyEWBwmCDuLerT3l+o2aJUCeHg2mZZIyoH4oeo/9crZwIdjBn\n70reouqnHNG9mBHuO/+IPGfj53mHLo+oGHh+6LkL3ImI4MFBofY=\n",
-    "iv": "bPlOKk2qkJAzdKf+\n",
-    "auth_tag": "VIp1IOjBGatn2MN5LHVymg==\n",
+    "encrypted_data": "sFnQlwyZF0tfMzbaG/bdwqQLPVdHPpbyDT66FY1+ubssmWUpxsuNtbI71KyY\nI1784c7SSl4qKRgHZRrR658bYMKU4whe836qBgSf7Icczp1VSQY=\n",
+    "iv": "x8RJT4dcNdtm59Zz\n",
+    "auth_tag": "6yxBq1W4jCNDYwP6+cTE6g==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
--- a/nodes/postgres-6.json
+++ b/nodes/postgres-6.json
@ -22,7 +22,6 @@
      "kosmos_kvm::guest",
      "kosmos_postgresql::primary",
      "kosmos_postgresql::firewall",
-      "kosmos-akkounts::pg_db",
      "kosmos-bitcoin::lndhub-go_pg_db",
      "kosmos-bitcoin::nbxplorer_pg_db",
      "kosmos_drone::pg_db",
--- a/roles/postgresql_primary.rb
+++ b/roles/postgresql_primary.rb
@ -3,7 +3,6 @@ name "postgresql_primary"
 run_list %w(
  kosmos_postgresql::primary
  kosmos_postgresql::firewall
-  kosmos-akkounts::pg_db
  kosmos-bitcoin::lndhub-go_pg_db
  kosmos-bitcoin::nbxplorer_pg_db
  kosmos_drone::pg_db
--- a/site-cookbooks/kosmos-akkounts/recipes/default.rb
+++ b/site-cookbooks/kosmos-akkounts/recipes/default.rb
@ -29,7 +29,7 @@ node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_20.x"
 include_recipe 'kosmos-nodejs'
 npm_package "bun"

-ruby_version = "3.3.8"
+ruby_version = "3.3.0"
 ruby_path = "/opt/ruby_build/builds/#{ruby_version}"
 bundle_path = "#{ruby_path}/bin/bundle"
 rails_env = node.chef_environment == "development" ? "development" : "production"
@ -47,28 +47,7 @@ webhooks_allowed_ips = [lndhub_host].compact.uniq.join(',')
 env = {
  primary_domain: node['akkounts']['primary_domain'],
  akkounts_domain: node['akkounts']['domain'],
-  rails_serve_static_files: true,
-  secret_key_base: credentials["rails_secret_key_base"],
-  encryption_primary_key: credentials["rails_encryption_primary_key"],
-  encryption_key_derivation_salt: credentials["rails_encryption_key_derivation_salt"],
-  db_adapter: "postgresql",
-  pg_host: "pg.kosmos.local",
-  pg_port: 5432,
-  pg_database: "akkounts",
-  pg_database_queue: "akkounts_queue",
-  pg_username: credentials["postgresql"]["username"],
-  pg_password: credentials["postgresql"]["password"]
-}
-
-env[:ldap] = {
-  host: "ldap.kosmos.local",
-  port: 389,
-  use_tls: false,
-  uid_attr: "cn",
-  base: "ou=kosmos.org,cn=users,dc=kosmos,dc=org",
-  admin_user: credentials["ldap"]["admin_user"],
-  admin_password: credentials["ldap"]["admin_password"],
-  suffix: "dc=kosmos,dc=org"
+  rails_serve_static_files: true
 }

 smtp_server, smtp_port = smtp_credentials[:relayhost].split(":")
@ -158,9 +137,9 @@ if lndhub_host
  if postgres_readonly_host
    env[:lndhub_admin_ui] = true
    env[:lndhub_pg_host] = postgres_readonly_host
-    env[:lndhub_pg_database] = node["akkounts"]["lndhub"]["postgres_db"]
-    env[:lndhub_pg_username] = credentials["postgresql"]["username"]
-    env[:lndhub_pg_password] = credentials["postgresql"]["password"]
+    env[:lndhub_pg_database] = node['akkounts']['lndhub']['postgres_db']
+    env[:lndhub_pg_username] = credentials['postgresql_username']
+    env[:lndhub_pg_password] = credentials['postgresql_password']
  end
 end

@ -228,7 +207,7 @@ systemd_unit "akkounts.service" do
      Type: "simple",
      User: deploy_user,
      WorkingDirectory: deploy_path,
-      Environment: "RAILS_ENV=#{rails_env} SOLID_QUEUE_IN_PUMA=true",
+      Environment: "RAILS_ENV=#{rails_env}",
      ExecStart: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid",
      ExecStop: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid stop",
      ExecReload: "#{bundle_path} exec pumactl -F config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid phased-restart",
@ -245,6 +224,36 @@ systemd_unit "akkounts.service" do
  action [:create, :enable]
 end

+systemd_unit "akkounts-sidekiq.service" do
+  content({
+    Unit: {
+      Description: "Kosmos Accounts async/background jobs",
+      Documentation: ["https://gitea.kosmos.org/kosmos/akkounts"],
+      Requires: "redis@6379.service",
+      After: "syslog.target network.target redis@6379.service"
+    },
+    Service: {
+      Type: "notify",
+      User: deploy_user,
+      WorkingDirectory: deploy_path,
+      Environment: "MALLOC_ARENA_MAX=2",
+      ExecStart: "#{bundle_path} exec sidekiq -C #{deploy_path}/config/sidekiq.yml -e #{rails_env}",
+      WatchdogSec: "10",
+      Restart: "on-failure",
+      RestartSec: "1",
+      StandardOutput: "syslog",
+      StandardError: "syslog",
+      SyslogIdentifier: "sidekiq"
+    },
+    Install: {
+      WantedBy: "multi-user.target"
+    }
+  })
+  verify false
+  triggers_reload true
+  action [:create, :enable]
+end
+
 deploy_env = {
  "HOME" => deploy_path,
  "PATH" => "#{ruby_path}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin",
@ -257,7 +266,15 @@ git deploy_path do
  revision node[app_name]["revision"]
  user  deploy_user
  group deploy_group
+  # Restart services on deployments
+  notifies :run, "execute[restart #{app_name} services]", :delayed
+end
+
+execute "restart #{app_name} services" do
+  command "true"
+  action :nothing
  notifies :restart, "service[#{app_name}]", :delayed
+  notifies :restart, "service[#{app_name}-sidekiq]", :delayed
 end

 file "#{deploy_path}/config/master.key" do
@ -265,7 +282,7 @@ file "#{deploy_path}/config/master.key" do
  mode '0400'
  owner deploy_user
  group deploy_group
-  notifies :restart, "service[#{app_name}]", :delayed
+  notifies :run, "execute[restart #{app_name} services]", :delayed
 end

 template "#{deploy_path}/.env.#{rails_env}" do
@ -275,7 +292,7 @@ template "#{deploy_path}/.env.#{rails_env}" do
  mode 0600
  sensitive true
  variables config: env
-  notifies :restart, "service[#{app_name}]", :delayed
+  notifies :run, "execute[restart #{app_name} services]", :delayed
 end

 execute "bundle install" do
@ -285,6 +302,13 @@ execute "bundle install" do
  command "bundle install --without development,test --deployment"
 end

+# execute "yarn install" do
+#   environment deploy_env
+#   user deploy_user
+#   cwd deploy_path
+#   command "yarn install --pure-lockfile"
+# end
+
 execute 'rake db:migrate' do
  environment deploy_env
  user deploy_user
@ -305,6 +329,10 @@ service "akkounts" do
  action [:enable, :start]
 end

+service "akkounts-sidekiq" do
+  action [:enable, :start]
+end
+
 firewall_rule "akkounts_zerotier" do
  command  :allow
  port     node["akkounts"]["port"]
--- a/site-cookbooks/kosmos-akkounts/recipes/pg_db.rb
+++ b/site-cookbooks/kosmos-akkounts/recipes/pg_db.rb
@ -1,22 +0,0 @@
-#
-# Cookbook:: kosmos-akkounts
-# Recipe:: pg_db
-#
-
-credentials = data_bag_item("credentials", "akkounts")
-pg_username = credentials["postgresql"]["username"]
-pg_password = credentials["postgresql"]["password"]
-
-postgresql_user pg_username do
-  action :create
-  password pg_password
-end
-
-databases = ["akkounts", "akkounts_queue"]
-
-databases.each do |database|
-  postgresql_database database do
-    owner pg_username
-    action :create
-  end
-end