Migrate discourse proxy to openresty

Reviewed-on: #509

environments/production.json

@@ -34,6 +34,15 @@
         }
       }
     },
+    "kosmos_kvm": {
+      "backup": {
+        "nodes_excluded": [
+          "garage-2", "garage-3", "garage-4",
+          "postgres-5",
+          "rsk-mainnet-2", "rsk-testnet-3"
+        ]
+      }
+    },
     "kosmos-mastodon": {
       "domain": "kosmos.social",
       "s3_endpoint": "http://localhost:3900",

nodes/draco.kosmos.org.json

@@ -11,7 +11,10 @@
       }
     },
     "openresty": {
-      "listen_ip": "148.251.237.111"
+      "listen_ip": "148.251.237.111",
+      "log_formats": {
+        "json": "{\"ip\":\"$remote_addr\",\"time\":\"$time_local\",\"host\":\"$host\",\"method\":\"$request_method\",\"uri\":\"$uri\",\"status\":$status,\"size\":$body_bytes_sent,\"referer\":\"$http_referer\",\"upstream_addr\":\"$upstream_addr\",\"upstream_response_time\":\"$upstream_response_time\",\"ua\":\"$http_user_agent\"}"
+      }
     }
   },
   "automatic": {
@@ -21,24 +24,28 @@
     "hostname": "draco",
     "ipaddress": "148.251.237.73",
     "roles": [
+      "base",
+      "kvm_host",
       "openresty_proxy",
       "openresty"
     ],
     "recipes": [
       "kosmos-base",
       "kosmos-base::default",
-      "kosmos_encfs",
-      "kosmos_encfs::default",
       "kosmos_kvm::host",
       "kosmos_kvm::backup",
-      "kosmos-ejabberd::firewall",
-      "kosmos-ipfs::firewall_swarm",
-      "kosmos-bitcoin::firewall",
-      "kosmos_zerotier::firewall",
       "kosmos_openresty",
       "kosmos_openresty::default",
       "kosmos_openresty::firewall",
       "kosmos_assets::nginx_site",
+      "kosmos-akkounts::nginx",
+      "kosmos_discourse::nginx",
+      "kosmos_encfs",
+      "kosmos_encfs::default",
+      "kosmos-ejabberd::firewall",
+      "kosmos-ipfs::firewall_swarm",
+      "kosmos-bitcoin::firewall",
+      "kosmos_zerotier::firewall",
       "sockethub::firewall",
       "apt::default",
       "timezone_iii::default",
@@ -54,7 +61,6 @@
       "postfix::_attributes",
       "postfix::sasl_auth",
       "hostname::default",
-      "firewall::default",
       "openresty::apt_package",
       "openresty::ohai_plugin",
       "openresty::commons_user",
@@ -65,7 +71,8 @@
       "openresty::luarocks",
       "git::default",
       "git::package",
-      "kosmos-base::letsencrypt"
+      "kosmos-base::letsencrypt",
+      "firewall::default"
     ],
     "platform": "ubuntu",
     "platform_version": "20.04",
@@ -83,15 +90,14 @@
     }
   },
   "run_list": [
-    "recipe[kosmos-base]",
+    "role[base]",
+    "role[kvm_host]",
+    "role[openresty_proxy]",
     "recipe[kosmos_encfs]",
-    "recipe[kosmos_kvm::host]",
-    "recipe[kosmos_kvm::backup]",
     "recipe[kosmos-ejabberd::firewall]",
     "recipe[kosmos-ipfs::firewall_swarm]",
     "recipe[kosmos-bitcoin::firewall]",
     "recipe[kosmos_zerotier::firewall]",
-    "role[openresty_proxy]",
     "recipe[sockethub::firewall]"
   ]
 }

nodes/fornax.kosmos.org.json

@@ -99,10 +99,9 @@
     }
   },
   "run_list": [
-    "recipe[kosmos-base]",
-    "recipe[kosmos_kvm::host]",
-    "recipe[kosmos_kvm::backup]",
+    "role[base]",
+    "role[kvm_host]",
     "role[nginx_proxy]",
     "role[zerotier_controller]"
   ]
-}
+}

roles/kvm_host.rb

@@ -0,0 +1,6 @@
+name "kvm_host"
+
+run_list %w(
+  kosmos_kvm::host
+  kosmos_kvm::backup
+)

roles/openresty_proxy.rb

@@ -21,8 +21,6 @@ development_run_list = %w(
 default_run_list = %w(
   role[openresty]
   tor-full
-  kosmos_assets::nginx_site
-  kosmos_discourse::nginx
   kosmos_drone::nginx
   kosmos_garage::default
   kosmos_garage::firewall_rpc
@@ -45,6 +43,8 @@ default_run_list = %w(
 production_run_list = %w(
   role[openresty]
   kosmos_assets::nginx_site
+  kosmos-akkounts::nginx
+  kosmos_discourse::nginx
 )
 
 env_run_lists(

site-cookbooks/discourse/metadata.rb

@@ -7,5 +7,4 @@ long_description 'Installs/Configures discourse'
 version '0.1.0'
 chef_version '>= 14.0'
 
-depends 'kosmos-nginx'
 depends 'firewall'

site-cookbooks/discourse/recipes/nginx.rb

@@ -1,39 +0,0 @@
-#
-# Cookbook:: discourse
-# Recipe:: nginx
-#
-
-include_recipe "kosmos-nginx"
-
-domain = node['discourse']['domain']
-discourse_role = node['discourse']['role']
-
-upstream_ip_addresses = []
-search(:node, "role:#{discourse_role}").each do |n|
-  upstream_ip_addresses << n["knife_zero"]["host"]
-end
-# No Discourse host, stop here
-if upstream_ip_addresses.empty?
-  Chef::Log.warn("No server with '#{discourse_role}' role. Stopping here.")
-  return
-end
-
-nginx_certbot_site domain
-
-template "#{node['nginx']['dir']}/sites-available/#{domain}" do
-  source "nginx_conf.erb"
-  owner 'www-data'
-  mode 0640
-  variables server_name:           domain,
-            ssl_cert:              "/etc/letsencrypt/live/#{domain}/fullchain.pem",
-            ssl_key:               "/etc/letsencrypt/live/#{domain}/privkey.pem",
-            upstream_port:         node['discourse']['port'],
-            upstream_name:         discourse_role,
-            upstream_ip_addresses: upstream_ip_addresses
-
-  notifies :reload, 'service[nginx]', :delayed
-end
-
-nginx_site domain do
-  action :enable
-end

site-cookbooks/kosmos-akkounts/metadata.rb

@@ -7,7 +7,7 @@ long_description 'Installs/configures kosmos-akkounts'
 version '0.2.0'
 chef_version '>= 18.0'
 
-depends 'kosmos-nginx'
+depends 'kosmos_openresty'
 depends "kosmos-nodejs"
 depends "redisio"
 depends "postgresql"

site-cookbooks/kosmos-akkounts/recipes/nginx.rb

@@ -3,11 +3,13 @@
 # Recipe:: nginx
 #
 
-include_recipe "kosmos-nginx"
-app_name    = "akkounts"
-domain      = node[app_name]["domain"]
+app_name = "akkounts"
+domain   = node[app_name]["domain"]
 
-nginx_certbot_site domain
+tls_cert_for domain do
+  auth "gandi_dns"
+  action :create
+end
 
 upstream_hosts = []
 search(:node, "role:akkounts").each do |node|
@@ -15,10 +17,8 @@ search(:node, "role:akkounts").each do |node|
 end
 upstream_hosts.push("localhost") if upstream_hosts.empty?
 
-template "#{node['nginx']['dir']}/sites-available/#{domain}" do
-  source "nginx_conf_#{app_name}.erb"
-  owner 'www-data'
-  mode 0640
+openresty_site domain do
+  template "nginx_conf_#{app_name}.erb"
   variables port: node[app_name]['port'],
             domain: domain,
             upstream_port: node["akkounts"]["port"],
@@ -26,9 +26,4 @@ template "#{node['nginx']['dir']}/sites-available/#{domain}" do
             root_dir: "/opt/#{app_name}/public",
             ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
             ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
-  notifies :reload, 'service[nginx]', :delayed
-end
-
-nginx_site domain do
-  action :enable
 end

site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts.erb

@@ -10,7 +10,7 @@ proxy_cache_path /var/cache/nginx/akkounts levels=1:2
                  max_size=1g inactive=120m use_temp_path=off;
 
 server {
-  listen 443 ssl http2;
+  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
   listen [::]:443 ssl http2;
   server_name <%= @domain %>;
 

site-cookbooks/kosmos_discourse/metadata.rb

@@ -2,10 +2,11 @@ name 'kosmos_discourse'
 maintainer 'Kosmos Developers'
 maintainer_email 'mail@kosmos.org'
 license 'MIT'
-description 'Installs/Configures discourse'
-long_description 'Installs/Configures discourse'
-version '0.1.0'
+description 'Installs/configures Discourse'
+long_description 'Installs/configures Discourse'
+version '0.2.0'
 chef_version '>= 14.0'
 
 depends 'discourse'
 depends 'firewall'
+depends 'kosmos_openresty'

site-cookbooks/kosmos_discourse/recipes/nginx.rb

@@ -3,4 +3,30 @@
 # Recipe:: nginx
 #
 
-include_recipe "discourse::nginx"
+domain = node['discourse']['domain']
+discourse_role = node['discourse']['role']
+
+upstream_ip_addresses = []
+search(:node, "role:#{discourse_role}").each do |n|
+  upstream_ip_addresses << n["knife_zero"]["host"]
+end
+# No Discourse host, stop here
+if upstream_ip_addresses.empty?
+  Chef::Log.warn("No server with '#{discourse_role}' role. Stopping here.")
+  return
+end
+
+tls_cert_for domain do
+  auth "gandi_dns"
+  action :create
+end
+
+openresty_site domain do
+  template "nginx_conf.erb"
+  variables server_name:           domain,
+            ssl_cert:              "/etc/letsencrypt/live/#{domain}/fullchain.pem",
+            ssl_key:               "/etc/letsencrypt/live/#{domain}/privkey.pem",
+            upstream_port:         node['discourse']['port'],
+            upstream_name:         discourse_role,
+            upstream_ip_addresses: upstream_ip_addresses
+end

site-cookbooks/kosmos_discourse/templates/nginx_conf.erb

@@ -8,7 +8,7 @@ upstream _discourse {
 <% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
 server {
   server_name <%= @server_name %>;
-  listen 443 ssl http2;
+  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
   listen [::]:443 ssl http2;
 
   ssl_certificate     <%= @ssl_cert %>;

site-cookbooks/kosmos_kvm/attributes/default.rb

@@ -8,3 +8,5 @@ node.default["kosmos_kvm"]["host"]["qemu_base_image"] = {
 
 # A systemd.timer OnCalendar config value
 node.default["kosmos_kvm"]["backup"]["schedule"] = "daily"
+# Node/VM names excluded from backups
+node.default["kosmos_kvm"]["backup"]["nodes_excluded"] = []

site-cookbooks/kosmos_kvm/recipes/backup.rb

@@ -54,6 +54,8 @@ end
 vm_domains = search(:node, "role:kvm_guest").map{|n| n["hostname"] } \
              & `virsh list --name`.strip.chomp.split("\n")
 
+vm_domains.reject! { |d| node["kosmos_kvm"]["backup"]["nodes_excluded"].include?(d) }
+
 template "/root/backups/backup_all_vms.sh" do
   source "backup_all_vms.sh.erb"
   mode '0750'

site-cookbooks/kosmos_openresty/recipes/default.rb

@@ -3,5 +3,7 @@
 # Recipe:: default
 #
 
+node.normal['openresty']['log_formats']['json'] = '{"ip":"$remote_addr","time":"$time_local","host":"$host","method":"$request_method","uri":"$uri","status":$status,"size":$body_bytes_sent,"referer":"$http_referer","upstream_addr":"$upstream_addr","upstream_response_time":"$upstream_response_time","ua":"$http_user_agent"}'
+
 # Install openresty from official packages
 include_recipe 'openresty::apt_package'