Migrate accounts API proxy to openresty

nodes/draco.kosmos.org.json

@@ -38,6 +38,8 @@
       "kosmos_openresty::default",
       "kosmos_openresty::firewall",
       "kosmos_assets::nginx_site",
+      "kosmos-akkounts::nginx",
+      "kosmos-akkounts::nginx_api",
       "kosmos_discourse::nginx",
       "kosmos_drone::nginx",
       "kosmos_gitea::nginx",
@@ -45,9 +47,6 @@
       "kosmos_rsk::nginx_mainnet",
       "kosmos_website",
       "kosmos_website::default",
-      "kosmos-akkounts::nginx",
-      "kosmos-akkounts::nginx_api",
-      "kosmos-bitcoin::nginx_lndhub",
       "kosmos_encfs",
       "kosmos_encfs::default",
       "kosmos-ejabberd::firewall",

roles/openresty_proxy.rb

@@ -25,6 +25,7 @@ default_run_list = %w(
   kosmos_garage::firewall_rpc
   kosmos_garage::nginx_web
 
+  kosmos-bitcoin::nginx_lndhub
   kosmos-ejabberd::nginx
   kosmos-hubot::nginx_botka_irc-libera-chat
   kosmos-hubot::nginx_hal8000_xmpp
@@ -36,15 +37,14 @@ default_run_list = %w(
 production_run_list = %w(
   role[openresty]
   kosmos_assets::nginx_site
+  kosmos-akkounts::nginx
+  kosmos-akkounts::nginx_api
   kosmos_discourse::nginx
   kosmos_drone::nginx
   kosmos_gitea::nginx
   kosmos_rsk::nginx_testnet
   kosmos_rsk::nginx_mainnet
   kosmos_website::default
-  kosmos-akkounts::nginx
-  kosmos-akkounts::nginx_api
-  kosmos-bitcoin::nginx_lndhub
 )
 
 env_run_lists(

site-cookbooks/kosmos-bitcoin/metadata.rb

@@ -14,7 +14,6 @@ depends 'git'
 depends 'golang'
 depends 'kosmos-nginx'
 depends 'kosmos-nodejs'
-depends 'kosmos_openresty'
 depends 'kosmos_postgresql'
 depends 'postgresql'
 depends 'redisio'

site-cookbooks/kosmos-bitcoin/recipes/nginx_lndhub.rb

@@ -3,20 +3,27 @@
 # Recipe:: nginx_lndhub
 #
 
+include_recipe "kosmos-base::letsencrypt"
+include_recipe "kosmos-nginx"
+
 domain = node['lndhub-go']['domain']
 
+nginx_certbot_site domain
+
 upstream_host = search(:node, "role:lndhub").first["knife_zero"]["host"]
 
-tls_cert_for domain do
-  auth "gandi_dns"
-  action :create
-end
-
-openresty_site domain do
-  template 'nginx_conf_lndhub.erb'
-  variables server_name: domain,
-            port: node['lndhub-go']['port'],
+template "#{node['nginx']['dir']}/sites-available/#{domain}" do
+  source 'nginx_conf_lndhub.erb'
+  owner node["nginx"]["user"]
+  mode 0640
+  variables port: node['lndhub-go']['port'],
+            server_name: domain,
             ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
             ssl_key:  "/etc/letsencrypt/live/#{domain}/privkey.pem",
             upstream_host: upstream_host
+  notifies :reload, 'service[nginx]', :delayed
+end
+
+nginx_site domain do
+  action :enable
 end

site-cookbooks/kosmos-bitcoin/templates/nginx_conf_lndhub.erb

@@ -6,7 +6,7 @@ upstream _lndhub {
 }
 
 server {
-  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
+  listen 443 ssl http2;
   listen [::]:443 ssl http2;
   server_name <%= @server_name %>;