Add privacy policy URL to strfry config

Reviewed-on: #660

clients/redis-4.json

@@ -0,0 +1,4 @@
+{
+  "name": "redis-4",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAn3Zdzfao+n3PdtlJlViJ\nnpVDcL8ofw2rb2/VK7ivpWMKaL7mOq8HIQ+R+ghvllX/vPmN6co3+aUxOvvQ6KGC\nmAcnc7StqOpYUK0g6QZFROESO0vz1hy078AL9D2dEwOj7XS8leWCQyGgA1Z89T9n\naatXqEF1zGuvnVLA340prYkJk5S1X6KHq1WIi9H23hYehvGZlpkJ87wv8sKIo4Y3\nzIVA5hio0t0q+JyStOGr+xRl3mM43b25XcIh2ibrzKp3YoRWSCvMfhAdMKm1WEEI\njM/3fQRtkI1OQSb0o/wUoAmpUEEOTIvbWU2SuFVY7HYRuPwEilvbrGZKgrvbp8R+\nZQIDAQAB\n-----END PUBLIC KEY-----\n"
+}

environments/production.json

@@ -81,7 +81,7 @@
           "garage-",
           "lq-",
           "rsk-",
-          "postgres-6"
+          "postgres-11"
         ]
       }
     },
@@ -127,7 +127,8 @@
             "description": "Members-only nostr relay for kosmos.org users",
             "pubkey": "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf",
             "contact": "ops@kosmos.org",
-            "icon": "https://assets.kosmos.org/img/app-icon-256px.png"
+            "icon": "https://assets.kosmos.org/img/app-icon-256px.png",
+            "privacy": "https://accounts.kosmos.org/privacy"
           },
           "write_policy": {
             "plugin": "/opt/strfry/strfry-policy.ts"

site-cookbooks/kosmos-akkounts/metadata.rb

@@ -8,7 +8,7 @@ version '0.3.0'
 chef_version '>= 18.0'
 
 depends 'kosmos_openresty'
-depends "kosmos-nodejs"
+depends "ark"
 depends "postgresql"
 depends "kosmos_postgresql"
 depends "backup"

site-cookbooks/kosmos-akkounts/recipes/default.rb

@@ -27,12 +27,24 @@ end
 
 package "libpq-dev"
 package "libvips"
+package "unzip"
 
-node.override["kosmos_nodejs"]["version"] = "22.23.1"
-include_recipe 'kosmos-nodejs'
-npm_package "bun"
+bun_version = "1.3.14"
+bun_checksum = "951ee2aee855f08595aeec6225226a298d3fea83a3dcd6465c09cbccdf7e848f"
 
-ruby_version = "3.3.8"
+ark "bun" do
+  url "https://github.com/oven-sh/bun/releases/download/bun-v#{bun_version}/bun-linux-x64.zip"
+  checksum bun_checksum
+  creates "bun"
+  path "/usr/local/bun/#{bun_version}/bin"
+  action :cherry_pick
+end
+
+link "/usr/local/bin/bun" do
+  to "/usr/local/bun/#{bun_version}/bin/bun"
+end
+
+ruby_version = "3.3.12"
 ruby_path = "/opt/ruby_build/builds/#{ruby_version}"
 bundle_path = "#{ruby_path}/bin/bundle"
 rails_env = node.chef_environment == "development" ? "development" : "production"

site-cookbooks/kosmos-bitcoin/attributes/default.rb

@@ -87,7 +87,7 @@ node.default['lndhub-go']['branding'] = {
 }
 
 node.default['nbxplorer']['repo'] = 'https://github.com/dgarage/NBXplorer'
-node.default['nbxplorer']['revision'] = 'v2.5.26'
+node.default['nbxplorer']['revision'] = 'v2.6.10'
 node.default['nbxplorer']['source_dir'] = '/opt/nbxplorer'
 node.default['nbxplorer']['config_path'] = "/home/#{node['bitcoin']['username']}/.nbxplorer/Main/settings.config"
 node.default['nbxplorer']['port'] = '24445'
@@ -95,7 +95,7 @@ node.default['nbxplorer']['postgres']['database'] = 'nbxplorer'
 node.default['nbxplorer']['postgres']['user'] = 'nbxplorer'
 
 node.default['btcpay']['repo'] = 'https://github.com/btcpayserver/btcpayserver'
-node.default['btcpay']['revision'] = 'v2.3.7'
+node.default['btcpay']['revision'] = 'v2.4.2'
 node.default['btcpay']['source_dir'] = '/opt/btcpay'
 node.default['btcpay']['config_path'] = "/home/#{node['bitcoin']['username']}/.btcpayserver/Main/settings.config"
 node.default['btcpay']['log_path'] = "/home/#{node['bitcoin']['username']}/.btcpayserver/debug.log"

site-cookbooks/kosmos-bitcoin/recipes/btcpay.rb

@@ -21,7 +21,7 @@ bash 'build_btcpay' do
     systemctl stop btcpayserver.service
     ./build.sh
   EOH
-  environment "DOTNET_CLI_TELEMETRY_OPTOUT" => 1
+  environment "DOTNET_CLI_TELEMETRY_OPTOUT" => "1"
   action :nothing
   notifies :restart, "service[btcpayserver]", :delayed
 end

site-cookbooks/kosmos-bitcoin/recipes/rtl.rb

@@ -3,7 +3,7 @@
 # Recipe:: rtl
 #
 
-node.override["kosmos_nodejs"]["version"] = "18.20.8"
+node.override["kosmos_nodejs"]["version"] = "22.23.1"
 include_recipe 'kosmos-nodejs'
 
 app_name      = "rtl"

site-cookbooks/kosmos_gitea/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 This file is used to list changes made in each version of the kosmos_gitea cookbook.
 
+# 0.2.2
+
+- Add `config.yaml` for the gitea actions runner, enabling the built-in cache
+  server (listening on the Docker bridge gateway `172.17.0.1`) and bumping
+  `runner.capacity` to 2 for concurrent job execution. Each runner gets a unique
+  cache port derived from `cache_base_port` (8088) + its index in the runners
+  data bag.
+- Set `container.network` to a user-defined Docker bridge network
+  (`gitea-actions`, subnet `172.20.0.0/16`) so job containers get DNS resolution
+  for service containers (e.g. `redis`) while keeping the cache server reachable
+  at the network gateway `172.20.0.1`.
+- Open the cache port in the firewall for Docker bridge traffic
+  (`172.20.0.0/16`), fixing `Request timeout` errors from `actions/cache`.
+
 # 0.1.0
 
 Initial release.

site-cookbooks/kosmos_gitea/attributes/default.rb

@@ -1,5 +1,5 @@
-node.default["gitea"]["version"] = "1.26.4"
-node.default["gitea"]["checksum"] = "0faa36d151918f8f7d6e0f3ae67597d1c338583d695add146ac393109d0fc44a"
+node.default["gitea"]["version"] = "1.27.1"
+node.default["gitea"]["checksum"] = "86a7ac26e7f9c9cca0f56c4fac07fff205d5fc3bca0e54af23a204f07b833bc9"
 node.default["gitea"]["repo"] = nil
 node.default["gitea"]["revision"] = nil
 node.default["gitea"]["working_directory"] = "/var/lib/gitea"
@@ -25,3 +25,17 @@ node.default["gitea"]["config"] = {
 
 node.default["gitea"]["runner"]["version"] = "2.0.0"
 node.default["gitea"]["runner"]["checksum"] = "447156b33407ee045409f5552bd4a188a315cdd4085b4b498d8d4a9ad26c9f73"
+node.default["gitea"]["runner"]["cache_base_port"] = 8088
+node.default["gitea"]["runner"]["config"] = {
+  "runner" => {
+    "capacity" => 2
+  },
+  "container" => {
+    "network" => "gitea-actions" # User-defined bridge network: provides DNS for service containers
+  },
+  "cache" => {
+    "enabled" => true,
+    "host"    => "172.20.0.1" # Gateway of the gitea-actions network, reachable from job containers
+    # Port is set per-runner (cache_base_port + index) in the runner recipe
+  }
+}

site-cookbooks/kosmos_gitea/files/rate_limits.conf

@@ -0,0 +1,25 @@
+# Increase if you have very long User-Agent strings
+map_hash_bucket_size 256;
+
+# Bot user agents
+map $http_user_agent $bot_name {
+    default              "";
+    ~*ClaudeBot          "claude";
+    ~*Sogou              "sogou";
+    ~*meta-externalagent "meta-externalagent";
+    # add more as needed
+}
+
+# Decide the rate-limit key (per-IP for each bot in this example)
+map $bot_name $bot_limit_key {
+    default              "";
+    "claude"             $binary_remote_addr;
+    "sogou"              $binary_remote_addr;
+    "meta-externalagent" $binary_remote_addr;
+}
+
+# Shared memory zone – only non-empty keys are counted
+limit_req_zone $bot_limit_key zone=bots:20m rate=240r/m; # 4r/s per IP+bot
+
+# Status code returned when the limit is exceeded
+limit_req_status 429;

site-cookbooks/kosmos_gitea/metadata.rb

@@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org'
 license 'MIT'
 description 'Installs/configures Gitea'
 long_description 'Installs/configures Gitea'
-version '0.2.0'
+version '0.2.2'
 chef_version '>= 14.0'
 
 depends "firewall"

site-cookbooks/kosmos_gitea/recipes/nginx.rb

@@ -17,6 +17,14 @@ tls_cert_for domain do
   action :create
 end
 
+# Slow down requests from bots
+cookbook_file "#{node["openresty"]["dir"]}/conf.d/rate_limits.conf" do
+  source "rate_limits.conf"
+  owner "root"
+  group "root"
+  mode "0644"
+end
+
 openresty_site domain do
   template "nginx_conf_web.erb"
   variables server_name:   domain,

site-cookbooks/kosmos_gitea/recipes/runner.rb

@@ -35,14 +35,39 @@ directory "#{working_directory}/runners" do
   mode  "0700"
 end
 
-runners.each do |runner|
+execute "create_gitea_actions_network" do
+  command "docker network create --subnet 172.20.0.0/16 gitea-actions"
+  not_if  "docker network inspect gitea-actions"
+end
+
+runners.each_with_index do |runner, index|
   runner_name = "gitea-runner-#{runner["org"]}"
   runner_dir = "#{working_directory}/runners/#{runner["org"]}"
+  cache_port = node["gitea"]["runner"]["cache_base_port"] + index
 
   directory runner_dir do
     mode  "0700"
   end
 
+  runner_config = node["gitea"]["runner"]["config"].to_hash
+  runner_config["cache"] = runner_config["cache"].merge("port" => cache_port)
+
+  firewall_rule "runner_cache_#{runner["org"]}" do
+    command  :allow
+    port     cache_port
+    protocol :tcp
+    source   "172.20.0.0/16"
+  end
+
+  template "#{runner_dir}/config.yaml" do
+    source "runner.config.yaml.erb"
+    mode   "0640"
+    owner  "root"
+    group  "root"
+    variables(config: runner_config)
+    notifies :restart, "service[#{runner_name}]", :delayed
+  end
+
   bash "register_#{runner["org"]}_runner" do
     cwd runner_dir
     code <<-EOF
@@ -67,7 +92,7 @@ gitea_runner register \
         Type: "simple",
         WorkingDirectory: runner_dir,
         Environment: "HOME=/root",
-        ExecStart: "/usr/local/bin/gitea_runner daemon",
+        ExecStart: "/usr/local/bin/gitea_runner daemon --config #{runner_dir}/config.yaml",
         ExecStartPre: "/bin/sleep 3", # Wait for Gitea's API to be up when restarting at the same time
         Restart: "always",
       },

site-cookbooks/kosmos_gitea/templates/default/app.ini.erb

@@ -62,6 +62,9 @@ FROM = <%= @email %>
 INTERNAL_TOKEN = <%= @internal_token %>
 INSTALL_LOCK   = true
 SECRET_KEY     = <%= @secret_key %>
+<% if c = @config["webhook"] %>
+<% if c["allowed_host_list"] %>ALLOWED_HOST_LIST = <%= c["allowed_host_list"] %><% end %>
+<% end %>
 
 [service]
 REGISTER_EMAIL_CONFIRM            = false
@@ -101,11 +104,6 @@ RUN_AT_START = false
 NOTICE_ON_SUCCESS = false
 SCHEDULE = @every 15m
 
-<% if c = @config["webhook"] %>
-[webhook]
-<% if c["allowed_host_list"] %>ALLOWED_HOST_LIST = <%= c["allowed_host_list"] %><% end %>
-<% end %>
-
 <% if c = @config["storage"] %>
 [storage]
 <% if c["type"] == "minio" %>

site-cookbooks/kosmos_gitea/templates/default/nginx_conf_web.erb

@@ -20,6 +20,9 @@ server {
 
   proxy_intercept_errors on;
 
+  # Rate limit for bots. Defined in /etc/openresty/conf.d/rate_limits.conf
+  limit_req zone=bots burst=10; # allow a larger spike for asset bursts
+
   location ~ ^/(avatars|repo-avatars)/.*$ {
     proxy_buffers 1024 8k;
     proxy_pass http://_gitea_web;

site-cookbooks/kosmos_gitea/templates/default/runner.config.yaml.erb

@@ -0,0 +1 @@
+<%= @config.to_yaml.sub(/^---\n/, '') %>

site-cookbooks/kosmos_kvm/recipes/host.rb

@@ -5,6 +5,11 @@
 
 package %w(virtinst libvirt-daemon-system libvirt-clients)
 
+# Required on legacy hosts (Ubuntu 20.04) to build the NoCloud seed ISO
+# via cloud-localds. Modern virt-install (>= 4.0.0, Ubuntu >= 22.04)
+# handles cloud-init natively via --cloud-init and does not need it.
+package "cloud-image-utils" if node["platform_version"].to_f < 22.04
+
 directory "/var/lib/libvirt/images/base" do
   recursive true
   owner "libvirt-qemu"
@@ -24,7 +29,10 @@ end
 template "/usr/local/sbin/create_vm" do
   source "create_vm.erb"
   mode "0750"
-  variables base_image_path: node["kosmos_kvm"]["host"]["qemu_base_image"]["path"]
+  variables(
+    base_image_path: node["kosmos_kvm"]["host"]["qemu_base_image"]["path"],
+    modern_virt_install: node["platform_version"].to_f >= 22.04
+  )
 end
 
 firewall_rule 'ssh-alt-port' do

site-cookbooks/kosmos_kvm/templates/create_vm.erb

@@ -64,6 +64,7 @@ EOS
   popd
 fi
 
+<% if @modern_virt_install -%>
 virt-install \
   --name "$VMNAME" \
   --ram "$RAM" \
@@ -83,3 +84,30 @@ virt-install \
   --autostart \
   --import \
   --cloud-init root-password-generate=off,disable=on,meta-data=$CIDATA_PATH/meta-data,user-data=$CIDATA_PATH/user-data
+<% else -%>
+# Legacy path for hosts running virt-install < 4.0.0 (e.g. Ubuntu 20.04,
+# virt-install 2.2.x). These versions predate the --osinfo/--cloud-init
+# options, so we build a NoCloud seed ISO from the same user-data and
+# meta-data files and attach it as a cdrom. The guest receives the
+# exact same cloud-init configuration as on modern hosts.
+cloud-localds "$CIDATA_PATH/seed.iso" "$CIDATA_PATH/user-data" "$CIDATA_PATH/meta-data"
+
+virt-install \
+  --name "$VMNAME" \
+  --ram "$RAM" \
+  --vcpus "$CPUS" \
+  --cpu host \
+  --arch x86_64 \
+  --hvm \
+  --virt-type kvm \
+  --disk "$IMAGE_PATH" \
+  --disk "$CIDATA_PATH/seed.iso,device=cdrom" \
+  --boot hd \
+  --network=bridge=virbr0,model=virtio \
+  --graphics none \
+  --serial pty \
+  --console pty \
+  --channel unix,mode=bind,path=/var/lib/libvirt/qemu/$VMNAME.guest_agent.0,target_type=virtio,name=org.qemu.guest_agent.0 \
+  --autostart \
+  --import
+<% end -%>

site-cookbooks/kosmos_prometheus/recipes/server.rb

@@ -89,6 +89,11 @@ jobs = node["kosmos_prometheus"]["jobs"].merge(
     "query" => "role:garage_node",
     "port" => 3903
   },
+  # strfry relay metrics
+  "strfry" => {
+    "query" => "role:strfry",
+    "port" => 7777
+  },
 }.transform_values do |config|
     {
       "targets" => search(:node, config["query"]).map do |n|

site-cookbooks/kosmos_strfry/templates/nginx_conf_strfry.erb

@@ -31,6 +31,10 @@ server {
     proxy_pass http://_substr;
   }
 
+  location /metrics {
+    return 404;
+  }
+
   location / {
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;