Migrate fornax nginx to openresty

nodes/fornax.kosmos.org.json

@@ -18,7 +18,12 @@
     "hostname": "fornax",
     "ipaddress": "148.251.83.201",
     "roles": [
-      "nginx_proxy",
+      "base",
+      "kvm_host",
+      "openresty_proxy",
+      "openresty",
+      "garage_gateway",
+      "tor_proxy",
       "zerotier_controller"
     ],
     "recipes": [
@@ -26,16 +31,19 @@
       "kosmos-base::default",
       "kosmos_kvm::host",
       "kosmos_kvm::backup",
-      "tor-full",
-      "tor-full::default",
-      "kosmos_assets::nginx_site",
-      "kosmos_discourse::nginx",
-      "kosmos_drone::nginx",
+      "kosmos_openresty",
+      "kosmos_openresty::default",
+      "kosmos_openresty::firewall",
       "kosmos_garage",
       "kosmos_garage::default",
       "kosmos_garage::firewall_rpc",
+      "kosmos_assets::nginx_site",
+      "kosmos_discourse::nginx",
+      "kosmos_drone::nginx",
+      "kosmos-ejabberd::nginx",
       "kosmos_garage::nginx_web",
       "kosmos_gitea::nginx",
+      "kosmos_gitea::nginx_ssh",
       "kosmos_rsk::nginx_testnet",
       "kosmos_rsk::nginx_mainnet",
       "kosmos_website",
@@ -43,12 +51,14 @@
       "kosmos-akkounts::nginx",
       "kosmos-akkounts::nginx_api",
       "kosmos-bitcoin::nginx_lndhub",
-      "kosmos-ejabberd::nginx",
       "kosmos-hubot::nginx_botka_irc-libera-chat",
       "kosmos-hubot::nginx_hal8000_xmpp",
       "kosmos-ipfs::nginx_public_gateway",
       "kosmos-mastodon::nginx",
       "remotestorage_discourse::nginx",
+      "kosmos-base::tor_services",
+      "tor-full",
+      "tor-full::default",
       "kosmos_zerotier::controller",
       "kosmos_zerotier::firewall",
       "kosmos_zerotier::zncui",
@@ -66,19 +76,16 @@
       "postfix::_attributes",
       "postfix::sasl_auth",
       "hostname::default",
-      "kosmos-nginx::default",
-      "nginx::default",
-      "nginx::package",
-      "nginx::ohai_plugin",
-      "nginx::repo",
-      "nginx::commons",
-      "nginx::commons_dir",
-      "nginx::commons_script",
-      "nginx::commons_conf",
-      "kosmos-nginx::firewall",
-      "discourse::nginx",
+      "openresty::apt_package",
+      "openresty::ohai_plugin",
+      "openresty::commons_cleanup",
+      "openresty::commons_user",
+      "openresty::commons_dir",
+      "openresty::commons_script",
+      "openresty::commons_conf",
+      "logrotate::default",
+      "openresty::luarocks",
       "firewall::default",
-      "chef-sugar::default",
       "git::default",
       "git::package",
       "kosmos-base::letsencrypt",
@@ -88,20 +95,21 @@
     "platform_version": "20.04",
     "cloud": null,
     "chef_packages": {
-      "ohai": {
-        "version": "15.12.0",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/2.6.0/gems/ohai-15.12.0/lib/ohai"
-      },
       "chef": {
-        "version": "15.17.4",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/2.6.0/gems/chef-15.17.4/lib"
+        "version": "18.2.7",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.2.7/lib",
+        "chef_effortless": null
+      },
+      "ohai": {
+        "version": "18.1.4",
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
       }
     }
   },
   "run_list": [
     "role[base]",
     "role[kvm_host]",
-    "role[nginx_proxy]",
+    "role[openresty_proxy]",
     "role[zerotier_controller]"
   ]
-}
+}

site-cookbooks/kosmos_gitea/templates/default/nginx_conf_web.erb

@@ -11,6 +11,9 @@ server {
   ssl_certificate     <%= @ssl_cert %>;
   ssl_certificate_key <%= @ssl_key %>;
 
+  access_log <%= node[:openresty][:log_dir] %>/<%= @server_name %>.access.log;
+  error_log <%= node[:openresty][:log_dir] %>/<%= @server_name %>.error.log warn;
+
   add_header Strict-Transport-Security "max-age=31536000";
 
   client_max_body_size 20M;

site-cookbooks/kosmos_website/recipes/default.rb

@@ -13,8 +13,8 @@ tls_cert_for domain do
 end
 
 git "/var/www/#{domain}" do
-  user node["nginx"]["user"]
-  group node["nginx"]["group"]
+  user node["openresty"]["user"]
+  group node["openresty"]["group"]
   repository node["kosmos_website"]["repo"]
   revision node["kosmos_website"]["revision"]
   action :sync