Add new architecture to Gemfile.lock

Also update Chef to 18.2.7

.chef/config.rb

@@ -26,8 +26,7 @@ knife[:automatic_attribute_whitelist] = %w[
   chef_packages
 ]
 
-knife[:default_attribute_whitelist] = []
-knife[:normal_attribute_whitelist] = ['knife_zero', 'kosmos_kvm', 'kosmos-ejabberd', 'openresty']
-knife[:override_attribute_whitelist] = []
-
+# Added to /etc/chef/client.rb on node bootstrap
+# https://docs.chef.io/attribute_persistence/
+knife[:normal_attribute_allowlist] = ['knife_zero', 'kosmos_kvm', 'kosmos-ejabberd', 'openresty']
 knife[:allowed_normal_attributes] = ['knife_zero', 'kosmos_kvm', 'kosmos-ejabberd', 'openresty']

Gemfile.lock

@@ -306,6 +306,7 @@ GEM
 
 PLATFORMS
   x86_64-darwin-18
+  x86_64-darwin-19
   x86_64-linux
 
 DEPENDENCIES

nodes/draco.kosmos.org.json

@@ -1,5 +1,6 @@
 {
   "name": "draco.kosmos.org",
+  "chef_environment": "production",
   "normal": {
     "knife_zero": {
       "host": "10.1.1.167"
@@ -8,6 +9,9 @@
       "backup": {
         "schedule": "0/3:55"
       }
+    },
+    "openresty": {
+      "listen_ip": "148.251.237.111"
     }
   },
   "automatic": {
@@ -17,7 +21,8 @@
     "hostname": "draco",
     "ipaddress": "148.251.237.73",
     "roles": [
-
+      "openresty_proxy",
+      "openresty"
     ],
     "recipes": [
       "kosmos-base",
@@ -30,7 +35,10 @@
       "kosmos-ipfs::firewall_swarm",
       "kosmos-bitcoin::firewall",
       "kosmos_zerotier::firewall",
-      "kosmos-nginx::firewall",
+      "kosmos_openresty",
+      "kosmos_openresty::default",
+      "kosmos_openresty::firewall",
+      "kosmos_assets::nginx_site",
       "sockethub::firewall",
       "apt::default",
       "timezone_iii::default",
@@ -47,19 +55,30 @@
       "postfix::sasl_auth",
       "hostname::default",
       "firewall::default",
-      "chef-sugar::default"
+      "openresty::apt_package",
+      "openresty::ohai_plugin",
+      "openresty::commons_user",
+      "openresty::commons_dir",
+      "openresty::commons_script",
+      "openresty::commons_conf",
+      "logrotate::default",
+      "openresty::luarocks",
+      "git::default",
+      "git::package",
+      "kosmos-base::letsencrypt"
     ],
     "platform": "ubuntu",
     "platform_version": "20.04",
     "cloud": null,
     "chef_packages": {
-      "ohai": {
-        "version": "15.12.0",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/2.6.0/gems/ohai-15.12.0/lib/ohai"
-      },
       "chef": {
-        "version": "15.17.4",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/2.6.0/gems/chef-15.17.4/lib"
+        "version": "18.2.7",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.2.7/lib",
+        "chef_effortless": null
+      },
+      "ohai": {
+        "version": "18.1.4",
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
       }
     }
   },
@@ -72,7 +91,7 @@
     "recipe[kosmos-ipfs::firewall_swarm]",
     "recipe[kosmos-bitcoin::firewall]",
     "recipe[kosmos_zerotier::firewall]",
-    "recipe[kosmos-nginx::firewall]",
+    "role[openresty_proxy]",
     "recipe[sockethub::firewall]"
   ]
 }

roles/openresty.rb

@@ -1,11 +1,17 @@
 name "openresty"
 
+development_run_list = %w(
+  kosmos_openresty::default
+  kosmos_openresty::hello_world
+)
+
 default_run_list = %w(
   kosmos_openresty::default
+  kosmos_openresty::firewall
 )
 
 env_run_lists(
   '_default' => default_run_list,
-  'development' => default_run_list,
+  'development' => development_run_list,
   'production' => default_run_list
 )

roles/openresty_proxy.rb

@@ -14,9 +14,12 @@ override_attributes(
 )
 
 development_run_list = %w(
+  role[openresty]
   kosmos_assets::nginx_site
 )
+
 default_run_list = %w(
+  role[openresty]
   tor-full
   kosmos_assets::nginx_site
   kosmos_discourse::nginx
@@ -39,8 +42,13 @@ default_run_list = %w(
   remotestorage_discourse::nginx
 )
 
+production_run_list = %w(
+  role[openresty]
+  kosmos_assets::nginx_site
+)
+
 env_run_lists(
   '_default' => default_run_list,
   'development' => development_run_list,
-  'production' => default_run_list
+  'production' => production_run_list
 )

site-cookbooks/kosmos-base/resources/tls_cert_for.rb

@@ -6,9 +6,13 @@ property :auth, [String, NilClass], default: nil
 
 default_action :create
 
-action :create do
-  include_recipe 'kosmos-base::letsencrypt'
+def initialize(*args)
+  super
 
+  @run_context.include_recipe 'kosmos-base::letsencrypt'
+end
+
+action :create do
   domains = Array(new_resource.domain)
 
   case new_resource.auth

site-cookbooks/kosmos_assets/recipes/nginx_site.rb

@@ -3,6 +3,7 @@
 # Recipe:: openresty_site
 #
 
+include_recipe "git"
 include_recipe "kosmos_openresty"
 
 domain = node["kosmos_assets"]["domain"]

site-cookbooks/kosmos_assets/templates/nginx_conf_assets.erb

@@ -8,7 +8,8 @@ server {
 
   root /var/www/<%= @domain %>/site;
 
-  access_log off;
+  access_log <%= node['openresty']['log_dir'] %>/<%= @domain %>.access.log;
+  error_log <%= node['openresty']['log_dir'] %>/<%= @domain %>.error.log;
   gzip_static on;
   gzip_comp_level 5;
 

site-cookbooks/kosmos_openresty/metadata.rb

@@ -2,8 +2,9 @@ name 'kosmos_openresty'
 maintainer 'Kosmos'
 maintainer_email 'mail@kosmos.org'
 license 'MIT'
-description 'Installs/Configures kosmos_openresty'
+description 'Installs/Configures openresty'
 version '0.1.0'
-chef_version '>= 16.0'
+chef_version '>= 18.0'
 
+depends 'kosmos-base'
 depends 'openresty'

site-cookbooks/kosmos_openresty/recipes/default.rb

@@ -5,8 +5,3 @@
 
 # Install openresty from official packages
 include_recipe 'openresty::apt_package'
-
-openresty_site 'hello_world' do
-  template 'hello_world.conf.erb'
-  action :enable
-end

site-cookbooks/kosmos_openresty/recipes/firewall.rb

@@ -0,0 +1,11 @@
+#
+# Cookbook Name:: kosmos_openresty
+# Recipe:: firewall
+
+include_recipe "kosmos-base::firewall"
+
+firewall_rule "http/https" do
+  port     [80, 443]
+  protocol :tcp
+  command  :allow
+end

site-cookbooks/kosmos_openresty/recipes/hello_world.rb

@@ -0,0 +1,9 @@
+#
+# Cookbook:: kosmos_openresty
+# Recipe:: hello_world
+#
+
+openresty_site 'hello_world' do
+  template 'hello_world.conf.erb'
+  action :enable
+end

site-cookbooks/openresty

@@ -1 +1 @@
-Subproject commit f48675c7f6aa03498dcd966a21f38d8f8f25f9f4
+Subproject commit 867046cbd1e120f7b2cb842114dcc725cdf0c2b2