Fix Java/Homebrew cookbook resource failing with recent Chef

Required by our Mastodon cookbook
Add new postgres cluster, remove old one
2026-04-11 15:23:30 +04:00 · 2026-04-11 15:22:34 +04:00 · 2026-04-11 14:56:15 +04:00 · 2026-04-11 14:55:32 +04:00 · 2026-04-11 14:55:02 +04:00 · 2026-04-11 14:53:28 +04:00
17 changed files with 74 additions and 177 deletions
--- a/1
+++ b/1
@@ -24,6 +24,7 @@ cookbook 'composer',               '~> 2.7.0'
 cookbook 'fail2ban',               '~> 7.0.4'
 cookbook 'git',                    '~> 10.0.0'
 cookbook 'golang',                 '~> 5.3.1'
+cookbook 'homebrew',               '>= 6.0.0'
 cookbook 'hostname',               '= 0.4.2'
 cookbook 'hostsfile',              '~> 3.0.1'
 cookbook 'java',                   '~> 4.3.0'
--- a/Berksfile.lock
+++ b/Berksfile.lock
@@ -8,6 +8,7 @@ DEPENDENCIES
  firewall (~> 6.2.16)
  git (~> 10.0.0)
  golang (~> 5.3.1)
+  homebrew (>= 6.0.0)
  hostname (= 0.4.2)
  hostsfile (~> 3.0.1)
  ipfs
@@ -62,7 +63,7 @@ GRAPH
  git (10.0.0)
  golang (5.3.1)
    ark (>= 6.0)
-  homebrew (5.4.1)
+  homebrew (6.0.2)
  hostname (0.4.2)
    hostsfile (>= 0.0.0)
  hostsfile (3.0.1)
--- a/clients/postgres-11.json
+++ b/clients/postgres-11.json
@@ -0,0 +1,4 @@
+{
+  "name": "postgres-11",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1foYpuubS2ovlg3uHO12\nQ/ROZ8MpG+LkCAM46uVfPaoWwfY0vdfMsBOanHDgm9DGUCEBJZ6LPrvCvGXbpPy6\n9GSswK75zVWODblNjvvV4ueGFq4bBFwRuZNjyMlqgyzeU+srZL0ivelu5XEuGuoD\nPYCBKWYqGMz85/eMC7/tinTJtKPyOtXe/G8meji+r7gh3j+ypj/EWeKfcRDa4aGe\n/DmMCurIjjPAXFLMAA6fIqPWVfcPw4APNPE60Z92yPGsTbPu7bL54M5f7udmmu7H\nOgk1HjMAmXCuLDzTkfaxqHP+57yELg/YpXR1E93VmBeQuIBsyOFEk6AmUmA1Ib6e\nnQIDAQAB\n-----END PUBLIC KEY-----\n"
+}
--- a/clients/postgres-12.json
+++ b/clients/postgres-12.json
@@ -0,0 +1,4 @@
+{
+  "name": "postgres-12",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1mYGrYB8keUKmXA8dhWc\ncCLzp50xR0ajSw+bWYydyRqD5wuEVKjiJu4+G9QmTVXkVgJ+AYI0Y9/WZYpDqVH6\nvLUo6BSNQaWx20q93qIdOGLy8YG3Qyznezk4l8T9u9vWZDyDpKw6gCxzikMkrXxb\n0cqOYtyud8+PtSEEMogSjOKhRURVHlVrlVH3SQO7Whke9rkiFcbXzubsK9yjkUtF\nxZafSoGorOlDsPvFTfYnkepVB+GHcgiribRYSrO+73GypC2kqMhCpWrb6a0VWsP/\nh53+q3JL3vBvdvjcv51Wpf4n6JdnXnQGn2/MdXEzw+NXgjU4/IdYtbORSbaI8F5t\nowIDAQAB\n-----END PUBLIC KEY-----\n"
+}
--- a/doc/postgres/migration.md
+++ b/doc/postgres/migration.md
@@ -246,7 +246,7 @@ sudo -u postgres pg_fix_sequences [db_name]

   ```bash
   export NEW_PG_PRIMARY=[private_ip]
-   bundle exec knife ssh roles:ejabberd -a knife_zero.host "sudo sed -r \"s/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\s(pg.kosmos.local)/$NEW_PG_PRIMARY\t\1/\" -i /etc/hosts"
+   knife ssh roles:ejabberd -a knife_zero.host "sudo sed -r \"s/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\s(pg.kosmos.local)/$NEW_PG_PRIMARY\t\1/\" -i /etc/hosts"
   ```

   Or override node attribute(s) if necessary and/or approporiate.
--- a/nodes/postgres-11.json
+++ b/nodes/postgres-11.json
@@ -1,16 +1,17 @@
 {
-  "name": "postgres-6",
+  "name": "postgres-11",
+  "chef_environment": "production",
  "normal": {
    "knife_zero": {
-      "host": "10.1.1.196"
+      "host": "10.1.1.91"
    }
  },
  "automatic": {
-    "fqdn": "postgres-6",
+    "fqdn": "postgres-11",
    "os": "linux",
-    "os_version": "5.4.0-173-generic",
-    "hostname": "postgres-6",
-    "ipaddress": "192.168.122.60",
+    "os_version": "5.15.0-1095-kvm",
+    "hostname": "postgres-11",
+    "ipaddress": "192.168.122.142",
    "roles": [
      "base",
      "kvm_guest",
@@ -21,18 +22,20 @@
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_postgresql::primary",
-      "kosmos_postgresql::firewall",
      "kosmos-akkounts::pg_db",
      "kosmos-bitcoin::lndhub-go_pg_db",
      "kosmos-bitcoin::nbxplorer_pg_db",
      "kosmos_drone::pg_db",
      "kosmos_gitea::pg_db",
      "kosmos-mastodon::pg_db",
+      "kosmos_postgresql::firewall",
+      "kosmos_postgresql::management_scripts",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
+      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -44,17 +47,17 @@
      "hostname::default"
    ],
    "platform": "ubuntu",
-    "platform_version": "20.04",
+    "platform_version": "22.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.4.2",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.4.2/lib",
+        "version": "18.10.17",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.1.11",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+        "version": "18.2.13",
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
      }
    }
  },
--- a/nodes/postgres-12.json
+++ b/nodes/postgres-12.json
@@ -1,17 +1,17 @@
 {
-  "name": "postgres-10",
+  "name": "postgres-12",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
-      "host": "10.1.1.176"
+      "host": "10.1.1.134"
    }
  },
  "automatic": {
-    "fqdn": "postgres-10",
+    "fqdn": "postgres-12",
    "os": "linux",
-    "os_version": "5.15.0-1095-kvm",
-    "hostname": "postgres-10",
-    "ipaddress": "192.168.122.41",
+    "os_version": "5.15.0-1096-kvm",
+    "hostname": "postgres-12",
+    "ipaddress": "192.168.122.139",
    "roles": [
      "base",
      "kvm_guest",
@@ -24,6 +24,7 @@
      "kosmos_postgresql::hostsfile",
      "kosmos_postgresql::replica",
      "kosmos_postgresql::firewall",
+      "kosmos_postgresql::management_scripts",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
--- a/nodes/postgres-8.json
+++ b/nodes/postgres-8.json
@@ -1,62 +0,0 @@
-{
-  "name": "postgres-8",
-  "chef_environment": "production",
-  "normal": {
-    "knife_zero": {
-      "host": "10.1.1.99"
-    }
-  },
-  "automatic": {
-    "fqdn": "postgres-8",
-    "os": "linux",
-    "os_version": "5.15.0-1059-kvm",
-    "hostname": "postgres-8",
-    "ipaddress": "192.168.122.100",
-    "roles": [
-      "base",
-      "kvm_guest",
-      "postgresql_replica"
-    ],
-    "recipes": [
-      "kosmos-base",
-      "kosmos-base::default",
-      "kosmos_kvm::guest",
-      "kosmos_postgresql::hostsfile",
-      "kosmos_postgresql::replica",
-      "kosmos_postgresql::firewall",
-      "apt::default",
-      "timezone_iii::default",
-      "timezone_iii::debian",
-      "ntp::default",
-      "ntp::apparmor",
-      "kosmos-base::systemd_emails",
-      "apt::unattended-upgrades",
-      "kosmos-base::firewall",
-      "kosmos-postfix::default",
-      "postfix::default",
-      "postfix::_common",
-      "postfix::_attributes",
-      "postfix::sasl_auth",
-      "hostname::default"
-    ],
-    "platform": "ubuntu",
-    "platform_version": "22.04",
-    "cloud": null,
-    "chef_packages": {
-      "chef": {
-        "version": "18.5.0",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
-        "chef_effortless": null
-      },
-      "ohai": {
-        "version": "18.1.11",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
-      }
-    }
-  },
-  "run_list": [
-    "role[base]",
-    "role[kvm_guest]",
-    "role[postgresql_replica]"
-  ]
-}
--- a/nodes/postgres-9.json
+++ b/nodes/postgres-9.json
@@ -1,63 +0,0 @@
-{
-  "name": "postgres-9",
-  "chef_environment": "production",
-  "normal": {
-    "knife_zero": {
-      "host": "10.1.1.3"
-    }
-  },
-  "automatic": {
-    "fqdn": "postgres-9",
-    "os": "linux",
-    "os_version": "5.15.0-1059-kvm",
-    "hostname": "postgres-9",
-    "ipaddress": "192.168.122.64",
-    "roles": [
-      "base",
-      "kvm_guest",
-      "postgresql_replica"
-    ],
-    "recipes": [
-      "kosmos-base",
-      "kosmos-base::default",
-      "kosmos_kvm::guest",
-      "kosmos_postgresql::hostsfile",
-      "kosmos_postgresql::replica",
-      "kosmos_postgresql::firewall",
-      "apt::default",
-      "timezone_iii::default",
-      "timezone_iii::debian",
-      "ntp::default",
-      "ntp::apparmor",
-      "kosmos-base::journald_conf",
-      "kosmos-base::systemd_emails",
-      "apt::unattended-upgrades",
-      "kosmos-base::firewall",
-      "kosmos-postfix::default",
-      "postfix::default",
-      "postfix::_common",
-      "postfix::_attributes",
-      "postfix::sasl_auth",
-      "hostname::default"
-    ],
-    "platform": "ubuntu",
-    "platform_version": "22.04",
-    "cloud": null,
-    "chef_packages": {
-      "chef": {
-        "version": "18.8.54",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.8.54/lib",
-        "chef_effortless": null
-      },
-      "ohai": {
-        "version": "18.2.8",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.8/lib/ohai"
-      }
-    }
-  },
-  "run_list": [
-    "role[base]",
-    "role[kvm_guest]",
-    "role[postgresql_replica]"
-  ]
-}
--- a/roles/postgresql_primary.rb
+++ b/roles/postgresql_primary.rb
@@ -1,12 +1,13 @@
 name "postgresql_primary"

-run_list %w(
-  kosmos_postgresql::primary
-  kosmos_postgresql::firewall
-  kosmos-akkounts::pg_db
-  kosmos-bitcoin::lndhub-go_pg_db
-  kosmos-bitcoin::nbxplorer_pg_db
-  kosmos_drone::pg_db
-  kosmos_gitea::pg_db
-  kosmos-mastodon::pg_db
-)
+run_list [
+  "kosmos_postgresql::primary",
+  "kosmos-akkounts::pg_db",
+  "kosmos-bitcoin::lndhub-go_pg_db",
+  "kosmos-bitcoin::nbxplorer_pg_db",
+  "kosmos_drone::pg_db",
+  "kosmos_gitea::pg_db",
+  "kosmos-mastodon::pg_db",
+  "kosmos_postgresql::firewall",
+  "kosmos_postgresql::management_scripts"
+]
--- a/roles/postgresql_replica.rb
+++ b/roles/postgresql_replica.rb
@@ -1,7 +1,8 @@
 name "postgresql_replica"

-run_list %w(
-  kosmos_postgresql::hostsfile
-  kosmos_postgresql::replica
-  kosmos_postgresql::firewall
-)
+run_list [
+  "kosmos_postgresql::hostsfile",
+  "kosmos_postgresql::replica",
+  "kosmos_postgresql::firewall",
+  "kosmos_postgresql::management_scripts"
+]
--- a/site-cookbooks/kosmos-akkounts/recipes/default.rb
+++ b/site-cookbooks/kosmos-akkounts/recipes/default.rb
@@ -230,7 +230,6 @@ systemd_unit "akkounts.service" do
      WorkingDirectory: deploy_path,
      Environment: "RAILS_ENV=#{rails_env} SOLID_QUEUE_IN_PUMA=true",
      ExecStart: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid",
-      ExecStop: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid stop",
      ExecReload: "#{bundle_path} exec pumactl -F config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid phased-restart",
      PIDFile: "#{deploy_path}/tmp/puma.pid",
      TimeoutSec: "10",
--- a/site-cookbooks/kosmos_postgresql/files/dump_all_databases.sh
+++ b/site-cookbooks/kosmos_postgresql/files/dump_all_databases.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 cd /tmp && \
 (pg_dumpall --globals-only > globals.sql) && \
-psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN (''template0'',''postgres'')" | \
+psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN (''template1'',''postgres'')" | \
 xargs -I{} -P4 sh -c "
  pg_dump -Fd -j 4 -d \"{}\" -f dump_{} &&
  tar -cf - dump_{} | zstd -19 -T0 > dump_{}.tar.zst &&
--- a/site-cookbooks/kosmos_postgresql/files/list_subscriptions.sh
+++ b/site-cookbooks/kosmos_postgresql/files/list_subscriptions.sh
@@ -1,5 +1,16 @@
 #!/bin/bash
-for db in $(psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN ('template1','postgres')"); do
-  echo "==== DB: $db ===="
-  psql -d "$db" -c "SELECT * FROM pg_stat_subscription;"
+set -euo pipefail
+
+psql -Atqc "
+SELECT datname
+FROM pg_database
+WHERE datallowconn
+  AND datname NOT IN ('template1','postgres')
+" | while read -r db; do
+  result=$(psql -X -At -d "$db" -c "SELECT * FROM pg_stat_subscription;" 2>/dev/null || true)
+
+  if [[ -n "$result" ]]; then
+    echo "==== DB: $db ===="
+    echo "$result"
+  fi
 done
--- a/site-cookbooks/kosmos_postgresql/libraries/helpers.rb
+++ b/site-cookbooks/kosmos_postgresql/libraries/helpers.rb
@@ -39,13 +39,5 @@ class Chef
    def postgresql_version
      node['kosmos_postgresql']['postgresql_version']
    end
-
-    def postgresql_service
-      "postgresql@#{postgresql_version}-main"
-    end
-
-    def postgresql_data_dir
-      "/var/lib/postgresql/#{postgresql_version}/main"
-    end
  end
 end
--- a/site-cookbooks/kosmos_postgresql/recipes/replica.rb
+++ b/site-cookbooks/kosmos_postgresql/recipes/replica.rb
@@ -16,16 +16,19 @@ if primary.nil?
  return
 end

+postgresql_service_name = "postgresql@#{postgresql_version}-main"
+postgresql_data_dir = "/var/lib/postgresql/#{postgresql_version}/main"
+
 # TODO Replace pg.kosmos.local with private IP once available
 # via proper node attribute
 # https://gitea.kosmos.org/kosmos/chef/issues/263
 execute "set up replication" do
  command <<-EOF
-systemctl stop #{postgresql_service}
+systemctl stop #{postgresql_service_name}
 mv #{postgresql_data_dir} #{postgresql_data_dir}.old
 pg_basebackup -h pg.kosmos.local -U replication -D #{postgresql_data_dir} -R
 chown -R postgres:postgres #{postgresql_data_dir}
-systemctl start #{postgresql_service}
+systemctl start #{postgresql_service_name}
  EOF
  environment 'PGPASSWORD' => postgresql_data_bag_item['replication_password']
  sensitive true
--- a/site-cookbooks/kosmos_postgresql/resources/server.rb
+++ b/site-cookbooks/kosmos_postgresql/resources/server.rb
@@ -44,13 +44,14 @@ action :create do

  shared_buffers = if node['memory']['total'].to_i / 1024 < 1024 # < 1GB RAM
                     "128MB"
-                   else # >= 1GB RAM, use 50% of total RAM
-                     "#{node['memory']['total'].to_i / 1024 / 2}MB"
+                   else # >= 1GB RAM, use 25% of total RAM
+                     "#{node['memory']['total'].to_i / 1024 / 4}MB"
                   end

  additional_config = {
    max_connections: 200, # default
    shared_buffers: shared_buffers,
+    work_mem: "4MB",
    unix_socket_directories: "/var/run/postgresql",
    dynamic_shared_memory_type: "posix",
    timezone: "UTC", # default is GMT
Author	SHA1	Message	Date
Râu Cao	ac4fb0c9ca	Fix Java/Homebrew cookbook resource failing with recent Chef Required by our Mastodon cookbook	2026-04-11 15:23:30 +04:00
Râu Cao	d5e3d62522	Add new postgres cluster, remove old one	2026-04-11 15:22:34 +04:00
Râu Cao	061880536b	Fix akkounts systemd unit stop command Typo (not using pumactl), but we don't need to specify it to do the right thing anyway. systemd can just send sigterm on its own.	2026-04-11 14:56:15 +04:00
Râu Cao	9de37cde96	Update doc	2026-04-11 14:55:32 +04:00
Râu Cao	64d5d34d85	Update postgres roles Reset to normal/final	2026-04-11 14:55:02 +04:00
Râu Cao	db9177c9c6	Improve RAM usage allowance Queries can spawn more processed and then use more RAM than `shared_buffers`	2026-04-11 14:53:28 +04:00
Râu Cao	c92f9157a5	Fix method undefined in heredoc	2026-04-11 14:52:53 +04:00
Râu Cao	a89db454d0	Improve postgres management scripts	2026-04-11 14:51:51 +04:00