Map LDAP jpegPhoto to vcard-temp PHOTO

Reviewed-on: #592
Reviewed-by: Greg <greg@noreply.kosmos.org>

data_bags/credentials/akkounts.json

@@ -1,72 +1,93 @@
 {
   "id": "akkounts",
-  "postgresql_username": {
-    "encrypted_data": "v2QoNkkxXGflxEdspIpfJdBjQVraMyF9yHq7\n",
-    "iv": "du8wubB9xQjOVeOS\n",
-    "auth_tag": "gDZLYz5/XBCQDlDaFoP6mQ==\n",
+  "rails_master_key": {
+    "encrypted_data": "q/0BtGuFZJQhw+iG4ZmFG12DPaWQDGTb/nCmRoxOnsACkANqMv/zZ39CoNFe\nLPtZiItY\n",
+    "iv": "JV8R0iu6TrqcZRxL\n",
+    "auth_tag": "YxZIhEUnrd3XrwR6f9wO4A==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
-  "postgresql_password": {
-    "encrypted_data": "Naz4R5oOCUS/S/CZmW5eoil8BpJ3K1WLUIc3mAihhA==\n",
-    "iv": "0S9Sb1MUoBVWbW9t\n",
-    "auth_tag": "L2yGzVMKiKAzfpA+HADRqA==\n",
+  "rails_secret_key_base": {
+    "encrypted_data": "JmDQew3+OR6+yJ1xErwXeTn6jw8N2HwTc9yvAVJ3G+7w1s3N7rKDM6+M50ez\n2zP4Lm/eXzH4WTsTZlQcodlyNpi66pvUCGAkNM36rwTN5yvnhqPUmuSQi7AG\nDTBronBwr9ENvwA/gRuugyyhrRB1iuStpzpYKCMhZ2ae9Mrxdux0+ezfSLn4\nuP22uUrEqdQ/BWsW\n",
+    "iv": "U/+YncCk13U6bYMz\n",
+    "auth_tag": "2wPYJ/uVPv4jLKpAW/x6sw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "rails_encryption_primary_key": {
+    "encrypted_data": "u/7z91Og/2eM7PWi2JWYAQMhYX4S5+bMMeVpkFPu778Gqj6Td9pagsWIak/d\nb7AU1zjF\n",
+    "iv": "wYhrJWcuWbY8yo8S\n",
+    "auth_tag": "WEoEdNy6VBvB2d5gb8DTXw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "rails_encryption_key_derivation_salt": {
+    "encrypted_data": "noOwTZuxfhsH94bjOT9rWCKS9rb3wAoXELGrc4nJZeNrb/B9XnOLTuK/wen8\nfmtoym0P\n",
+    "iv": "jiFWs3VXhJdQBNqk\n",
+    "auth_tag": "XDpJFgadYp7LyRqU7SO+Fg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "postgresql": {
+    "encrypted_data": "Xorg8R8COxE/Swivu8MqZiwstD6rD+8FmgDx70pFscZ/CTb6WQRpyqGSrGZt\nZ7oL9WrqZs+mQgBb30odU+Sgdr6x\n",
+    "iv": "6QWZc3+MY0hBCc/s\n",
+    "auth_tag": "ZM+7OYyx5E9PciNG2OILhg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "ldap": {
+    "encrypted_data": "mr2Z7hXF1GOn8RmqeZMMdaUcmiVP4ZeKtTX6RYW1cR+FQiUwoITwTPBE9XUx\n2cqZ9Mcd8uJicmf9vd+PfwPtRtoZFwqHQ4LDRFLW64hBZyiEkZWxWW+HzgPr\n",
+    "iv": "k1AkyEplnJ4IZO1Z\n",
+    "auth_tag": "zAOcrPex3VLDfRFq38n7fA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "sentry_dsn": {
-    "encrypted_data": "OXiAeg6lIqEnbplAnKlkwb3o3DTfMJbLC0wnxmguQ8GZiP0RcpPOwUAa9Q3U\naA44f36BCKgHtCxdlVB59TTFA9W24ecU5KWb/jIc7mueSoc=\n",
-    "iv": "86cAncfc1K4d43ql\n",
-    "auth_tag": "0i04Y/eFIN+b+5F605d7Dg==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "rails_master_key": {
-    "encrypted_data": "Ypv4g33evnuutOWmGl49kq3Ca3SmfWIswyxGIZA0J/o1ZMGpMOfySim/e7r8\nzdAM/PFo\n",
-    "iv": "w2bflz2KIbu/vRT1\n",
-    "auth_tag": "tpemUQJly8Ft9lN6rP+W4w==\n",
+    "encrypted_data": "51cAERaRBCRg/sMb5c13EcnJzsz6VEf7jx6X3ooUSzm9wHoEfC5Hs/qakr/D\nqm9x3s3aGURRzyLUIEoe9jCohGguh6ehrXYVrun0B6pghVU=\n",
+    "iv": "hJsiiW6dFQMEQ+2p\n",
+    "auth_tag": "TOIahNrUhhsdQGlzp6UV5g==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "discourse_connect_secret": {
-    "encrypted_data": "DUK6G5SyRiehJh3iHtCKQj8Ki5+suk9Ds5/ZMp6OP1EshdbpziQ4XNey2x+R\nHCTSVg==\n",
-    "iv": "kfhA3apCUAHcNlwH\n",
-    "auth_tag": "BqRV+CiF9rFrqEToJeisoQ==\n",
+    "encrypted_data": "pvKcwuZgUJsAvClQ4V0BwhwEg09EUEWVxoSx+mFlfG1KpvZE4Cu3u3PalPSD\nldyKsw==\n",
+    "iv": "ED85d6PKyaKB3Wlv\n",
+    "auth_tag": "XVCU/WigC97tNe0bUK6okQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "lndhub_admin_token": {
-    "encrypted_data": "C3aKQIEwcQNCrr+uyLiOY2KAHZh5dUvTZ9IdANPqkGlr\n",
-    "iv": "qrhJJzmmced9lNF1\n",
-    "auth_tag": "CH1fOwMWsidmWBwX2+4nJg==\n",
+    "encrypted_data": "LvCgahQblsKOxK9iNbwDd31atBfemVppHqV7s3K/sR4j\n",
+    "iv": "zObzh2jEsqXk2vD2\n",
+    "auth_tag": "n9m/sBYBfzggwQLWrGpR2Q==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "btcpay_auth_token": {
-    "encrypted_data": "0vRq3ZeYPtNcdlCUQI0ip6YOaQZKBeK/dODL7IxdrAK9pHz+u53aL8LW92nJ\nmHW2DYcv+eX3ltnwu88=\n",
-    "iv": "5HenMAvE1Uu5l7jJ\n",
-    "auth_tag": "rJzkZPRYar1qw4dauSNV2w==\n",
+    "encrypted_data": "M4kGd6+jresm90nWrJG25mX6rfhaU+VlJlIVd/IjOAUsDABryyulJul3GZFh\nFPSI4uEhgIWtn56I0bA=\n",
+    "iv": "hvqHm7A/YfUOJwRJ\n",
+    "auth_tag": "DhtT6IeixD1MSRX+D7JxZA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "s3_access_key": {
-    "encrypted_data": "QB7XpwhzCvLczUojhcjXy+KX26rEDQHSSw983KP8W7Nud1SNbheU1PrDEQv/\n",
-    "iv": "DTtUXHNQ2g04E+oE\n",
-    "auth_tag": "0XSkHE+MG4AnVT4XJR9tzw==\n",
+    "encrypted_data": "FPRpLZoIbLcVWPJhOlX7ZeXGv6TZIWYAD+BKTsJOyOHxDG3eRULqQc89cGWi\n",
+    "iv": "f9WiiGLmDxtygp60\n",
+    "auth_tag": "lGnq4itmByuF/Yp20/6coQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "s3_secret_key": {
-    "encrypted_data": "IEUzFfOBuOwjzD1DbRyk07+jFlZhQVY+a7riDJ3QU1cNYZ3OTJUgJkowA/u5\nrZ6jqehGIzvPlDuzIezxQwN+Dy0ZJueB/ZEdRqhfkXUxgzkqb2s=\n",
-    "iv": "gs9Igisu2EH+dAC/\n",
-    "auth_tag": "gDFuQCwlCL5mvys83CGv+w==\n",
+    "encrypted_data": "JnnwISbHJ+d7JZB/C0NH0fb8p+bDSwoq5t5knSi+bSTltSxKcq6PRX9K6bov\nEbo0GTdWePbuc5NCsyYxfrkzCtpLXTIxeCROtinRmFIgMFNwaOA=\n",
+    "iv": "pKPCaANDqGtbFV3V\n",
+    "auth_tag": "S//hn2HOhuZH8+UfCNBWDg==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "nostr_private_key": {
-    "encrypted_data": "sFnQlwyZF0tfMzbaG/bdwqQLPVdHPpbyDT66FY1+ubssmWUpxsuNtbI71KyY\nI1784c7SSl4qKRgHZRrR658bYMKU4whe836qBgSf7Icczp1VSQY=\n",
-    "iv": "x8RJT4dcNdtm59Zz\n",
-    "auth_tag": "6yxBq1W4jCNDYwP6+cTE6g==\n",
+    "encrypted_data": "AKfFiLow+veDyEWBwmCDuLerT3l+o2aJUCeHg2mZZIyoH4oeo/9crZwIdjBn\n70reouqnHNG9mBHuO/+IPGfj53mHLo+oGHh+6LkL3ImI4MFBofY=\n",
+    "iv": "bPlOKk2qkJAzdKf+\n",
+    "auth_tag": "VIp1IOjBGatn2MN5LHVymg==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }

data_bags/credentials/gandi_api.json

@@ -1,23 +1,23 @@
 {
   "id": "gandi_api",
   "key": {
-    "encrypted_data": "Ky1/PdywtEIl5vVXhzu3n2JetqOxnNjpjQ7yCao6qwIAn8oYxnv1c1hFAQ==\n",
-    "iv": "stAc2FxDvUqrh0kt\n",
-    "auth_tag": "rcK4Qt+f2O4Zo5IMmG0fkw==\n",
+    "encrypted_data": "lU7/xYTmP5Sb6SsK5TNNIyegWozzBtUzpg7oDdl6gcz9FEMmG2ft0Ljh5Q==\n",
+    "iv": "EZPQD3C+wsP/mBhF\n",
+    "auth_tag": "vF9E8Pj4Z8quJJdOMg/QTw==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "access_token": {
-    "encrypted_data": "J7zoLhEbPfPjnVWBmFmDdPKRer5GGw2o6Ad0uinznANugfaDiqjyYinOdEDF\nHlAqLmXv4J40rr3F+o4=\n",
-    "iv": "fAxFqVh9QqrfBsPW\n",
-    "auth_tag": "9ugi4frDLv8f7X0X1+k4DA==\n",
+    "encrypted_data": "1Uw69JkNrmb8LU/qssuod1SlqxxrWR7TJQZeeivRrNzrMIVTEW/1uwJIYL6b\nM4GeeYl9lIRlMMmLBkc=\n",
+    "iv": "cc1GJKu6Cf4DkIgX\n",
+    "auth_tag": "ERem4S7ozG695kjvWIMghw==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "domains": {
-    "encrypted_data": "X0KOKlJp5GYbKcq/jzmlaMmTXV1U7exWSqi3UxX9Sw==\n",
-    "iv": "9JucnYLlYdQ9N6pd\n",
-    "auth_tag": "sERYPDnVUJwVfSS8/xrPpQ==\n",
+    "encrypted_data": "scZ5blsSjs54DlitR7KZ3enLbyceOR5q0wjHw1golQ==\n",
+    "iv": "oDcHm7shAzW97b4t\n",
+    "auth_tag": "62Zais9yf68SwmZRsmZ3hw==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }

nodes/draco.kosmos.org.json

@@ -20,7 +20,7 @@
   "automatic": {
     "fqdn": "draco.kosmos.org",
     "os": "linux",
-    "os_version": "5.4.0-54-generic",
+    "os_version": "5.4.0-187-generic",
     "hostname": "draco",
     "ipaddress": "148.251.237.73",
     "roles": [

nodes/postgres-6.json

@@ -22,6 +22,7 @@
       "kosmos_kvm::guest",
       "kosmos_postgresql::primary",
       "kosmos_postgresql::firewall",
+      "kosmos-akkounts::pg_db",
       "kosmos-bitcoin::lndhub-go_pg_db",
       "kosmos-bitcoin::nbxplorer_pg_db",
       "kosmos_drone::pg_db",

roles/postgresql_primary.rb

@@ -3,6 +3,7 @@ name "postgresql_primary"
 run_list %w(
   kosmos_postgresql::primary
   kosmos_postgresql::firewall
+  kosmos-akkounts::pg_db
   kosmos-bitcoin::lndhub-go_pg_db
   kosmos-bitcoin::nbxplorer_pg_db
   kosmos_drone::pg_db

site-cookbooks/kosmos-akkounts/recipes/default.rb

@@ -24,13 +24,12 @@ package "libvips"
 
 include_recipe 'redisio::default'
 include_recipe 'redisio::enable'
+
+node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_20.x"
 include_recipe 'kosmos-nodejs'
+npm_package "bun"
 
-npm_package "yarn" do
-  version "1.22.4"
-end
-
-ruby_version = "3.3.0"
+ruby_version = "3.3.8"
 ruby_path = "/opt/ruby_build/builds/#{ruby_version}"
 bundle_path = "#{ruby_path}/bin/bundle"
 rails_env = node.chef_environment == "development" ? "development" : "production"
@@ -48,7 +47,28 @@ webhooks_allowed_ips = [lndhub_host].compact.uniq.join(',')
 env = {
   primary_domain: node['akkounts']['primary_domain'],
   akkounts_domain: node['akkounts']['domain'],
-  rails_serve_static_files: true
+  rails_serve_static_files: true,
+  secret_key_base: credentials["rails_secret_key_base"],
+  encryption_primary_key: credentials["rails_encryption_primary_key"],
+  encryption_key_derivation_salt: credentials["rails_encryption_key_derivation_salt"],
+  db_adapter: "postgresql",
+  pg_host: "pg.kosmos.local",
+  pg_port: 5432,
+  pg_database: "akkounts",
+  pg_database_queue: "akkounts_queue",
+  pg_username: credentials["postgresql"]["username"],
+  pg_password: credentials["postgresql"]["password"]
+}
+
+env[:ldap] = {
+  host: "ldap.kosmos.local",
+  port: 389,
+  use_tls: false,
+  uid_attr: "cn",
+  base: "ou=kosmos.org,cn=users,dc=kosmos,dc=org",
+  admin_user: credentials["ldap"]["admin_user"],
+  admin_password: credentials["ldap"]["admin_password"],
+  suffix: "dc=kosmos,dc=org"
 }
 
 smtp_server, smtp_port = smtp_credentials[:relayhost].split(":")
@@ -138,9 +158,9 @@ if lndhub_host
   if postgres_readonly_host
     env[:lndhub_admin_ui] = true
     env[:lndhub_pg_host] = postgres_readonly_host
-    env[:lndhub_pg_database] = node['akkounts']['lndhub']['postgres_db']
-    env[:lndhub_pg_username] = credentials['postgresql_username']
-    env[:lndhub_pg_password] = credentials['postgresql_password']
+    env[:lndhub_pg_database] = node["akkounts"]["lndhub"]["postgres_db"]
+    env[:lndhub_pg_username] = credentials["postgresql"]["username"]
+    env[:lndhub_pg_password] = credentials["postgresql"]["password"]
   end
 end
 
@@ -208,7 +228,7 @@ systemd_unit "akkounts.service" do
       Type: "simple",
       User: deploy_user,
       WorkingDirectory: deploy_path,
-      Environment: "RAILS_ENV=#{rails_env}",
+      Environment: "RAILS_ENV=#{rails_env} SOLID_QUEUE_IN_PUMA=true",
       ExecStart: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid",
       ExecStop: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid stop",
       ExecReload: "#{bundle_path} exec pumactl -F config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid phased-restart",
@@ -225,36 +245,6 @@ systemd_unit "akkounts.service" do
   action [:create, :enable]
 end
 
-systemd_unit "akkounts-sidekiq.service" do
-  content({
-    Unit: {
-      Description: "Kosmos Accounts async/background jobs",
-      Documentation: ["https://gitea.kosmos.org/kosmos/akkounts"],
-      Requires: "redis@6379.service",
-      After: "syslog.target network.target redis@6379.service"
-    },
-    Service: {
-      Type: "notify",
-      User: deploy_user,
-      WorkingDirectory: deploy_path,
-      Environment: "MALLOC_ARENA_MAX=2",
-      ExecStart: "#{bundle_path} exec sidekiq -C #{deploy_path}/config/sidekiq.yml -e #{rails_env}",
-      WatchdogSec: "10",
-      Restart: "on-failure",
-      RestartSec: "1",
-      StandardOutput: "syslog",
-      StandardError: "syslog",
-      SyslogIdentifier: "sidekiq"
-    },
-    Install: {
-      WantedBy: "multi-user.target"
-    }
-  })
-  verify false
-  triggers_reload true
-  action [:create, :enable]
-end
-
 deploy_env = {
   "HOME" => deploy_path,
   "PATH" => "#{ruby_path}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin",
@@ -267,15 +257,7 @@ git deploy_path do
   revision node[app_name]["revision"]
   user  deploy_user
   group deploy_group
-  # Restart services on deployments
-  notifies :run, "execute[restart #{app_name} services]", :delayed
-end
-
-execute "restart #{app_name} services" do
-  command "true"
-  action :nothing
   notifies :restart, "service[#{app_name}]", :delayed
-  notifies :restart, "service[#{app_name}-sidekiq]", :delayed
 end
 
 file "#{deploy_path}/config/master.key" do
@@ -283,7 +265,7 @@ file "#{deploy_path}/config/master.key" do
   mode '0400'
   owner deploy_user
   group deploy_group
-  notifies :run, "execute[restart #{app_name} services]", :delayed
+  notifies :restart, "service[#{app_name}]", :delayed
 end
 
 template "#{deploy_path}/.env.#{rails_env}" do
@@ -293,7 +275,7 @@ template "#{deploy_path}/.env.#{rails_env}" do
   mode 0600
   sensitive true
   variables config: env
-  notifies :run, "execute[restart #{app_name} services]", :delayed
+  notifies :restart, "service[#{app_name}]", :delayed
 end
 
 execute "bundle install" do
@@ -303,13 +285,6 @@ execute "bundle install" do
   command "bundle install --without development,test --deployment"
 end
 
-execute "yarn install" do
-  environment deploy_env
-  user deploy_user
-  cwd deploy_path
-  command "yarn install --pure-lockfile"
-end
-
 execute 'rake db:migrate' do
   environment deploy_env
   user deploy_user
@@ -330,10 +305,6 @@ service "akkounts" do
   action [:enable, :start]
 end
 
-service "akkounts-sidekiq" do
-  action [:enable, :start]
-end
-
 firewall_rule "akkounts_zerotier" do
   command  :allow
   port     node["akkounts"]["port"]

site-cookbooks/kosmos-akkounts/recipes/pg_db.rb

@@ -0,0 +1,22 @@
+#
+# Cookbook:: kosmos-akkounts
+# Recipe:: pg_db
+#
+
+credentials = data_bag_item("credentials", "akkounts")
+pg_username = credentials["postgresql"]["username"]
+pg_password = credentials["postgresql"]["password"]
+
+postgresql_user pg_username do
+  action :create
+  password pg_password
+end
+
+databases = ["akkounts", "akkounts_queue"]
+
+databases.each do |database|
+  postgresql_database database do
+    owner pg_username
+    action :create
+  end
+end

site-cookbooks/kosmos-bitcoin/attributes/default.rb

@@ -90,7 +90,7 @@ node.default['dotnet']['ms_packages_src_url'] = "https://packages.microsoft.com/
 node.default['dotnet']['ms_packages_src_checksum'] = "4df5811c41fdded83eb9e2da9336a8dfa5594a79dc8a80133bd815f4f85b9991"
 
 node.default['nbxplorer']['repo'] = 'https://github.com/dgarage/NBXplorer'
-node.default['nbxplorer']['revision'] = 'v2.5.0'
+node.default['nbxplorer']['revision'] = 'v2.5.23'
 node.default['nbxplorer']['source_dir'] = '/opt/nbxplorer'
 node.default['nbxplorer']['config_path'] = "/home/#{node['bitcoin']['username']}/.nbxplorer/Main/settings.config"
 node.default['nbxplorer']['port'] = '24445'
@@ -98,7 +98,7 @@ node.default['nbxplorer']['postgres']['database'] = 'nbxplorer'
 node.default['nbxplorer']['postgres']['user'] = 'nbxplorer'
 
 node.default['btcpay']['repo'] = 'https://github.com/btcpayserver/btcpayserver'
-node.default['btcpay']['revision'] = 'v1.12.5'
+node.default['btcpay']['revision'] = 'v2.0.7'
 node.default['btcpay']['source_dir'] = '/opt/btcpay'
 node.default['btcpay']['config_path'] = "/home/#{node['bitcoin']['username']}/.btcpayserver/Main/settings.config"
 node.default['btcpay']['log_path'] = "/home/#{node['bitcoin']['username']}/.btcpayserver/debug.log"

site-cookbooks/kosmos-bitcoin/recipes/nbxplorer.rb

@@ -58,9 +58,7 @@ directory '/run/nbxplorer' do
 end
 
 env = {
-  NBXPLORER_POSTGRES: "User ID=#{postgres_user};Password=#{credentials['postgresql_password']};Database=#{postgres_database};Host=pg.kosmos.local;Port=5432;Application Name=nbxplorer;MaxPoolSize=20",
-  NBXPLORER_AUTOMIGRATE: "1",
-  NBXPLORER_NOMIGRATEEVTS: "1"
+  NBXPLORER_POSTGRES: "User ID=#{postgres_user};Password=#{credentials['postgresql_password']};Database=#{postgres_database};Host=pg.kosmos.local;Port=5432;Application Name=nbxplorer;MaxPoolSize=20"
 }
 
 systemd_unit 'nbxplorer.service' do

site-cookbooks/kosmos-ejabberd/recipes/letsencrypt.rb

@@ -16,8 +16,8 @@ set -e
 for domain in $RENEWED_DOMAINS; do
   case $domain in
   kosmos.org|kosmos.chat|5apps.com)
-    cp "${RENEWED_LINEAGE}/privkey.pem" /opt/ejabberd/conf/$domain.key
-    cp "${RENEWED_LINEAGE}/fullchain.pem" /opt/ejabberd/conf/$domain.crt
+    cp "/etc/letsencrypt/live/${domain}/privkey.pem" /opt/ejabberd/conf/$domain.key
+    cp "/etc/letsencrypt/live/${domain}/fullchain.pem" /opt/ejabberd/conf/$domain.crt
     chown ejabberd:ejabberd /opt/ejabberd/conf/$domain.*
     chmod 600 /opt/ejabberd/conf/$domain.*
     /opt/ejabberd-#{node["ejabberd"]["version"]}/bin/ejabberdctl reload_config
@@ -38,12 +38,13 @@ gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
 template "/root/gandi_dns_certbot_hook.sh" do
   variables access_token: gandi_api_credentials["access_token"]
   mode 0700
+  sensitive true
 end
 
 # Generate a Let's Encrypt cert (only if no cert has been generated before).
 # The systemd timer will take care of renewing
 execute "letsencrypt cert for kosmos.org domains" do
-  command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.org\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d uploads.xmpp.kosmos.org -n"
+  command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d upload.kosmos.org -d proxy.kosmos.org -d pubsub.kosmos.org -d uploads.xmpp.kosmos.org -n"
   not_if do
     File.exist?("/etc/letsencrypt/live/kosmos.org/fullchain.pem")
   end

site-cookbooks/kosmos-ejabberd/templates/ejabberd.yml.erb

@@ -258,7 +258,10 @@ modules:
         transport: tcp
         restricted: true
   mod_vcard:
+    db_type: ldap
     search: false
+    ldap_vcard_map:
+      PHOTO: {"%s": [jpegPhoto]}
   mod_vcard_xupdate: {}
   mod_avatar: {}
   mod_version: {}

site-cookbooks/kosmos-mastodon/recipes/nginx.rb

@@ -12,6 +12,13 @@ search(:node, "role:mastodon").each do |node|
 end
 if upstream_hosts.any?
   web_root_dir = "/var/www/#{server_name}/public"
+  directory web_root_dir do
+    action :create
+    recursive true
+    owner 'www-data'
+    group 'www-data'
+    mode 0755
+  end
 else
   web_root_dir = "#{app_dir}/public"
   upstream_hosts << "localhost"

site-cookbooks/kosmos-nginx/recipes/default.rb

@@ -59,7 +59,7 @@ cookbook_file "#{node["nginx"]["user_home"]}/maintenance.html" do
   source "maintenance.html"
   owner node['nginx']['user']
   group node['nginx']['group']
-  mode "0640"
+  mode "0755"
 end
 
 unless node.chef_environment == "development"

site-cookbooks/kosmos_gitea/attributes/default.rb

@@ -1,5 +1,5 @@
-node.default["gitea"]["version"] = "1.23.4"
-node.default["gitea"]["checksum"] = "51c25be0bfc3dab25f7e16e736d0a8e15b8c6c571e69139ee487993956caf8bf"
+node.default["gitea"]["version"] = "1.23.7"
+node.default["gitea"]["checksum"] = "3c0a7121ad1d9c525a92c68a7c040546553cd41e7464ce2fa811246b648c0a46"
 node.default["gitea"]["working_directory"] = "/var/lib/gitea"
 node.default["gitea"]["port"] = 3000
 node.default["gitea"]["postgresql_host"] = "localhost:5432"

site-cookbooks/kosmos_gitea/templates/default/app.ini.erb

@@ -24,9 +24,11 @@ NAME    = gitea
 USER    = gitea
 PASSWD  = <%= @postgresql_password %>
 SSL_MODE = disable
+MAX_OPEN_CONNS = 20
 
 [repository]
 ROOT = <%= @repository_root_directory %>
+DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true
 
 # [indexer]
 # ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve

site-cookbooks/kosmos_rsk/attributes/default.rb

@@ -1,4 +1,4 @@
-node.default['rskj']['version'] = '5.3.0~jammy'
+node.default['rskj']['version'] = '7.0.0~jammy'
 node.default['rskj']['network'] = 'testnet'
 
 node.default['rskj']['nginx']['domain'] = nil

site-cookbooks/kosmos_rsk/recipes/rskj.rb

@@ -19,6 +19,8 @@ apt_repository 'rskj' do
   key '5EED9995C84A49BC02D4F507DF10691F518C7BEA'
 end
 
+apt_package 'openjdk-17-jdk'
+
 apt_package 'rskj' do
   response_file 'rskj-preseed.cfg.erb'
   response_file_variables network: node['rskj']['network']

site-cookbooks/kosmos_rsk/test/integration/rskj/rskj_test.rb

@@ -9,7 +9,7 @@ end
 
 describe package('rskj') do
   it { should be_installed }
-  its('version') { should eq '5.3.0~jammy' }
+  its('version') { should eq '7.0.0~jammy' }
 end
 
 describe service('rsk') do

site-cookbooks/kosmos_website/templates/nginx_conf_website.erb

@@ -29,11 +29,15 @@ server {
   ssl_certificate     <%= @ssl_cert %>;
   ssl_certificate_key <%= @ssl_key %>;
 
+  location /.well-known/host-meta.json {
+    add_header 'Access-Control-Allow-Origin' '*';
+  }
+
 <% if @accounts_url %>
   location ~ ^/.well-known/(keysend|lnurlp|nostr|openpgpkey|webfinger) {
     proxy_ssl_server_name on;
     proxy_set_header X-Forwarded-Host $host;
-    proxy_pass https://accounts.kosmos.org;
+    proxy_pass <%= @accounts_url %>;
   }
 <% end %>
 }