Support letsencrypt proxy validation via CNAMEs

Allows to point other domains' `_acme-challenge.example.com` entries at `example.com.letsencrypt.kosmos.chat` so we can validate from our side without access to the other domain's DNS records. Used for 5apps.com XMPP for now. Can be used for others later.
2024-03-11 16:15:12 +01:00
56 changed files with 179 additions and 743 deletions
--- a/.gitmodules
+++ b/.gitmodules
@@ -4,9 +4,3 @@
 [submodule "site-cookbooks/openresty"]
 	path = site-cookbooks/openresty
 	url = https://github.com/67P/chef-openresty.git
-[submodule "site-cookbooks/strfry"]
-	path = site-cookbooks/strfry
-	url = git@gitea.kosmos.org:kosmos/strfry-cookbook.git
-[submodule "site-cookbooks/deno"]
-	path = site-cookbooks/deno
-	url = git@gitea.kosmos.org:kosmos/deno-cookbook.git
--- a/clients/strfry-1.json
+++ b/clients/strfry-1.json
@@ -1,4 +0,0 @@
-{
-  "name": "strfry-1",
-  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzDV/RMGMXVDbvoA6PNh8\nQzhtHwYDCFcUSkbrwP6tzh6GpVunGEOdOdhj2V63T2tF1H+lujxQXh5pK7C0D6VZ\niO04ftJlo7/svyxUcwWr+znyN5sFdQRh3cBZiGSBYolizwoqgtPFlbNhmWAzV0Du\n9t8mhz70IK3B+UdwWyHtoK0NNsJGnQ9YzAvcjyDmEO/3sCjAhNnxVpmXftpcSmd9\nMonzFtIDBbRRll4AHZYRbmXCzx63+VmelvdnufnbY82liol0zzBwJaBD1wyNlG0y\ni96p3Kx03bLNlIaYVGbjZeJi+6oo2VDWJ4OloLLAYoHDSipeHT9qWfUdnE6ge4Lm\nywIDAQAB\n-----END PUBLIC KEY-----\n"
-}
--- a/data_bags/credentials/akkounts.json
+++ b/data_bags/credentials/akkounts.json
@@ -1,72 +1,65 @@
 {
  "id": "akkounts",
  "postgresql_username": {
-    "encrypted_data": "bDlOkEmhvMgyVzPeTNUzYnzRLf3T9cc0cDxt\n",
-    "iv": "GCCUoqU5pxQ7fGkv\n",
-    "auth_tag": "Q7mrSHIBluMe3CGVmoR86Q==\n",
+    "encrypted_data": "l00Lmdbl5xNq07XU4XmcnRxXsIJaYyMQQ6xI\n",
+    "iv": "yxvL6hKwlVWmdMzl\n",
+    "auth_tag": "mMCV9ewJW/0TfVE76WBSZw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "postgresql_password": {
-    "encrypted_data": "wD0HtdsNe/hl4ZaOy8hyr2k4z8TXQrrSja3KNVE47w==\n",
-    "iv": "tb5yz8WDer0CsGvJ\n",
-    "auth_tag": "/+K2anuCff/6M7Pu70Smqw==\n",
+    "encrypted_data": "Q6xWsH6bmI1GfMzme3mBRYrt3XmDwFJ7E4FjYg2Rrw==\n",
+    "iv": "jcQmuT7Jz3g3XE8d\n",
+    "auth_tag": "nNMvf9UmP6ikf1BW93QZIw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "sentry_dsn": {
-    "encrypted_data": "jCz681x0WVixHYZUb62TO+1cgyJMiJ2UMqWcaztx57yDBOIiKW3oSZjuXdhP\n9WCesfXQF/lgzITZno3IKDqzlKjWgbGLC75y8FLguxidCHI=\n",
-    "iv": "IRNOzN/hLwg1iqax\n",
-    "auth_tag": "eg9dWnEK04JDb94e4CFa9Q==\n",
+    "encrypted_data": "V7cqlH2baN1Ix/ggQFeo9PY6dNKKpnDECaB1cO3XuCfy74oN2ot44nbpCQTA\nUl0+1LQv/qNn/L4gmJkqZfdIXZQqhR+iTc06UJxe3aTKJDw=\n",
+    "iv": "HJtdKYcApwaxhTXI\n",
+    "auth_tag": "qyIYK9h6nciJTFXBWOjVOA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "rails_master_key": {
-    "encrypted_data": "nUB77VLRp41rluH7hLBwQqPtnh/HsmfLr2VbcIZHWawL3o2TGuY+mj648f9L\n7XsEpgqY\n",
-    "iv": "fpdbDitqTRHxEKiv\n",
-    "auth_tag": "I44fn8Ott3L/Y5LYr56U/Q==\n",
+    "encrypted_data": "KAl2Kgq1TXjOm4TNxGwZkPwJeOSNLbLLKiRdb4fTyBFfUhIGGeCS9VvV9kIb\n9sQZ6HLU\n",
+    "iv": "BBPvDNs6nBXDti5I\n",
+    "auth_tag": "yjM/0nyUwt+5SSGuLC5qWA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "discourse_connect_secret": {
-    "encrypted_data": "ENtMn+1XTVFmdEZw7LU6WGoMbSZY654ggm3vPACGfFgqo6r0LhG60c5OTdqv\nZvT5/Q==\n",
-    "iv": "bL1BmvRhgxFqSM1P\n",
-    "auth_tag": "sEBZzGWwwYFHn+4B4SsyCA==\n",
+    "encrypted_data": "YHkZGzXeK3nDHaXt3JKmGtCcvMfgvv3yHbvS2C+CLKagOIOe+0+2/CiNuh4U\nxO1Pug==\n",
+    "iv": "SnUxDpIMQum8ySfN\n",
+    "auth_tag": "Ny6I+3EoCA1s74JLjjbbyQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "lndhub_admin_token": {
-    "encrypted_data": "4LPGFoARzI8UYnsJPIk8sax/rAA16pUULEZWn86e2C7L\n",
-    "iv": "nvjXrOwgfgutwEVw\n",
-    "auth_tag": "A89RUf1sdcS3FVscNPWYLg==\n",
+    "encrypted_data": "dJHxB80Enwkm+2aNuIrp7lILAy2J5tQaChPJCl/BHwMo\n",
+    "iv": "zHLtD1jTIwvjMt1l\n",
+    "auth_tag": "IC0adEzsS5YF5YHqabWw2A==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "btcpay_auth_token": {
-    "encrypted_data": "ky5iWYF06os0Ek6vIRzWqMTekqJhCOh/Q9DTDIeKhSyk8TnT3O71lCNEt1F5\nXCNq6ux3V6oyHVLWj0o=\n",
-    "iv": "zk6WnxsY89oNW1F9\n",
-    "auth_tag": "FAIMXKvQ1T7QKezVSNJbwQ==\n",
+    "encrypted_data": "YbM0HvgIijluKQBcgfKn6hmWvdbhr0ijR1xKc+BRZCZJsRaJBHTjCbwhH8T9\nVnBESruyjhxphtBetcc=\n",
+    "iv": "3107v/c2Tonx6/cP\n",
+    "auth_tag": "jnO9fvoXJW5gbDMRjkdMPA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_access_key": {
-    "encrypted_data": "KfhfEGwPjOonlz6rpnNTinXFPqX/sIbqQn/aby0UDi/G/7cvEcOiNcCkfuSz\n",
-    "iv": "Q3rg06v6K9pUDLDY\n",
-    "auth_tag": "G5ugdlJ896KtYtObKLclJA==\n",
+    "encrypted_data": "PFjQKe1us12SNHlReQ4f0qctulPp4d2F3t5t+AGocp87PS/kZx77rtHQtruK\n",
+    "iv": "BGD8+XchqwPmhhwi\n",
+    "auth_tag": "XefaZKCVs8hotszALN+kxQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_secret_key": {
-    "encrypted_data": "N8s1OoDrYXHjqSydQA0kY7dd68Aelq4+/cgmJlYfP92u4YA17V4TR7fsvQZL\nkqjuUSClNYPc0XiCwf/5gxVirE9AO6OmmvSV7lUyu4hcEY6unrU=\n",
-    "iv": "bXzIVWnX6V0P6PRb\n",
-    "auth_tag": "1EOjCfsX9P6ETjUsgBvBsA==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "nostr_private_key": {
-    "encrypted_data": "Sf8PEyQ0sqcgxddSlIDxLOVzPjOkTFObsYuTgcxkbEV7igrati4e8QVVUEBD\n1yoLJXelp8jlCr28Ectci29jc53gYSMTLSQsw97uYas2R0dGCqQ=\n",
-    "iv": "+1CIUyvIUOveLrY4\n",
-    "auth_tag": "GDqS+IuAIfMBmHIeFXaV7A==\n",
+    "encrypted_data": "ziO35x8P1YMaSeenMNQoTWug62b5ZVLFlkMlJEFGnYjHK5qTAn6ir06WnMJC\n0zErzTZsPpcr7KpE/ipWgWHRy7qVbGnd6iVO4t9tf5NjiU2OXfA=\n",
+    "iv": "S3syCCxh2m+mylLu\n",
+    "auth_tag": "ZMkyBqXMXr3K3LGqxWvbtA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
--- a/data_bags/credentials/dirsrv.json
+++ b/data_bags/credentials/dirsrv.json
@@ -1,30 +1,9 @@
 {
  "id": "dirsrv",
-  "admin_dn": {
-    "encrypted_data": "zRtz6Scb9WtUXGyjc0xyvsre0YvqupuaFz+RPApj7DEQTmYyZPVb\n",
-    "iv": "xfIXMhEBHBWqa4Dz\n",
-    "auth_tag": "BcA32u1njcnCZ+yrBGSceQ==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
  "admin_password": {
-    "encrypted_data": "7JpXl3JZDqKWDfYt/wuNbkbob+oRuONhkuAlpqUCCEIn+tY=\n",
-    "iv": "Lcwc4NDzrfcBaIKQ\n",
-    "auth_tag": "rrePS3Bhdnwbr2d/o8vMhg==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "service_dn": {
-    "encrypted_data": "sqRFiZreLeTPQljSfhAuV3DmsPxSC8tzWjCdu+WSSbO67sBQA+xhmGtzBhBD\nDZPGJw+jtAxzuVvPdAjxgAVgxXO6C6WEo87L1tdJewE=\n",
-    "iv": "GUEGtyRJXrPhWcUs\n",
-    "auth_tag": "2USsrx//3V7RCyumGCbMkg==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "service_password": {
-    "encrypted_data": "f2wi8B8SEt6p5G0TF3dZ72j0vMFlvwcP1suxYnshBA==\n",
-    "iv": "rOnUoxbnkaJtodM+\n",
-    "auth_tag": "dVLCtBVMjxLfW2D8XjJBdQ==\n",
+    "encrypted_data": "i71l5E129mXCcDAyME8sNMUkYUlQMgt7Eh6noyFcLNgbaMo=\n",
+    "iv": "KNW2B8tpX7ywZwbg\n",
+    "auth_tag": "GawQ+FSlA5v5YVyryeUxng==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
--- a/data_bags/credentials/gandi_api.json
+++ b/data_bags/credentials/gandi_api.json
@@ -1,24 +0,0 @@
-{
-  "id": "gandi_api",
-  "key": {
-    "encrypted_data": "d3/rJMX6B9GuzUt0/mIk/lgQ3qGyQdbNXH6UEm3ZX7DeSl+rbW9FPJCRWg==\n",
-    "iv": "15YVAYla7PqqVOab\n",
-    "auth_tag": "xQSq+ld6SDOAER07N4ZkUQ==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "access_token": {
-    "encrypted_data": "geQwcNosiJZmqbbMpD/I+a2yueBzpV6C8Rb7vrCD8kR161ZRjvqLe+g/1XpT\n2/65wKYDMTrdto1I030=\n",
-    "iv": "1sj58eyooOZ8FTYn\n",
-    "auth_tag": "yBNfgWXaToc06VDLly/HUw==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "domains": {
-    "encrypted_data": "p5rIQTyCE+0d4HIuA4GKEAFekh7qEC4xe9Rm/kP0DyzY83FO0/4uKIvYoZRB\n",
-    "iv": "LWlx98NSS1/ngCH1\n",
-    "auth_tag": "FID+x/LjTZ3cgQV5U2xZLA==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  }
-}
--- a/data_bags/credentials/gandi_api_5apps.json
+++ b/data_bags/credentials/gandi_api_5apps.json
@@ -0,0 +1,17 @@
+{
+  "id": "gandi_api_5apps",
+  "key": {
+    "encrypted_data": "AGYIkLdbnU3+O6OxGsFyLpZtTw531s2dbRC4Lik+8NYp3l4P0UMM2Pqf0g==\n",
+    "iv": "kPRHGpLwNIC3MpES\n",
+    "auth_tag": "wKth2tA+JxILFIKppHLDJg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "access_token": {
+    "encrypted_data": "+tKKFcWV0CZ5wEB/No5hou5+p1llsUkq7AXBvfnA7xsgbpa2q8AX/2UFf9Cf\nGtd9om1CeJJtz+o4ceA=\n",
+    "iv": "hLJSV77DQtqXZDbV\n",
+    "auth_tag": "8xgyudyDk4hq16LRkykGhQ==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  }
+}
--- a/data_bags/credentials/mastodon.json
+++ b/data_bags/credentials/mastodon.json
@@ -1,93 +1,79 @@
 {
  "id": "mastodon",
  "paperclip_secret": {
-    "encrypted_data": "VJn4Yd2N7qFV+nWXPjPA8Y2KEXL/gZs2gK5E3DZZc9ogFXV7RtpDtq+NKGJU\ndpR8ohtEZvkyC+iBkMAlnS1sSVKiLdQ1xXvbzkj04mYgjnLvwsZ19uVpBGwR\nt/DON7Bhe5Fw+OyrBQksqNcZQSpB9sMBfgA1IgCpdVGHQ8PmkMbFTaZZYcoF\n7gg3yUw5/0t3vRdL\n",
-    "iv": "X5atp/KaIurfln/u\n",
-    "auth_tag": "mVnBoUb5HwhXNYUddJbq8Q==\n",
+    "encrypted_data": "orOIbqFANPCkd4sUTCyyoh4z1o6SBudgH4wKJudTo9dANaHGhWcBUFKrhZi1\nMJTBQx/d0hiDI1P2XN3h+hROCg3JJ8OClUSJH9CfN5GlbWvXh0Nhq7hqy8L3\nLAPL+uigiXI6ObrnKQoD8LeJIB46233uwaCA/7zB6gah0ExJ2DXGH6qq9JSS\nqmTFiy+hT+VHGrUo\n",
+    "iv": "U4E4NLYLkP0/tTTs\n",
+    "auth_tag": "WKQ+pDPZp7B791lhC5j3iQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "secret_key_base": {
-    "encrypted_data": "d0sNREFhzQEJhkRzielbCNBJOVAdfThv7zcYTZ1vFZ20i/mzB9GWW2nb+1yn\nNFjAq8wCLpLXn9n3FClE+WOqnAw0jwTlyScRM5lzjKI5SxHKkBQHGyFs2AF8\nqFjEvpiqxhjsc4kNOJGO8DdcyHuulXyaO9fJg8HDnU1ov1vSSuTc0ABKgycY\nMq/Xt10UXnhP8cPw\n",
-    "iv": "HFT7fdGQ2KRJ2NFy\n",
-    "auth_tag": "C55JT2msLQCoI+09VKf+Jw==\n",
+    "encrypted_data": "vweClhdY8SqQkK+p0OYUL2B6Fsz5eQDpEYWCtd/eRJfwwYAObbLcMWRC6MwE\neQVMw59bOqYc3RBuv/+WPLtENazA1bYCXBXQr1J6xqjJAz0Mo6KbRyxy5n78\nv8q6RSiao1VVIUXohtFlQgWeV6x5sz34bJxjlHinKvKsgiGXiuVBxYUUfzWQ\nuzrGug09cpZBqfpc\n",
+    "iv": "Z0/csEBH5/X1+MR+\n",
+    "auth_tag": "fTvBN6eovi3JVEK0ZX97Nw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "otp_secret": {
-    "encrypted_data": "1iH7mUkaUzyn9dfDwMdiJ8X059qWSUO3DqivsOFfI1f44nMnzllaYPu6nh8O\nNLNCOzvsSAonhhaq1X+foOdyPIG2mGhE/juKveDD57/AdZAayHWsbsQlPC4l\nwdShz/ANrq0YZ/zOhpT2sZj1TZavW+S+JlxJFX2kP24D4dUzwG0vNj7522+Q\n9NAApJdUte1ZYF/b\n",
-    "iv": "00/vs5zTdoC19+pS\n",
-    "auth_tag": "3cjYqebMshnmWkQ3SdRcCQ==\n",
+    "encrypted_data": "o1ts1bUgPIzFQXjJ2MpBMLntWkyPxDaJAaU1K3WzmNMXnw5MVlkKKCEFVccd\nPss/MwDuBkbNPhri3ZkH48m9SiayWETVYvw5GZzcVsw4TeMu915O44lfl9tX\nW3XHU+DBps1BVH9535R4X9M1aFW4W4XfwHtS5wcrZqtVhNhS3NSgE4JpN/Dz\nFdcFAOhflnt8fIAN\n",
+    "iv": "QLsxmIlX1NpxMyHz\n",
+    "auth_tag": "j1h/PvIoqshTBN5c5IaAsA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "aws_access_key_id": {
-    "encrypted_data": "krcfpxOrAkwZR2GP4glTaFg2dw/COw8BO8I+KICqyl4bvpL5NrB9\n",
-    "iv": "paoDKp6EIU8bjxzF\n",
-    "auth_tag": "p6Pt/tz5dgGXzW5cO06nBg==\n",
+    "encrypted_data": "YQHUx0GugKu0AtlbGLRGocFEhTGAghWA0DUs1Nxs4Hd3bTIp4lyM\n",
+    "iv": "54zt2tkQhHtpY7sO\n",
+    "auth_tag": "ofBJx3QDsjHe66ga3nji8g==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "aws_secret_access_key": {
-    "encrypted_data": "aQySCT7gxeNiMMocq81KtIi+YzrZwMBeTd4LrRSN8iNEikWReJrrfagBwozy\n+Gfdw4bMGzY1dhF1Sl4=\n",
-    "iv": "R/hvvOvmqq/uoKbx\n",
-    "auth_tag": "QBJY/3+OprBXO/FSNwv2OQ==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "ldap_bind_dn": {
-    "encrypted_data": "wDPABdL+DlXz2WWV4XwW20kM4EWPSwc/ajBmbdYMnjFau6c76CIBpbFhrFoj\n3mwDbHz8cgOnLNvozXSV4w6N7URCN/mWWTBHNhd3ppw=\n",
-    "iv": "8rQ0M4LT1HbCNpq9\n",
-    "auth_tag": "AuO5R6WCtd75TGJNfgFSCg==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "ldap_password": {
-    "encrypted_data": "y0t8RuptVYiTKmUhaAWsC4c2ZzhQsYeVLeMPiQBn+Q==\n",
-    "iv": "mixYzDKkPSIDQ/l+\n",
-    "auth_tag": "DbLlZG7rlgBmyCdJ3nhSYA==\n",
+    "encrypted_data": "FAz6xZ+wsCz/KFA+DK6f4V04rxJt+9U/yXUGF9tvce0VqB3scH+T0KDDn1/n\nZ/0G0Tbxt2urRPbPUdI=\n",
+    "iv": "iapSpeM6lfDMIfNk\n",
+    "auth_tag": "HlkwUnNeJlOUrZ3ieN5xAQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "smtp_user_name": {
-    "encrypted_data": "Ugc29HUFcirv6jOOlYNs9uvmhfwa2rG41im/MusCx0Vu0AZKcdy0krGi/kCZ\nKg==\n",
-    "iv": "ZlDK854w+vTNmeJe\n",
-    "auth_tag": "Nj95g0JMxrT419OLQIX26g==\n",
+    "encrypted_data": "ivB09/mCRrUaz9X4NFRBiqytjgy/vxN5Nha7gopFq5eSu9v4K9MkaLRqHh1I\nYw==\n",
+    "iv": "a8WKhRKsUjqBtfmn\n",
+    "auth_tag": "ib5WJNNaO7bRIspdACmOLw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "smtp_password": {
-    "encrypted_data": "D1TGjRfmM1ZeUmzwewlKXfQvvqTSzpzNlK5MKIU8dxbAH175UKn5qiemDEWe\nRYPe1LWT\n",
-    "iv": "D1OVfD5bMcefM5DP\n",
-    "auth_tag": "2E/q2gTbdXiLVnOMDeJv9w==\n",
+    "encrypted_data": "FxPz2e7fUNqcAu+DDJKlqn8rcSBLmnzigTFf5moZlQ1zz4YVl6pqHisa22Qz\nbfUx9rjU\n",
+    "iv": "GvRlNDV/b1WawtOP\n",
+    "auth_tag": "kyRCGfSJQelIwThDT4iQQQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "vapid_private_key": {
-    "encrypted_data": "+87bVrbd/XvWhZH1IYusc4Hla7ZZmylptAyJf48CMG/F3SMEO33OqW2I+UWh\nSkqbxai5+GaMhvZHB8U2Clod\n",
-    "iv": "HVhNdFQl0TvCcjsa\n",
-    "auth_tag": "EEQXuQ5keOHXmchhBh+Ixw==\n",
+    "encrypted_data": "DlbEAhd+SkSJoOSuwGhd5bdFlJADnT0w4u0+6m8AJoWJjoSCGAnzzmdHWT/k\nVUDkwiBCkqmEPK0oTvxnl/a8\n",
+    "iv": "6e0Gay7GVrQad1rI\n",
+    "auth_tag": "jjVundJ/ITxP/oYgEgzElg==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "vapid_public_key": {
-    "encrypted_data": "nBm1lXbn1+Kzol95+QSEjsUI/n7ObhdEqEyfYcVSP/LiLy57KOBQDu6CjSMz\n+PN9yEP4lOjtscqHS29jTC2vi3PSui9XpOFHRxFBnDuyKxczrnID2KlLCNRQ\n228G3VRgFIMAWMYKACgzUk0=\n",
-    "iv": "xHrVl+4JGkQbfUW3\n",
-    "auth_tag": "rfFoBMocq17YiDSlOCvWqw==\n",
+    "encrypted_data": "+m37w/eWYqdEjsEYQw27FvQC+37ucruOFjZAjo0OgCwA0SoVz4VHX2eSA2AK\njX4CnM91cY4e/WG/ZHKlOMN1PftyQn2bdGaw35nXDanep8z0ROa01JEEi5DE\nUFRKvBmPInTeR6xvemuj7GM=\n",
+    "iv": "loYbGrAsWGLUZ+BK\n",
+    "auth_tag": "lAfpEEVQq+n7MLLm/kpmIA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_key_id": {
-    "encrypted_data": "pq0+VZhjoxzLuyY34f23wOmuks9Wevt8Wu6muKZAsZMSuU0iJvlRoK/65Qa0\n",
-    "iv": "QTxO+IfYcpI170ON\n",
-    "auth_tag": "4ZHva2iBYgDv6DyhMRRXzA==\n",
+    "encrypted_data": "4B8OQ0iVCCna4FvC+EuS5prEUWaHRm1+tzXGmFoCQ4WZfhUA1HwT3x651e/R\n",
+    "iv": "1/zGwcQPQQQCiXIs\n",
+    "auth_tag": "siK9ph1q3/VVEycy91wkqQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_secret_key": {
-    "encrypted_data": "YMZqKtOXDPAME8IWWC+lO8TsxHMzawlbTju9z/Hcb5DnQAOy82QufTN90m73\n/xikUboAdKcA5YGn0mkm+Rt/ygVR6DFirYV3kwi2M3qyGVJifug=\n",
-    "iv": "9AwabheRFOgC8IKR\n",
-    "auth_tag": "iU2kkA1q8OsblN5jaZrWGQ==\n",
+    "encrypted_data": "BSAc8dE/rQUiVvTGV6Ee/ZUDpq4HZlpoaCZ+lbQAbcnxui4ib0OTLPFwhVJ9\n4OQWahtSzkqxMc6MKWpadLT1a3oTnvnae9b3u40X5b2P3VyZYCM=\n",
+    "iv": "bqw8GTqLMTs5vD5n\n",
+    "auth_tag": "+e48L1lYVNda7VE3uLOAHA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
--- a/environments/production.json
+++ b/environments/production.json
@@ -3,7 +3,6 @@
  "override_attributes": {
    "akkounts": {
      "btcpay": {
-        "public_url": "https://btcpay.kosmos.org",
        "store_id": "FNJVVsrVkKaduPDAkRVchdegjwzsNhpceAdonCaXAwBX"
      },
      "ejabberd": {
@@ -12,10 +11,6 @@
      "lndhub": {
        "public_url": "https://lndhub.kosmos.org",
        "public_key": "024cd3be18617f39cf645851e3ba63f51fc13f0bb09e3bb25e6fd4de556486d946"
-      },
-      "nostr": {
-        "public_key": "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a",
-        "relay_url": "wss://nostr.kosmos.org"
      }
    },
    "discourse": {
@@ -38,7 +33,8 @@
        "hostmaster@kosmos.org":  "mail@kosmos.org",
        "postmaster@kosmos.org":  "mail@kosmos.org",
        "abuse@kosmos.org":       "mail@kosmos.org",
-        "mail@kosmos.org":        "foundation@kosmos.org"
+        "mail@kosmos.org":        "foundation@kosmos.org",
+        "hackerhouse@kosmos.org": "mail@lagrange6.com"
      }
    },
    "garage": {
@@ -77,7 +73,6 @@
    },
    "kosmos-mastodon": {
      "domain": "kosmos.social",
-      "user_address_domain": "kosmos.social",
      "s3_endpoint": "http://localhost:3900",
      "s3_region": "garage",
      "s3_bucket": "kosmos-social",
@@ -102,20 +97,6 @@
    },
    "sentry": {
      "allowed_ips": "10.1.1.0/24"
-    },
-    "strfry": {
-      "domain": "nostr.kosmos.org",
-      "real_ip_header": "x-real-ip",
-      "policy_path": "/opt/strfry/strfry-policy.ts",
-      "whitelist_pubkeys": [
-        "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a"
-      ],
-      "info": {
-        "name": "Kosmos Relay",
-        "description": "Members-only nostr relay for kosmos.org users",
-        "pubkey": "1f79058c77a224e5be226c8f024cacdad4d741855d75ed9f11473ba8eb86e1cb",
-        "contact": "ops@kosmos.org"
-      }
    }
  }
 }
--- a/nodes/draco.kosmos.org.json
+++ b/nodes/draco.kosmos.org.json
@@ -54,10 +54,8 @@
      "kosmos_liquor-cabinet::nginx",
      "kosmos_rsk::nginx_testnet",
      "kosmos_rsk::nginx_mainnet",
-      "kosmos_strfry::nginx",
      "kosmos_website",
      "kosmos_website::default",
-      "kosmos_website::redirects",
      "kosmos-akkounts::nginx",
      "kosmos-akkounts::nginx_api",
      "kosmos-bitcoin::nginx_lndhub",
--- a/nodes/fornax.kosmos.org.json
+++ b/nodes/fornax.kosmos.org.json
@@ -48,10 +48,8 @@
      "kosmos_liquor-cabinet::nginx",
      "kosmos_rsk::nginx_testnet",
      "kosmos_rsk::nginx_mainnet",
-      "kosmos_strfry::nginx",
      "kosmos_website",
      "kosmos_website::default",
-      "kosmos_website::redirects",
      "kosmos-akkounts::nginx",
      "kosmos-akkounts::nginx_api",
      "kosmos-bitcoin::nginx_lndhub",
--- a/nodes/mastodon-3.json
+++ b/nodes/mastodon-3.json
@@ -14,7 +14,6 @@
    "ipaddress": "192.168.122.161",
    "roles": [
      "kvm_guest",
-      "ldap_client",
      "garage_gateway",
      "mastodon",
      "postgresql_client"
@@ -23,7 +22,6 @@
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
-      "kosmos-dirsrv::hostsfile",
      "kosmos_garage",
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
@@ -86,7 +84,6 @@
  "run_list": [
    "recipe[kosmos-base]",
    "role[kvm_guest]",
-    "role[ldap_client]",
    "role[garage_gateway]",
    "role[mastodon]"
  ]
--- a/nodes/strfry-1.json
+++ b/nodes/strfry-1.json
@@ -1,66 +0,0 @@
-{
-  "name": "strfry-1",
-  "chef_environment": "production",
-  "normal": {
-    "knife_zero": {
-      "host": "10.1.1.164"
-    }
-  },
-  "automatic": {
-    "fqdn": "strfry-1",
-    "os": "linux",
-    "os_version": "5.15.0-1060-kvm",
-    "hostname": "strfry-1",
-    "ipaddress": "192.168.122.54",
-    "roles": [
-      "base",
-      "kvm_guest",
-      "strfry",
-      "ldap_client"
-    ],
-    "recipes": [
-      "kosmos-base",
-      "kosmos-base::default",
-      "kosmos_kvm::guest",
-      "kosmos-dirsrv::hostsfile",
-      "strfry",
-      "strfry::default",
-      "kosmos_strfry::policies",
-      "kosmos_strfry::firewall",
-      "apt::default",
-      "timezone_iii::default",
-      "timezone_iii::debian",
-      "ntp::default",
-      "ntp::apparmor",
-      "kosmos-base::systemd_emails",
-      "apt::unattended-upgrades",
-      "kosmos-base::firewall",
-      "kosmos-postfix::default",
-      "postfix::default",
-      "postfix::_common",
-      "postfix::_attributes",
-      "postfix::sasl_auth",
-      "hostname::default",
-      "deno::default"
-    ],
-    "platform": "ubuntu",
-    "platform_version": "22.04",
-    "cloud": null,
-    "chef_packages": {
-      "chef": {
-        "version": "18.4.12",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.4.12/lib",
-        "chef_effortless": null
-      },
-      "ohai": {
-        "version": "18.1.11",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
-      }
-    }
-  },
-  "run_list": [
-    "role[base]",
-    "role[kvm_guest]",
-    "role[strfry]"
-  ]
-}
--- a/roles/openresty_proxy.rb
+++ b/roles/openresty_proxy.rb
@@ -28,9 +28,7 @@ production_run_list = %w(
  kosmos_liquor-cabinet::nginx
  kosmos_rsk::nginx_testnet
  kosmos_rsk::nginx_mainnet
-  kosmos_strfry::nginx
  kosmos_website::default
-  kosmos_website::redirects
  kosmos-akkounts::nginx
  kosmos-akkounts::nginx_api
  kosmos-bitcoin::nginx_lndhub
--- a/roles/strfry.rb
+++ b/roles/strfry.rb
@@ -1,8 +0,0 @@
-name "strfry"
-
-run_list %w(
-  role[ldap_client]
-  strfry::default
-  kosmos_strfry::policies
-  kosmos_strfry::firewall
-)
--- a/site-cookbooks/deno
+++ b/site-cookbooks/deno
--- a/site-cookbooks/kosmos-akkounts/attributes/default.rb
+++ b/site-cookbooks/kosmos-akkounts/attributes/default.rb
@@ -1,5 +1,5 @@
 node.default['akkounts']['repo'] = 'https://gitea.kosmos.org/kosmos/akkounts.git'
-node.default['akkounts']['revision'] = 'live'
+node.default['akkounts']['revision'] = 'master'
 node.default['akkounts']['port'] = 3000
 node.default['akkounts']['domain'] = 'accounts.kosmos.org'
 node.default['akkounts']['primary_domain'] = 'kosmos.org'
@@ -11,7 +11,6 @@ node.default['akkounts']['smtp']['domain']          = 'kosmos.org'
 node.default['akkounts']['smtp']['auth_method']     = 'plain'
 node.default['akkounts']['smtp']['enable_starttls'] = 'auto'

-node.default['akkounts']['btcpay']['public_url'] = nil
 node.default['akkounts']['btcpay']['store_id'] = nil

 node.default['akkounts']['ejabberd']['admin_url'] = nil
@@ -21,9 +20,6 @@ node.default['akkounts']['lndhub']['public_url'] = nil
 node.default['akkounts']['lndhub']['public_key'] = nil
 node.default['akkounts']['lndhub']['postgres_db'] = 'lndhub'

-node.default['akkounts']['nostr']['public_key'] = nil
-node.default['akkounts']['nostr']['relay_url'] = nil
-
 node.default['akkounts']['s3_enabled'] = true
 node.default['akkounts']['s3_endpoint'] = "https://s3.kosmos.org"
 node.default['akkounts']['s3_region'] = "garage"
--- a/site-cookbooks/kosmos-akkounts/recipes/default.rb
+++ b/site-cookbooks/kosmos-akkounts/recipes/default.rb
@@ -75,7 +75,6 @@ end

 if btcpay_host
  env[:btcpay_api_url] = "http://#{btcpay_host}:23001/api/v1"
-  env[:btcpay_public_url] = node['akkounts']['btcpay']['public_url']
  env[:btcpay_store_id] = node['akkounts']['btcpay']['store_id']
  env[:btcpay_auth_token] = credentials["btcpay_auth_token"]
 end
@@ -149,7 +148,6 @@ end
 #

 env[:mastodon_public_url] = "https://#{node['kosmos-mastodon']['domain']}"
-env[:mastodon_address_domain] = node['kosmos-mastodon']['user_address_domain']

 #
 # MediaWiki
@@ -157,14 +155,6 @@ env[:mastodon_address_domain] = node['kosmos-mastodon']['user_address_domain']

 env[:mediawiki_public_url] = node['mediawiki']['url']

-#
-# Nostr
-#
-
-env[:nostr_private_key] = credentials['nostr_private_key']
-env[:nostr_public_key] = node['akkounts']['nostr']['public_key']
-env[:nostr_relay_url] = node['akkounts']['nostr']['relay_url']
-
 #
 # remoteStorage / Liquor Cabinet
 #
--- a/site-cookbooks/kosmos-base/recipes/letsencrypt.rb
+++ b/site-cookbooks/kosmos-base/recipes/letsencrypt.rb
@@ -2,6 +2,27 @@
 # Cookbook Name:: kosmos-base
 # Recipe:: letsencrypt
 #
+# The MIT License (MIT)
+#
+# Copyright:: 2019, Kosmos Developers
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.

 unless platform?('ubuntu')
  raise "This recipe only supports Ubuntu installs"
--- a/site-cookbooks/kosmos-base/resources/tls_cert_for.rb
+++ b/site-cookbooks/kosmos-base/resources/tls_cert_for.rb
@@ -3,8 +3,6 @@ provides :tls_cert_for

 property :domain, [String, Array], name_property: true
 property :auth, [String, NilClass], default: nil
-property :deploy_hook, [String, NilClass], default: nil
-property :acme_domain, [String, NilClass], default: nil

 default_action :create

@@ -19,35 +17,13 @@ action :create do

  case new_resource.auth
  when "gandi_dns"
-    gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
+    gandi_api_data_bag_item = data_bag_item('credentials', 'gandi_api_5apps')

    hook_path = "/root/gandi_dns_certbot_hook.sh"
-    hook_auth_command = "#{hook_path} auth"
-    hook_cleanup_command = "#{hook_path} cleanup"
-
-    if new_resource.acme_domain
-      hook_auth_command += " #{new_resource.acme_domain}"
-      hook_cleanup_command += " #{new_resource.acme_domain}"
-    end
-
    template hook_path do
      cookbook "kosmos-base"
-      variables access_token: gandi_api_credentials["access_token"]
-      mode 0700
-      sensitive true
-    end
-
-    if new_resource.deploy_hook
-      deploy_hook_path = "/etc/letsencrypt/renewal-hooks/#{domains.first}"
-
-      file deploy_hook_path do
-        content new_resource.deploy_hook
-        mode 0755
-        owner "root"
-        group "root"
-      end
-    elsif node.run_list.roles.include?("openresty_proxy")
-      deploy_hook_path = "/etc/letsencrypt/renewal-hooks/post/openresty"
+      variables gandi_api_key: gandi_api_data_bag_item["key"]
+      mode 0770
    end

    # Generate a Let's Encrypt cert (only if no cert has been generated before).
@@ -58,10 +34,10 @@ action :create do
        --preferred-challenges dns \
        --manual-public-ip-logging-ok \
        --agree-tos \
-        --manual-auth-hook '#{hook_auth_command}' \
-        --manual-cleanup-hook '#{hook_cleanup_command}' \
+        --manual-auth-hook '#{hook_path} auth' \
+        --manual-cleanup-hook '#{hook_path} cleanup' \
        --email ops@kosmos.org \
-        #{"--deploy-hook #{deploy_hook_path}" if defined?(deploy_hook_path)} \
+        #{node.run_list.roles.include?("openresty_proxy") ? '--deploy-hook /etc/letsencrypt/renewal-hooks/post/openresty' : nil } \
        #{domains.map {|d| "-d #{d}" }.join(" ")}
      CMD
      not_if do
--- a/site-cookbooks/kosmos-base/templates/default/gandi_dns_certbot_hook.sh.erb
+++ b/site-cookbooks/kosmos-base/templates/default/gandi_dns_certbot_hook.sh.erb
@@ -1,16 +1,21 @@
 #!/usr/bin/env bash
+#
+
 set -euf -o pipefail

 # ************** USAGE **************
 #
-# Example usage:
+# Example usage (with this hook file saved in /root/):
 #
+#   sudo su -
 #   certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos -d "5apps.com" -d muc.5apps.com -d "xmpp.5apps.com" \
 #     --manual-auth-hook "/root/letsencrypt_hook.sh auth" --manual-cleanup-hook "/root/letsencrypt_hook.sh cleanup"
 #
+# This hook requires configuration, continue reading.
+#
 # ************** CONFIGURATION **************
 #
-# ACCESS_TOKEN: Your Gandi Live API key
+# GANDI_API_KEY: Your Gandi Live API key
 #
 # PROVIDER_UPDATE_DELAY:
 #   How many seconds to wait after updating your DNS records. This may be required,
@@ -20,16 +25,10 @@ set -euf -o pipefail
 #
 #   Defaults to 30 seconds.
 #
-# VALIDATION_DOMAIN:
-#   Domain to create ACME DNS entries on. Use this when redirecting ACME subdomains
-#   from the original domain to a proxy validation domain that we control.
-#
-ACCESS_TOKEN="<%= @access_token %>"
+GANDI_API_KEY="<%= @gandi_api_key %>"
 PROVIDER_UPDATE_DELAY=10
-VALIDATION_DOMAIN="${2:-}"

 regex='.*\.(.*\..*)'
-
 if [[ $CERTBOT_DOMAIN =~ $regex ]]
 then
  DOMAIN="${BASH_REMATCH[1]}"
@@ -37,41 +36,25 @@ else
  DOMAIN="${CERTBOT_DOMAIN}"
 fi

-if [[ -n "$VALIDATION_DOMAIN" ]]
-then
-  if [[ $VALIDATION_DOMAIN =~ $regex ]]
-  then
-    ACME_BASE_DOMAIN="${BASH_REMATCH[1]}"
-  else
-    echo "Validation domain has to be a subdomain, but it is not: \"${VALIDATION_DOMAIN}\""
-    exit 1
-  fi
-  ACME_DOMAIN="${CERTBOT_DOMAIN}.${VALIDATION_DOMAIN}"
-else
-  ACME_BASE_DOMAIN="${DOMAIN}"
-  ACME_DOMAIN="_acme-challenge.${CERTBOT_DOMAIN}"
-fi
-
 # To be invoked via Certbot's --manual-auth-hook
 function auth {
-  curl -s -D- \
-       -H "Content-Type: application/json" \
-       -H "Authorization: Bearer ${ACCESS_TOKEN}" \
-       -d "{\"rrset_name\": \"${ACME_DOMAIN}.\",
-            \"rrset_type\": \"TXT\",
-            \"rrset_ttl\": 300,
-            \"rrset_values\": [\"${CERTBOT_VALIDATION}\"]}" \
-       "https://api.gandi.net/v5/livedns/domains/${ACME_BASE_DOMAIN}/records"
+    curl -s -D- -H "Content-Type: application/json" \
+        -H "X-Api-Key: ${GANDI_API_KEY}" \
+        -d "{\"rrset_name\": \"_acme-challenge.${CERTBOT_DOMAIN}.\",
+             \"rrset_type\": \"TXT\",
+             \"rrset_ttl\": 3600,
+             \"rrset_values\": [\"${CERTBOT_VALIDATION}\"]}" \
+        "https://dns.api.gandi.net/api/v5/domains/${DOMAIN}/records"

-  sleep ${PROVIDER_UPDATE_DELAY}
+
+    sleep ${PROVIDER_UPDATE_DELAY}
 }

 # To be invoked via Certbot's --manual-cleanup-hook
 function cleanup {
-  curl -s -X DELETE \
-       -H "Content-Type: application/json" \
-       -H "Authorization: Bearer ${ACCESS_TOKEN}" \
-       "https://api.gandi.net/v5/livedns/domains/${ACME_BASE_DOMAIN}/records/${ACME_DOMAIN}./TXT"
+    curl -s -X DELETE -H "Content-Type: application/json" \
+        -H "X-Api-Key: ${GANDI_API_KEY}" \
+        https://dns.api.gandi.net/api/v5/domains/${DOMAIN}/records/_acme-challenge.${CERTBOT_DOMAIN}./TXT
 }

 HANDLER=$1; shift;
--- a/site-cookbooks/kosmos-ejabberd/recipes/default.rb
+++ b/site-cookbooks/kosmos-ejabberd/recipes/default.rb
--- a/site-cookbooks/kosmos-ejabberd/recipes/letsencrypt.rb
+++ b/site-cookbooks/kosmos-ejabberd/recipes/letsencrypt.rb
@@ -33,7 +33,7 @@ file "/etc/letsencrypt/renewal-hooks/post/ejabberd" do
  group "root"
 end

-gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
+gandi_api_credentials = data_bag_item('credentials', 'gandi_api_5apps')

 template "/root/gandi_dns_certbot_hook.sh" do
  variables access_token: gandi_api_credentials["access_token"]
--- a/site-cookbooks/kosmos-ejabberd/templates/ejabberd.yml.erb
+++ b/site-cookbooks/kosmos-ejabberd/templates/ejabberd.yml.erb
@@ -216,7 +216,7 @@ modules:
    access_createnode: pubsub_createnode
    ignore_pep_from_offline: false
    last_item_cache: false
-    max_items_node: 1000
+    max_items_node: 10
    plugins:
      - "flat"
      - "pep" # pep requires mod_caps
@@ -258,6 +258,8 @@ modules:
        type: turns
        transport: tcp
        restricted: true
+  mod_vcard:
+    search: false
  mod_vcard_xupdate: {}
  mod_avatar: {}
  mod_version: {}
--- a/site-cookbooks/kosmos-ejabberd/templates/gandi_dns_certbot_hook.sh.erb
+++ b/site-cookbooks/kosmos-ejabberd/templates/gandi_dns_certbot_hook.sh.erb
@@ -3,14 +3,17 @@ set -euf -o pipefail

 # ************** USAGE **************
 #
-# Example usage:
+# Example usage (with this hook file saved in /root/):
 #
+#   sudo su -
 #   certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos -d "5apps.com" -d muc.5apps.com -d "xmpp.5apps.com" \
 #     --manual-auth-hook "/root/letsencrypt_hook.sh auth" --manual-cleanup-hook "/root/letsencrypt_hook.sh cleanup"
 #
+# This hook requires configuration, continue reading.
+#
 # ************** CONFIGURATION **************
 #
-# ACCESS_TOKEN: Your Gandi Live API key
+# GANDI_API_KEY: Your Gandi Live API key
 #
 # PROVIDER_UPDATE_DELAY:
 #   How many seconds to wait after updating your DNS records. This may be required,
@@ -20,10 +23,6 @@ set -euf -o pipefail
 #
 #   Defaults to 30 seconds.
 #
-# VALIDATION_DOMAIN:
-#   Domain to create ACME DNS entries on. Use this when redirecting ACME subdomains
-#   from the original domain to a proxy validation domain that we control.
-#
 ACCESS_TOKEN="<%= @access_token %>"
 PROVIDER_UPDATE_DELAY=10
 VALIDATION_DOMAIN="${2:-}"
--- a/site-cookbooks/kosmos-ejabberd/templates/vhost.yml.erb
+++ b/site-cookbooks/kosmos-ejabberd/templates/vhost.yml.erb
@@ -16,7 +16,7 @@ host_config:
    ldap_password: "<%= @host[:ldap_password] %>"
    ldap_encrypt: <%= @ldap_encryption_type %>
    ldap_base: "ou=<%= @host[:name] %>,<%= @ldap_base %>"
-    ldap_filter: "<%= @ldap_filter %>"
+    ldap_filter: "(objectClass=person)"
  <% end -%>

 append_host_config:
--- a/site-cookbooks/kosmos-ipfs/attributes/default.rb
+++ b/site-cookbooks/kosmos-ipfs/attributes/default.rb
@@ -62,4 +62,4 @@ node.default['kosmos-ipfs']['ipfs']['config'] = {
 node.default['kosmos-ipfs']['nginx']['domain'] = "ipfs.kosmos.org"
 node.default['kosmos-ipfs']['nginx']['external_api_port'] = 5444

-node.default['kosmos-ipfs']['kredits-pinner']['revision'] = "v2.3.0"
+node.default['kosmos-ipfs']['kredits-pinner']['revision'] = "v2.2.0"
--- a/site-cookbooks/kosmos-mastodon/recipes/default.rb
+++ b/site-cookbooks/kosmos-mastodon/recipes/default.rb
@@ -44,7 +44,7 @@ end

 elasticsearch_service 'elasticsearch'

-postgresql_credentials = data_bag_item('credentials', 'postgresql')
+postgresql_data_bag_item = data_bag_item('credentials', 'postgresql')

 mastodon_path = node["kosmos-mastodon"]["directory"]
 mastodon_user = "mastodon"
@@ -168,22 +168,7 @@ execute "restart mastodon services" do
  notifies :restart, "service[mastodon-streaming]", :delayed
 end

-credentials = data_bag_item('credentials', 'mastodon')
-
-ldap_config = {
-  host: "ldap.kosmos.local",
-  port: 389,
-  method: "plain",
-  base: "ou=kosmos.org,cn=users,dc=kosmos,dc=org",
-  bind_dn: credentials["ldap_bind_dn"],
-  password: credentials["ldap_password"],
-  uid: "cn",
-  mail: "mail",
-  search_filter: "(&(|(cn=%{email})(mail=%{email}))(serviceEnabled=mastodon))",
-  uid_conversion_enabled: "true",
-  uid_conversion_search: "-",
-  uid_conversion_replace: "_"
-}
+mastodon_credentials = data_bag_item('credentials', 'mastodon')

 template "#{mastodon_path}/.env.#{rails_env}" do
  source "env.erb"
@@ -193,22 +178,21 @@ template "#{mastodon_path}/.env.#{rails_env}" do
  variables redis_url: node["kosmos-mastodon"]["redis_url"],
            domain: node["kosmos-mastodon"]["domain"],
            alternate_domains: node["kosmos-mastodon"]["alternate_domains"],
-            paperclip_secret: credentials['paperclip_secret'],
-            secret_key_base: credentials['secret_key_base'],
-            otp_secret: credentials['otp_secret'],
-            ldap: ldap_config,
-            smtp_login: credentials['smtp_user_name'],
-            smtp_password: credentials['smtp_password'],
+            paperclip_secret: mastodon_credentials['paperclip_secret'],
+            secret_key_base: mastodon_credentials['secret_key_base'],
+            otp_secret: mastodon_credentials['otp_secret'],
+            smtp_login: mastodon_credentials['smtp_user_name'],
+            smtp_password: mastodon_credentials['smtp_password'],
            smtp_from_address: "mail@#{node['kosmos-mastodon']['domain']}",
            s3_endpoint: node["kosmos-mastodon"]["s3_endpoint"],
            s3_region: node["kosmos-mastodon"]["s3_region"],
            s3_bucket: node["kosmos-mastodon"]["s3_bucket"],
            s3_alias_host: node["kosmos-mastodon"]["s3_alias_host"],
-            aws_access_key_id: credentials['s3_key_id'],
-            aws_secret_access_key: credentials['s3_secret_key'],
-            vapid_private_key: credentials['vapid_private_key'],
-            vapid_public_key: credentials['vapid_public_key'],
-            db_pass: postgresql_credentials['mastodon_user_password'],
+            aws_access_key_id: mastodon_credentials['s3_key_id'],
+            aws_secret_access_key: mastodon_credentials['s3_secret_key'],
+            vapid_private_key: mastodon_credentials['vapid_private_key'],
+            vapid_public_key: mastodon_credentials['vapid_public_key'],
+            db_pass: postgresql_data_bag_item['mastodon_user_password'],
            db_host: "pg.kosmos.local",
            default_locale: node["kosmos-mastodon"]["default_locale"],
            allowed_private_addresses: node["kosmos-mastodon"]["allowed_private_addresses"],
--- a/site-cookbooks/kosmos-mastodon/recipes/nginx.rb
+++ b/site-cookbooks/kosmos-mastodon/recipes/nginx.rb
@@ -28,15 +28,12 @@ template "#{node['openresty']['dir']}/snippets/mastodon.conf" do
  owner 'www-data'
  mode 0640
  variables web_root_dir: web_root_dir,
-            server_name:  server_name,
-            s3_private_url: "#{node["kosmos-mastodon"]["s3_endpoint"]}/#{node["kosmos-mastodon"]["s3_bucket"]}/",
-            s3_public_url: "https://#{node["kosmos-mastodon"]["s3_alias_host"]}/"
+            server_name:  server_name
  notifies :reload, 'service[openresty]', :delayed
 end

 tls_cert_for server_name do
  auth "gandi_dns"
-  acme_domain "letsencrypt.kosmos.org"
  action :create
 end

--- a/site-cookbooks/kosmos-mastodon/templates/default/env.erb
+++ b/site-cookbooks/kosmos-mastodon/templates/default/env.erb
@@ -29,23 +29,6 @@ SMTP_LOGIN=<%= @smtp_login %>
 SMTP_PASSWORD=<%= @smtp_password %>
 SMTP_FROM_ADDRESS=<%= @smtp_from_address %>

-<% if @ldap %>
-# LDAP configuration
-LDAP_ENABLED=true
-LDAP_HOST=<%= @ldap[:host] %>
-LDAP_PORT=<%= @ldap[:port] %>
-LDAP_METHOD='<%= @ldap[:method] %>'
-LDAP_BASE='<%= @ldap[:base] %>'
-LDAP_BIND_DN='<%= @ldap[:bind_dn] %>'
-LDAP_PASSWORD='<%= @ldap[:password] %>'
-LDAP_UID=<%= @ldap[:uid] %>
-LDAP_MAIL=<%= @ldap[:mail] %>
-LDAP_SEARCH_FILTER='<%= @ldap[:search_filter] %>'
-LDAP_UID_CONVERSION_ENABLED=<%= @ldap[:uid_conversion_enabled] %>
-LDAP_UID_CONVERSION_SEARCH=<%= @ldap[:uid_conversion_search] %>
-LDAP_UID_CONVERSION_REPLACE=<%= @ldap[:uid_conversion_replace] %>
-<% end %>
-
 # Optional asset host for multi-server setups
 # CDN_HOST=assets.example.com

--- a/site-cookbooks/kosmos-mastodon/templates/default/nginx_conf_mastodon.erb
+++ b/site-cookbooks/kosmos-mastodon/templates/default/nginx_conf_mastodon.erb
@@ -32,12 +32,6 @@ server {
 <% if @onion_address %>
  add_header Onion-Location https://mastodon.<%= @onion_address %>$request_uri;
 <% end %>
-
-  location ~ ^/.well-known/(lnurlp|keysend) {
-    add_header 'Access-Control-Allow-Origin' '*';
-    proxy_ssl_server_name on;
-    proxy_pass https://accounts.kosmos.org;
-  }
 }

 <% if @onion_address %>
--- a/site-cookbooks/kosmos-mastodon/templates/default/nginx_conf_shared.erb
+++ b/site-cookbooks/kosmos-mastodon/templates/default/nginx_conf_shared.erb
@@ -108,13 +108,11 @@ location @proxy {

  proxy_pass http://mastodon_app;
  proxy_buffering on;
+  proxy_redirect off;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection $connection_upgrade;

-  # https://github.com/mastodon/mastodon/issues/24380
-  proxy_redirect <%= @s3_private_url %> <%= @s3_public_url %>;
-
  tcp_nodelay on;
 }

--- a/site-cookbooks/kosmos_email/recipes/default.rb
+++ b/site-cookbooks/kosmos_email/recipes/default.rb
@@ -7,7 +7,6 @@ domain   = node["email"]["domain"]
 hostname = node["email"]["hostname"]
 root_dir = node["email"]["root_directory"]
 ip_addr  = node["knife_zero"]["host"]
-extra_hostnames = ["smtp.#{domain}", "imap.#{domain}"]

 node.override["set_fqdn"] = hostname
 include_recipe "hostname"
@@ -24,9 +23,7 @@ directory root_dir do
 end

 tls_cert_for hostname do
-  domain ([hostname]+extra_hostnames)
  auth "gandi_dns"
-  deploy_hook "systemctl reload postfix.service && systemctl reload dovecot.service"
  action :create
 end

--- a/site-cookbooks/kosmos_garage/recipes/nginx_web.rb
+++ b/site-cookbooks/kosmos_garage/recipes/nginx_web.rb
@@ -3,8 +3,6 @@
 # Recipe:: nginx_web
 #

-gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
-
 file "#{node['openresty']['dir']}/conf.d/garage.conf" do
  content <<-EOF
 upstream garage_web {
@@ -42,12 +40,8 @@ end
 #

 node['garage']['s3_web_domains'].each do |domain_name|
-  second_level_domain = domain_name.match(/(?:.*\.)?([^.]+\.[^.]+)$/) { $1 }
-  proxy_validation = !gandi_api_credentials["domains"].include?(second_level_domain)
-
  tls_cert_for domain_name do
    auth "gandi_dns"
-    acme_domain "letsencrypt.kosmos.org" if proxy_validation
    action :create
  end

--- a/site-cookbooks/kosmos_gitea/attributes/default.rb
+++ b/site-cookbooks/kosmos_gitea/attributes/default.rb
@@ -1,5 +1,5 @@
-node.default["gitea"]["version"] = "1.22.1"
-node.default["gitea"]["checksum"] = "b8043324545eec269fc8f18c22b49fc365ed367e0dd41e081b79832de2570f9c"
+node.default["gitea"]["version"] = "1.21.7"
+node.default["gitea"]["checksum"] = "fa88e6404d3d34136bdd50c990a8c390d5e05f4cb2e31641559d14234e022bd6"
 node.default["gitea"]["working_directory"] = "/var/lib/gitea"
 node.default["gitea"]["port"] = 3000
 node.default["gitea"]["postgresql_host"] = "localhost:5432"
--- a/site-cookbooks/kosmos_gitea/templates/default/app.ini.erb
+++ b/site-cookbooks/kosmos_gitea/templates/default/app.ini.erb
@@ -112,7 +112,3 @@ MINIO_USE_SSL=<%= c["use_ssl"] %>
 [actions]
 ENABLED = true
 <% end %>
-
-[other]
-SHOW_FOOTER_VERSION = false
-SHOW_FOOTER_TEMPLATE_LOAD_TIME = false
--- a/site-cookbooks/kosmos_gitea/templates/default/nginx_conf_web.erb
+++ b/site-cookbooks/kosmos_gitea/templates/default/nginx_conf_web.erb
@@ -21,13 +21,8 @@ server {
  location ~ ^/(avatars|repo-avatars)/.*$ {
    proxy_buffers 1024 8k;
    proxy_pass http://_gitea_web;
+    proxy_http_version 1.1;
    expires 30d;
-    proxy_set_header Connection $http_connection;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
  }

  # Docker registry
@@ -35,22 +30,12 @@ server {
    client_max_body_size 0;
    proxy_buffers 1024 8k;
    proxy_pass http://_gitea_web;
-    proxy_set_header Connection $http_connection;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_http_version 1.1;
  }

  location / {
    proxy_buffers 1024 8k;
    proxy_pass http://_gitea_web;
-    proxy_set_header Connection $http_connection;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_http_version 1.1;
  }
 }
--- a/site-cookbooks/kosmos_kvm/attributes/default.rb
+++ b/site-cookbooks/kosmos_kvm/attributes/default.rb
@@ -1,10 +1,9 @@
-release = "20240514"
-img_filename = "ubuntu-22.04-server-cloudimg-amd64-disk-kvm"
+ubuntu_server_cloud_image_release = "20230506"

 node.default["kosmos_kvm"]["host"]["qemu_base_image"] = {
-  "url" => "https://cloud-images.ubuntu.com/releases/jammy/release-#{release}/#{img_filename}.img",
-  "checksum" => "2e7698b3ebd7caead06b08bd3ece241e6ce294a6db01f92ea12bcb56d6972c3f",
-  "path" => "/var/lib/libvirt/images/base/#{img_filename}-#{release}.qcow2"
+  "url" => "https://cloud-images.ubuntu.com/releases/focal/release-#{ubuntu_server_cloud_image_release}/ubuntu-20.04-server-cloudimg-amd64-disk-kvm.img",
+  "checksum" => "27d2b91fd2b715729d739e2a3155dce70d1aaae4f05c177f338b9d4b60be638c",
+  "path" => "/var/lib/libvirt/images/base/ubuntu-20.04-server-cloudimg-amd64-disk-kvm-#{ubuntu_server_cloud_image_release}.qcow2"
 }

 # A systemd.timer OnCalendar config value
--- a/site-cookbooks/kosmos_kvm/files/backup_vm.sh
+++ b/site-cookbooks/kosmos_kvm/files/backup_vm.sh
@@ -22,5 +22,8 @@ borg create -v $REPOSITORY::$1_$(date +%F_%H-%M) \
        /var/lib/libvirt/images/$1.qcow2  \
        /root/backups/vm_meta/$1.xml

-echo "Pivoting base image back to original, and removing the snapshot image"
-virsh blockcommit $1 vda --pivot --base=/var/lib/libvirt/images/$1.qcow2 && rm /var/lib/libvirt/images/$1.hotswap.qcow2
+echo "Pivoting base image back to original"
+virsh blockcommit $1 vda --pivot --base=/var/lib/libvirt/images/$1.qcow2
+
+echo "Removing snapshot image"
+rm /var/lib/libvirt/images/$1.hotswap.qcow2
--- a/site-cookbooks/kosmos_strfry/LICENSE
+++ b/site-cookbooks/kosmos_strfry/LICENSE
@@ -1,20 +0,0 @@
-Copyright (c) 2024 Kosmos Developers
-
-Permission is hereby granted, free of charge, to any person obtaining
-a copy of this software and associated documentation files (the
-"Software"), to deal in the Software without restriction, including
-without limitation the rights to use, copy, modify, merge, publish,
-distribute, sublicense, and/or sell copies of the Software, and to
-permit persons to whom the Software is furnished to do so, subject to
-the following conditions:
-
-The above copyright notice and this permission notice shall be
-included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
-EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
-NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
-LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
-OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
-WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
--- a/site-cookbooks/kosmos_strfry/README.md
+++ b/site-cookbooks/kosmos_strfry/README.md
@@ -1,4 +0,0 @@
-kosmos_strfry
-=============
-
-Installs/configures a strfry relay and its reverse proxy config
--- a/site-cookbooks/kosmos_strfry/attributes/default.rb
+++ b/site-cookbooks/kosmos_strfry/attributes/default.rb
@@ -1,2 +0,0 @@
-node.default["strfry"]["ldap_search_dn"] = "ou=kosmos.org,cn=users,dc=kosmos,dc=org"
-node.default["strfry"]["extras_dir"] = "/opt/strfry"
--- a/site-cookbooks/kosmos_strfry/metadata.rb
+++ b/site-cookbooks/kosmos_strfry/metadata.rb
@@ -1,10 +0,0 @@
-name             'kosmos_strfry'
-maintainer       'Kosmos'
-maintainer_email 'mail@kosmos.org'
-license          'MIT'
-description      'strfry wrapper cookbook'
-long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
-version          '0.1.0'
-
-depends 'kosmos_openresty'
-depends 'deno'
--- a/site-cookbooks/kosmos_strfry/recipes/firewall.rb
+++ b/site-cookbooks/kosmos_strfry/recipes/firewall.rb
@@ -1,13 +0,0 @@
-#
-# Cookbook Name:: kosmos_strfry
-# Recipe:: firewall
-#
-
-include_recipe "kosmos-base::firewall"
-
-firewall_rule "strfry" do
-  port     node["strfry"]["port"]
-  source   "10.1.1.0/24"
-  protocol :tcp
-  command  :allow
-end
--- a/site-cookbooks/kosmos_strfry/recipes/nginx.rb
+++ b/site-cookbooks/kosmos_strfry/recipes/nginx.rb
@@ -1,29 +0,0 @@
-#
-# Cookbook Name:: kosmos_strfry
-# Recipe:: nginx
-#
-
-domain = node["strfry"]["domain"]
-
-upstream_hosts = []
-search(:node, 'role:strfry').each do |node|
-  upstream_hosts << node['knife_zero']['host']
-end
-if upstream_hosts.empty?
-  Chef::Log.warn("No node found with 'strfry' role. Not configuring nginx site.")
-  return
-end
-
-tls_cert_for domain do
-  auth "gandi_dns"
-  action :create
-end
-
-openresty_site domain do
-  template "nginx_conf_strfry.erb"
-  variables domain: domain,
-            upstream_port: node['strfry']['port'],
-            upstream_hosts: upstream_hosts,
-            ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
-            ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
-end
--- a/site-cookbooks/kosmos_strfry/recipes/policies.rb
+++ b/site-cookbooks/kosmos_strfry/recipes/policies.rb
@@ -1,83 +0,0 @@
-#
-# Cookbook Name:: kosmos_strfry
-# Recipe:: policies
-#
-
-include_recipe "deno"
-
-#
-# config
-#
-
-ldap_credentials = Chef::EncryptedDataBagItem.load('credentials', 'dirsrv')
-
-extras_dir = node["strfry"]["extras_dir"]
-
-directory extras_dir do
-  owner node["strfry"]["user"]
-  group node["strfry"]["group"]
-  mode "0755"
-end
-
-env = {
-  ldap_url: 'ldap://ldap.kosmos.local:389', # requires "ldap_client" role
-  ldap_bind_dn: ldap_credentials["service_dn"],
-  ldap_password: ldap_credentials["service_password"],
-  ldap_search_dn: node["strfry"]["ldap_search_dn"],
-  whitelist_pubkeys: node["strfry"]["whitelist_pubkeys"].join(",")
-}
-
-template "#{extras_dir}/.env" do
-  source 'env.erb'
-  owner node["strfry"]["user"]
-  group node["strfry"]["group"]
-  mode 0600
-  sensitive true
-  variables config: env
-  notifies :restart, "service[strfry]", :delayed
-end
-
-#
-# strfry deno scripts
-#
-
-base_url = "https://gitea.kosmos.org/kosmos/akkounts/raw/branch/live/extras/strfry"
-
-remote_file "#{extras_dir}/deno.json" do
-  source "#{base_url}/deno.json"
-  owner node["strfry"]["user"]
-  group node["strfry"]["group"]
-  mode "0644"
-  notifies :restart, "service[strfry]", :delayed
-end
-
-remote_file "#{extras_dir}/deno.lock" do
-  source "#{base_url}/deno.lock"
-  owner node["strfry"]["user"]
-  group node["strfry"]["group"]
-  mode "0644"
-  notifies :restart, "service[strfry]", :delayed
-end
-
-remote_file "#{extras_dir}/strfry-policy.ts" do
-  source "#{base_url}/strfry-policy.ts"
-  owner node["strfry"]["user"]
-  group node["strfry"]["group"]
-  mode "0755"
-  notifies :restart, "service[strfry]", :delayed
-end
-
-remote_file "#{extras_dir}/ldap-policy.ts" do
-  source "#{base_url}/ldap-policy.ts"
-  owner node["strfry"]["user"]
-  group node["strfry"]["group"]
-  mode "0644"
-  notifies :restart, "service[strfry]", :delayed
-end
-
-remote_file "#{extras_dir}/strfry-sync.ts" do
-  source "#{base_url}/strfry-sync.ts"
-  owner node["strfry"]["user"]
-  group node["strfry"]["group"]
-  mode "0644"
-end
--- a/site-cookbooks/kosmos_strfry/templates/env.erb
+++ b/site-cookbooks/kosmos_strfry/templates/env.erb
@@ -1,11 +0,0 @@
-<% @config.each do |key, value| %>
-<% if value.is_a?(Hash) %>
-<% value.each do |k, v| %>
-<%= "#{key.upcase}_#{k.upcase}" %>=<%= v.to_s %>
-<% end %>
-<% else %>
-<% if value %>
-<%= key.upcase %>=<%= value.to_s %>
-<% end %>
-<% end %>
-<% end %>
--- a/site-cookbooks/kosmos_strfry/templates/nginx_conf_strfry.erb
+++ b/site-cookbooks/kosmos_strfry/templates/nginx_conf_strfry.erb
@@ -1,25 +0,0 @@
-upstream _strfry {
-<% @upstream_hosts.each do |host| %>
-  server <%= host %>:<%= @upstream_port || "7777" %>;
-<% end %>
-}
-
-server {
-  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
-  server_name <%= @domain %>;
-
-  access_log "/var/log/nginx/<%= @domain %>.access.log";
-  error_log "/var/log/nginx/<%= @domain %>.error.log";
-
-  ssl_certificate     <%= @ssl_cert %>;
-  ssl_certificate_key <%= @ssl_key %>;
-
-  location / {
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_pass http://_strfry;
-    proxy_http_version 1.1;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Connection "upgrade";
-  }
-}
--- a/site-cookbooks/kosmos_website/attributes/default.rb
+++ b/site-cookbooks/kosmos_website/attributes/default.rb
@@ -1,4 +1,3 @@
-node.default["kosmos_website"]["domain"]       = "kosmos.org"
-node.default["kosmos_website"]["repo"]         = "https://gitea.kosmos.org/kosmos/website.git"
-node.default["kosmos_website"]["revision"]     = "chore/content"
-node.default["kosmos_website"]["accounts_url"] = "https://accounts.kosmos.org"
+node.default["kosmos_website"]["domain"]   = "kosmos.org"
+node.default["kosmos_website"]["repo"]     = "https://gitea.kosmos.org/kosmos/website.git"
+node.default["kosmos_website"]["revision"] = "chore/content"
--- a/site-cookbooks/kosmos_website/recipes/default.rb
+++ b/site-cookbooks/kosmos_website/recipes/default.rb
@@ -23,7 +23,6 @@ end
 openresty_site domain do
  template "nginx_conf_website.erb"
  variables domain: domain,
-            accounts_url: node.default["kosmos_website"]["accounts_url"],
            ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
            ssl_key:  "/etc/letsencrypt/live/#{domain}/privkey.pem"
 end
--- a/site-cookbooks/kosmos_website/recipes/redirects.rb
+++ b/site-cookbooks/kosmos_website/recipes/redirects.rb
@@ -1,35 +0,0 @@
-#
-# Cookbook:: kosmos_website
-# Recipe:: redirects
-#
-
-redirects = [
-  {
-    domain: "kosmos.chat",
-    target: "https://kosmos.org",
-    http_status: 307
-  },
-  {
-    domain: "kosmos.cash",
-    acme_domain: "letsencrypt.kosmos.org",
-    target: "https://kosmos.org",
-    http_status: 307
-  }
-]
-
-redirects.each do |redirect|
-  tls_cert_for redirect[:domain] do
-    auth "gandi_dns"
-    acme_domain redirect[:acme_domain] unless redirect[:acme_domain].nil?
-    action :create
-  end
-
-  openresty_site redirect[:domain] do
-    template "nginx_conf_redirect.erb"
-    variables domain: redirect[:domain],
-              target: redirect[:target],
-              http_status: redirect[:http_status],
-              ssl_cert: "/etc/letsencrypt/live/#{redirect[:domain]}/fullchain.pem",
-              ssl_key:  "/etc/letsencrypt/live/#{redirect[:domain]}/privkey.pem"
-  end
-end
--- a/site-cookbooks/kosmos_website/templates/nginx_conf_redirect.erb
+++ b/site-cookbooks/kosmos_website/templates/nginx_conf_redirect.erb
@@ -1,20 +0,0 @@
-# Generated by Chef
-
-server {
-  server_name <%= @domain %>;
-  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
-  listen [::]:443 ssl http2;
-
-  access_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.access.log;
-  error_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.error.log warn;
-
-  gzip_static on;
-  gzip_comp_level 5;
-
-  ssl_certificate     <%= @ssl_cert %>;
-  ssl_certificate_key <%= @ssl_key %>;
-
-  location / {
-    return <%= @http_status || 301 %> <%= @target %>;
-  }
-}
--- a/site-cookbooks/kosmos_website/templates/nginx_conf_simple.erb
+++ b/site-cookbooks/kosmos_website/templates/nginx_conf_simple.erb
@@ -1,18 +0,0 @@
-# Generated by Chef
-
-server {
-  server_name <%= @domain %>;
-  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
-  listen [::]:443 ssl http2;
-
-  root /var/www/<%= @domain %>/public;
-
-  access_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.access.log;
-  error_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.error.log warn;
-
-  gzip_static on;
-  gzip_comp_level 5;
-
-  ssl_certificate     <%= @ssl_cert %>;
-  ssl_certificate_key <%= @ssl_key %>;
-}
--- a/site-cookbooks/kosmos_website/templates/nginx_conf_website.erb
+++ b/site-cookbooks/kosmos_website/templates/nginx_conf_website.erb
@@ -1,18 +1,9 @@
 # Generated by Chef

-server {
-  server_name _;
-  listen 80 default_server;
-
-  location / {
-    return 301 https://<%= @domain %>;
-  }
-}
-
 server {
  server_name <%= @domain %>;
-  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2 default_server;
-  listen [::]:443 ssl http2 default_server;
+  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
+  listen [::]:443 ssl http2;

  root /var/www/<%= @domain %>/public;

@@ -27,10 +18,8 @@ server {
  ssl_certificate     <%= @ssl_cert %>;
  ssl_certificate_key <%= @ssl_key %>;

-<% if @accounts_url %>
  location ~ ^/.well-known/(webfinger|nostr|lnurlp|keysend) {
    proxy_ssl_server_name on;
    proxy_pass https://accounts.kosmos.org;
  }
-<% end %>
 }
--- a/site-cookbooks/remotestorage_discourse/recipes/nginx.rb
+++ b/site-cookbooks/remotestorage_discourse/recipes/nginx.rb
@@ -18,7 +18,6 @@ end

 tls_cert_for domain do
  auth "gandi_dns"
-  acme_domain "letsencrypt.kosmos.org"
  action :create
 end

--- a/site-cookbooks/sockethub/recipes/proxy.rb
+++ b/site-cookbooks/sockethub/recipes/proxy.rb
@@ -24,10 +24,10 @@ file "/etc/letsencrypt/renewal-hooks/post/nginx" do
  group "root"
 end

-gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
+gandi_api_data_bag_item = data_bag_item('credentials', 'gandi_api_5apps')

 template "/root/gandi_dns_certbot_hook.sh" do
-  variables gandi_api_key: gandi_api_credentials["key"]
+  variables gandi_api_key: gandi_api_data_bag_item["key"]
  mode 0770
 end

--- a/site-cookbooks/strfry
+++ b/site-cookbooks/strfry