kosmos/chef
8
3
Fork 0
Code Issues 34 Pull Requests 3 Projects 2 Activity

Compare commits

base: kosmos:e3559119beb68d9b6293222e8c85870ffd4745fe
Branches Tags
kosmos:master kosmos:feature/237-gitea_ssh_signing kosmos:bugfix/substr_url_matching kosmos:notes/ejabberd_ldap_photo kosmos:feature/akaunting kosmos:chore/ejabberd_service_avatar kosmos:feature/237-gitea_gpg kosmos:jammy_jellyfish
...
compare: kosmos:master
Branches Tags
kosmos:feature/237-gitea_ssh_signing kosmos:master kosmos:bugfix/substr_url_matching kosmos:notes/ejabberd_ldap_photo kosmos:feature/akaunting kosmos:chore/ejabberd_service_avatar kosmos:feature/237-gitea_gpg kosmos:jammy_jellyfish

8 Commits
e3559119be ... master

Author SHA1 Message Date
Râu Cao
be8278fbdc Upgrade act_runner 2026-02-13 16:06:08 +04:00
Râu Cao
ff3f05452f Merge pull request 'Update Gitea to 1.25.4' (#622) from chore/upgrade_gitea into master 
Reviewed-on: #622
Reviewed-by: Râu Cao <raucao@kosmos.org>
 2026-02-13 10:18:36 +00:00
Greg Karekinian
1fb66092fc Update Gitea to 1.25.4 
Back to using the binary from upstream releases
 2026-02-13 11:15:07 +01:00
Greg Karekinian
81691f7e21 Run systemctl daemon-reload on gitea service changes 2026-02-13 11:05:08 +01:00
Râu Cao
e9dff82628 Merge pull request 'Add IPv6 support for all OpenResty sites' (#618) from feature/614-ipv6 into master 
Reviewed-on: #618
 2026-02-12 13:09:25 +00:00
Râu Cao
0933e9caa0 Add IPv6 to all OpenResty sites 
Co-authored-by: Greg Karékinian <greg@karekinian.com>
 2026-02-12 17:05:14 +04:00
Greg
9f862a89cc Merge pull request 'Enable Gitea SSH via IPv6' (#613) from chore/612-enable_ipv6_ssh into master 
Reviewed-on: #613
Reviewed-by: Greg <greg@kosmos.org>
 2026-01-11 13:19:33 +00:00
Râu Cao
039dbdf091 Enable Gitea SSH via IPv6 
closes #612
 2026-01-09 13:43:06 +07:00
32 changed files with 38 additions and 41 deletions
Expand all files Collapse all files

1
nodes/draco.kosmos.org.json
View File

@@ -12,6 +12,7 @@
},
"openresty": {
"listen_ip": "148.251.237.111",
"listen_ipv6": "2a01:4f8:202:804a::2",
"log_formats": {
"json": "{\"ip\":\"$remote_addr\",\"time\":\"$time_local\",\"host\":\"$host\",\"method\":\"$request_method\",\"uri\":\"$uri\",\"status\":$status,\"size\":$body_bytes_sent,\"referer\":\"$http_referer\",\"upstream_addr\":\"$upstream_addr\",\"upstream_response_time\":\"$upstream_response_time\",\"ua\":\"$http_user_agent\"}"
}

7
nodes/gitea-2.json
View File

@@ -50,13 +50,6 @@
"postfix::sasl_auth",
"hostname::default",
"firewall::default",
"kosmos_gitea::compile_from_source",
"git::default",
"git::package",
"kosmos-nodejs::default",
"nodejs::nodejs_from_package",
"nodejs::repo",
"golang::default",
"backup::default",
"logrotate::default"
],

4
roles/gitea.rb
View File

@@ -8,8 +8,8 @@ run_list %w(
override_attributes(
"gitea" => {
"repo" => "https://github.com/67P/gitea.git",
"revision" => "ldap_sync",
# "repo" => "https://github.com/67P/gitea.git",
# "revision" => "ldap_sync",
"log" => { "level" => "Info" }
},
)

4
site-cookbooks/discourse/templates/nginx_conf.erb
View File

@@ -8,8 +8,8 @@ upstream _<%= @upstream_name %> {
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
server {
server_name <%= @server_name %>;
listen 443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>;

2
site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts.erb
View File

@@ -11,7 +11,7 @@ proxy_cache_path <%= node[:openresty][:cache_dir] %>/akkounts levels=1:2
server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @domain %>;
if ($host != $server_name) {

2
site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts_api.erb
View File

@@ -7,7 +7,7 @@ upstream _akkounts_api {
server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @domain %>;
ssl_certificate <%= @ssl_cert %>;

2
site-cookbooks/kosmos-bitcoin/templates/nginx_conf_btcpayserver.erb
View File

@@ -49,7 +49,7 @@ server {
client_max_body_size 100M;
server_name <%= @server_name %>;
listen 443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
access_log <%= node[:nginx][:log_dir] %>/btcpayserver.access.log json;
error_log <%= node[:nginx][:log_dir] %>/btcpayserver.error.log warn;

2
site-cookbooks/kosmos-bitcoin/templates/nginx_conf_lndhub.erb
View File

@@ -7,7 +7,7 @@ upstream _lndhub {
server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>;
add_header Strict-Transport-Security "max-age=15768000";

2
site-cookbooks/kosmos-btcpayserver/templates/nginx_conf_btcpayserver.erb
View File

@@ -49,7 +49,7 @@ server {
server_name <%= @server_name %>;
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
listen 443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
<% else -%>
listen 80;
<% end -%>

2
site-cookbooks/kosmos-ejabberd/templates/nginx_conf_upload_service.erb
View File

@@ -3,7 +3,7 @@
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>;
ssl_certificate <%= @ssl_cert %>;

2
site-cookbooks/kosmos-hubot/templates/default/nginx_conf_hubot.erb
View File

@@ -7,7 +7,7 @@ upstream _express_<%= @server_name.gsub(".", "_") %> {
server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>;
add_header Strict-Transport-Security "max-age=15768000";

2
site-cookbooks/kosmos-ipfs/templates/default/nginx_conf_ipfs.kosmos.org.erb
View File

@@ -12,7 +12,7 @@ upstream _ipfs_api {
server {
server_name <%= @server_name %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
access_log /var/log/nginx/<%= @server_name %>.access.log;
error_log /var/log/nginx/<%= @server_name %>.error.log;

2
site-cookbooks/kosmos-mastodon/templates/default/nginx_conf_mastodon.erb
View File

@@ -21,7 +21,7 @@ proxy_cache_path /var/cache/nginx/mastodon levels=1:2
server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>;
include <%= @shared_config_path %>;

2
site-cookbooks/kosmos_assets/templates/nginx_conf_assets.erb
View File

@@ -3,7 +3,7 @@
server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @domain %>;
root /var/www/<%= @domain %>/site;

2
site-cookbooks/kosmos_discourse/templates/nginx_conf.erb
View File

@@ -9,7 +9,7 @@ upstream _discourse {
server {
server_name <%= @server_name %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>;

2
site-cookbooks/kosmos_drone/templates/nginx_conf.erb
View File

@@ -8,7 +8,7 @@ upstream _drone {
server {
server_name <%= @server_name %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>;

2
site-cookbooks/kosmos_garage/templates/nginx_conf_s3.erb
View File

@@ -4,7 +4,7 @@ upstream garage_s3 {
server {
listen <%= "#{node[:openresty][:listen_ip]}:" if node[:openresty][:listen_ip] %>443 ssl http2;
listen [::]:443 http2 ssl;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>;

2
site-cookbooks/kosmos_garage/templates/nginx_conf_web.erb
View File

@@ -1,6 +1,6 @@
server {
listen <%= "#{node[:openresty][:listen_ip]}:" if node[:openresty][:listen_ip] %>443 ssl http2;
listen [::]:443 http2 ssl;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>;

8
site-cookbooks/kosmos_gitea/attributes/default.rb
View File

@@ -1,5 +1,5 @@
node.default["gitea"]["version"] = "1.23.8"
node.default["gitea"]["checksum"] = "827037e7ca940866918abc62a7488736923396c467fcb4acd0dd9829bb6a6f4c"
node.default["gitea"]["version"] = "1.25.4"
node.default["gitea"]["checksum"] = "a3031853e67c53714728ef705642c9046a11fb0ea356aff592e23efe6114607d"
node.default["gitea"]["repo"] = nil
node.default["gitea"]["revision"] = nil
node.default["gitea"]["working_directory"] = "/var/lib/gitea"
@@ -22,5 +22,5 @@ node.default["gitea"]["config"] = {
}
}
node.default["gitea"]["act_runner"]["version"] = "0.2.6"
node.default["gitea"]["act_runner"]["checksum"] = "234c2bdb871e7b0bfb84697f353395bfc7819faf9f0c0443845868b64a041057"
node.default["gitea"]["act_runner"]["version"] = "0.2.13"
node.default["gitea"]["act_runner"]["checksum"] = "3acac8b506ac8cadc88a55155b5d6378f0fab0b8f62d1e0c0450f4ccd69733e2"

2
site-cookbooks/kosmos_gitea/recipes/default.rb
View File

@@ -129,7 +129,7 @@ template "/etc/systemd/system/gitea.service" do
git_home_directory: git_home_directory,
config_directory: config_directory,
gitea_binary_path: gitea_binary_path
notifies :run, "execute[systemctl daemon-reload]", :delayed
notifies :run, "execute[systemctl daemon-reload]", :immediately
end
service "gitea" do

1
site-cookbooks/kosmos_gitea/templates/default/nginx_conf_ssh.erb
View File

@@ -4,5 +4,6 @@ upstream _gitea_ssh {
server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>22;
listen [::]:22;
proxy_pass _gitea_ssh;
}

2
site-cookbooks/kosmos_gitea/templates/default/nginx_conf_web.erb
View File

@@ -6,7 +6,7 @@ upstream _gitea_web {
server {
server_name <%= @server_name %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>;

2
site-cookbooks/kosmos_liquor-cabinet/templates/nginx_conf_liquor-cabinet.erb
View File

@@ -12,7 +12,7 @@ upstream _<%= @app_name %> {
server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>;
access_log <%= node[:nginx][:log_dir] %>/<%= @app_name %>.access.log; # TODO json_liquor_cabinet;

1
site-cookbooks/kosmos_openresty/attributes/default.rb Normal file
View File

@@ -0,0 +1 @@
node.default["openresty"]["listen_ipv6"] = "::"

2
site-cookbooks/kosmos_rsk/templates/nginx_conf_rskj.erb
View File

@@ -6,7 +6,7 @@ upstream _<%= @upstream_name %> {
server {
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @domain %>;

2
site-cookbooks/kosmos_strfry/templates/nginx_conf_strfry.erb
View File

@@ -13,7 +13,7 @@ upstream _substr {
server {
server_name <%= @domain %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
access_log "/var/log/nginx/<%= @domain %>.access.log";
error_log "/var/log/nginx/<%= @domain %>.error.log";

2
site-cookbooks/kosmos_website/templates/nginx_conf_redirect.erb
View File

@@ -3,7 +3,7 @@
server {
server_name <%= @domain %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
access_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.access.log;
error_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.error.log warn;

2
site-cookbooks/kosmos_website/templates/nginx_conf_simple.erb
View File

@@ -3,7 +3,7 @@
server {
server_name <%= @domain %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
root /var/www/<%= @domain %>/public;

3
site-cookbooks/kosmos_website/templates/nginx_conf_website.erb
View File

@@ -3,6 +3,7 @@
server {
server_name _;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>80 default_server;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:80 default_server;
location / {
return 301 https://<%= @domain %>;
@@ -12,7 +13,7 @@ server {
server {
server_name <%= @domain %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2 default_server;
listen [::]:443 ssl http2 default_server;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2 default_server;
if ($host != $server_name) {
return 307 $scheme://$server_name;

4
site-cookbooks/kredits-github/templates/default/nginx_conf.erb
View File

@@ -5,8 +5,8 @@ upstream _<%= @app_name %> {
<% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
server_name <%= @server_name %>;
access_log <%= node[:nginx][:log_dir] %>/<%= @app_name %>.access.log json;

2
site-cookbooks/openresty

Submodule site-cookbooks/openresty updated: bc916b981c...b31d6b0b01

2
site-cookbooks/remotestorage_discourse/templates/nginx_conf.erb
View File

@@ -8,7 +8,7 @@ upstream _rs_discourse {
server {
server_name <%= @server_name %>;
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
listen [::]:443 ssl http2;
listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
ssl_certificate <%= @ssl_cert %>;
ssl_certificate_key <%= @ssl_key %>;