Compare commits
1 Commits
feature/23
...
71391ce323
| Author | SHA1 | Date | |
|---|---|---|---|
|
71391ce323
|
6
.gitmodules
vendored
6
.gitmodules
vendored
@@ -4,9 +4,3 @@
|
||||
[submodule "site-cookbooks/openresty"]
|
||||
path = site-cookbooks/openresty
|
||||
url = https://github.com/67P/chef-openresty.git
|
||||
[submodule "site-cookbooks/strfry"]
|
||||
path = site-cookbooks/strfry
|
||||
url = git@gitea.kosmos.org:kosmos/strfry-cookbook.git
|
||||
[submodule "site-cookbooks/deno"]
|
||||
path = site-cookbooks/deno
|
||||
url = git@gitea.kosmos.org:kosmos/deno-cookbook.git
|
||||
|
||||
@@ -21,7 +21,6 @@ cookbook 'composer', '~> 2.7.0'
|
||||
cookbook 'fail2ban', '~> 7.0.4'
|
||||
cookbook 'git', '~> 10.0.0'
|
||||
cookbook 'golang', '~> 5.3.1'
|
||||
cookbook 'gpg', '~> 2.0.13'
|
||||
cookbook 'hostname', '= 0.4.2'
|
||||
cookbook 'hostsfile', '~> 3.0.1'
|
||||
cookbook 'java', '~> 4.3.0'
|
||||
|
||||
@@ -8,7 +8,6 @@ DEPENDENCIES
|
||||
firewall (~> 6.2.16)
|
||||
git (~> 10.0.0)
|
||||
golang (~> 5.3.1)
|
||||
gpg (~> 2.0.13)
|
||||
hostname (= 0.4.2)
|
||||
hostsfile (~> 3.0.1)
|
||||
ipfs
|
||||
@@ -60,8 +59,6 @@ GRAPH
|
||||
git (10.0.0)
|
||||
golang (5.3.1)
|
||||
ark (>= 6.0)
|
||||
gpg (2.0.13)
|
||||
yum-epel (>= 0.0.0)
|
||||
homebrew (5.4.1)
|
||||
hostname (0.4.2)
|
||||
hostsfile (>= 0.0.0)
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
{
|
||||
"name": "strfry-1",
|
||||
"public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzDV/RMGMXVDbvoA6PNh8\nQzhtHwYDCFcUSkbrwP6tzh6GpVunGEOdOdhj2V63T2tF1H+lujxQXh5pK7C0D6VZ\niO04ftJlo7/svyxUcwWr+znyN5sFdQRh3cBZiGSBYolizwoqgtPFlbNhmWAzV0Du\n9t8mhz70IK3B+UdwWyHtoK0NNsJGnQ9YzAvcjyDmEO/3sCjAhNnxVpmXftpcSmd9\nMonzFtIDBbRRll4AHZYRbmXCzx63+VmelvdnufnbY82liol0zzBwJaBD1wyNlG0y\ni96p3Kx03bLNlIaYVGbjZeJi+6oo2VDWJ4OloLLAYoHDSipeHT9qWfUdnE6ge4Lm\nywIDAQAB\n-----END PUBLIC KEY-----\n"
|
||||
}
|
||||
@@ -1,5 +0,0 @@
|
||||
config:
|
||||
ul-indent: false # MD007
|
||||
line-length: false # MD013
|
||||
no-duplicate-heading: false # MD024
|
||||
reference-links-images: false # MD052
|
||||
@@ -1,89 +0,0 @@
|
||||
# gpg Cookbook CHANGELOG
|
||||
|
||||
This file is used to list changes made in each version of the gpg cookbook.
|
||||
|
||||
## 2.0.13 - *2024-05-02*
|
||||
|
||||
## 2.0.12 - *2024-05-02*
|
||||
|
||||
## 2.0.11 - *2023-09-28*
|
||||
|
||||
## 2.0.10 - *2023-09-04*
|
||||
|
||||
## 2.0.9 - *2023-07-10*
|
||||
|
||||
## 2.0.8 - *2023-05-16*
|
||||
|
||||
- Fix markdown formatting in the changelog
|
||||
- Standardise files with files in sous-chefs/repo-management
|
||||
|
||||
## 2.0.7 - *2023-05-16*
|
||||
|
||||
- Standardise files with files in sous-chefs/repo-management
|
||||
|
||||
## 2.0.6 - *2023-05-03*
|
||||
|
||||
- Standardise files with files in sous-chefs/repo-management
|
||||
|
||||
## 2.0.5 - *2023-04-01*
|
||||
|
||||
- Standardise files with files in sous-chefs/repo-management
|
||||
|
||||
## 2.0.4 - *2023-03-02*
|
||||
|
||||
- Standardise files with files in sous-chefs/repo-management
|
||||
|
||||
## 2.0.3 - *2023-02-14*
|
||||
|
||||
- Remove delivery folder
|
||||
|
||||
## 2.0.2 - *2021-08-31*
|
||||
|
||||
- Standardise files with files in sous-chefs/repo-management
|
||||
|
||||
## 2.0.1 - *2021-06-01*
|
||||
|
||||
- Standardise files with files in sous-chefs/repo-management
|
||||
|
||||
## 2.0.0 - *2021-05-07*
|
||||
|
||||
- Update tested platforms
|
||||
- Set minimum Chef version to 15.3 for unified_mode support
|
||||
|
||||
## 1.3.0 - *2020-12-14*
|
||||
|
||||
- Added support for SUSE and OpenSUSE
|
||||
|
||||
## 1.2.0 (2020-08-26)
|
||||
|
||||
- Comment out enforce_idempotency in kitchen.dokken.yml so tests work
|
||||
- Update/Remove the platforms we test against
|
||||
- Fix support for pinentry_mode on Ubuntu 16.04
|
||||
|
||||
## 1.1.0 (2020-05-14)
|
||||
|
||||
- resolved cookstyle error: resources/install.rb:1:36 convention: `Layout/TrailingWhitespace`
|
||||
- resolved cookstyle error: resources/install.rb:1:37 refactor: `ChefModernize/FoodcriticComments`
|
||||
|
||||
## 1.0.1 (2020-01-26)
|
||||
|
||||
- Use Github Actions for testing
|
||||
- Fix Ubuntu platform checks in the `gpg_key` resource
|
||||
- Use true/false in the resource to simplify the types
|
||||
|
||||
## 1.0.0 (2019-01-26)
|
||||
|
||||
- Adds two new resources `gpg_install` and `gpg_key`
|
||||
- Use CircleCI for testing
|
||||
|
||||
## 0.3.0 (2018-05-08)
|
||||
|
||||
- Sous Chefs will now be maintaining this cookbook. For more information on Sous Chefs see <http://sous-chefs.org/>
|
||||
- This cookbook now requires Chef 12 or later
|
||||
- Added a chefignore file
|
||||
- Added local testing with delivery local mode
|
||||
- Added Code of conduct, testing, contributing, license, and changelog files
|
||||
- Added `chef_version`, `source_url`, and `issues_url` to the metadata
|
||||
- Added ubuntu/debian to the metadata as supported platforms
|
||||
- Updated the kitchen config to use Vagrant on common platforms
|
||||
- Resolved all cookstyle / foodcritic warnings
|
||||
@@ -1,202 +0,0 @@
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "{}"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright {yyyy} {name of copyright owner}
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
||||
@@ -1,63 +0,0 @@
|
||||
# GPG cookbook
|
||||
|
||||
[](https://supermarket.chef.io/cookbooks/gpg)
|
||||
[](https://circleci.com/gh/sous-chefs/gpg)
|
||||
[](#backers)
|
||||
[](#sponsors)
|
||||
[](https://opensource.org/licenses/Apache-2.0)
|
||||
|
||||
Installs and configures GPG on a system
|
||||
|
||||
## Maintainers
|
||||
|
||||
This cookbook is maintained by the Sous Chefs. The Sous Chefs are a community of Chef cookbook maintainers working together to maintain important cookbooks. If you’d like to know more please visit [sous-chefs.org](https://sous-chefs.org/) or come chat with us on the Chef Community Slack in [#sous-chefs](https://chefcommunity.slack.com/messages/C2V7B88SF).
|
||||
|
||||
## Custom resources
|
||||
|
||||
This cookboks uses custom resources to control GPG2.
|
||||
|
||||
Install GPG2 and haveged
|
||||
|
||||
```ruby
|
||||
gpg_install
|
||||
```
|
||||
|
||||
Generate a GPG key for a user
|
||||
|
||||
```ruby
|
||||
gpg_key 'foo' do
|
||||
user 'foo'
|
||||
passphrase 'this-is-not-secure'
|
||||
end
|
||||
```
|
||||
|
||||
For further detail please see the documentation for each resource, or the test cookbook for example usage.
|
||||
|
||||
- [gpg_install](https://github.com/sous-chefs/gpg/blob/master/documentation/resource/install.md)
|
||||
- [gpg_key](https://github.com/sous-chefs/gpg/blob/master/documentation/resource/key.md)
|
||||
- [Test Cookbook](https://github.com/sous-chefs/gpg/blob/master/test/fixtures/cookbooks/test/recipes)
|
||||
|
||||
## Contributors
|
||||
|
||||
This project exists thanks to all the people who [contribute.](https://opencollective.com/sous-chefs/contributors.svg?width=890&button=false)
|
||||
|
||||
### Backers
|
||||
|
||||
Thank you to all our backers!
|
||||
|
||||
|
||||
|
||||
### Sponsors
|
||||
|
||||
Support this project by becoming a sponsor. Your logo will show up here with a link to your website.
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,115 +0,0 @@
|
||||
# Put files/directories that should be ignored in this file when uploading
|
||||
# to a Chef Infra Server or Supermarket.
|
||||
# Lines that start with '# ' are comments.
|
||||
|
||||
# OS generated files #
|
||||
######################
|
||||
.DS_Store
|
||||
ehthumbs.db
|
||||
Icon?
|
||||
nohup.out
|
||||
Thumbs.db
|
||||
.envrc
|
||||
|
||||
# EDITORS #
|
||||
###########
|
||||
.#*
|
||||
.project
|
||||
.settings
|
||||
*_flymake
|
||||
*_flymake.*
|
||||
*.bak
|
||||
*.sw[a-z]
|
||||
*.tmproj
|
||||
*~
|
||||
\#*
|
||||
REVISION
|
||||
TAGS*
|
||||
tmtags
|
||||
.vscode
|
||||
.editorconfig
|
||||
|
||||
## COMPILED ##
|
||||
##############
|
||||
*.class
|
||||
*.com
|
||||
*.dll
|
||||
*.exe
|
||||
*.o
|
||||
*.pyc
|
||||
*.so
|
||||
*/rdoc/
|
||||
a.out
|
||||
mkmf.log
|
||||
|
||||
# Testing #
|
||||
###########
|
||||
.circleci/*
|
||||
.codeclimate.yml
|
||||
.delivery/*
|
||||
.foodcritic
|
||||
.kitchen*
|
||||
.mdlrc
|
||||
.overcommit.yml
|
||||
.rspec
|
||||
.rubocop.yml
|
||||
.travis.yml
|
||||
.watchr
|
||||
.yamllint
|
||||
azure-pipelines.yml
|
||||
Dangerfile
|
||||
examples/*
|
||||
features/*
|
||||
Guardfile
|
||||
kitchen*.yml
|
||||
mlc_config.json
|
||||
Procfile
|
||||
Rakefile
|
||||
spec/*
|
||||
test/*
|
||||
|
||||
# SCM #
|
||||
#######
|
||||
.git
|
||||
.gitattributes
|
||||
.gitconfig
|
||||
.github/*
|
||||
.gitignore
|
||||
.gitkeep
|
||||
.gitmodules
|
||||
.svn
|
||||
*/.bzr/*
|
||||
*/.git
|
||||
*/.hg/*
|
||||
*/.svn/*
|
||||
|
||||
# Berkshelf #
|
||||
#############
|
||||
Berksfile
|
||||
Berksfile.lock
|
||||
cookbooks/*
|
||||
tmp
|
||||
|
||||
# Bundler #
|
||||
###########
|
||||
vendor/*
|
||||
Gemfile
|
||||
Gemfile.lock
|
||||
|
||||
# Policyfile #
|
||||
##############
|
||||
Policyfile.rb
|
||||
Policyfile.lock.json
|
||||
|
||||
# Documentation #
|
||||
#############
|
||||
CODE_OF_CONDUCT*
|
||||
CONTRIBUTING*
|
||||
documentation/*
|
||||
TESTING*
|
||||
UPGRADING*
|
||||
|
||||
# Vagrant #
|
||||
###########
|
||||
.vagrant
|
||||
Vagrantfile
|
||||
@@ -1,43 +0,0 @@
|
||||
module Gpg
|
||||
module Helpers
|
||||
include Chef::Mixin::ShellOut
|
||||
|
||||
def key_exists(new_resource)
|
||||
gpg_check = gpg_cmd
|
||||
gpg_check << gpg_opts if new_resource.override_default_keyring
|
||||
gpg_check << "--list-keys | grep '#{new_resource.name_real}'"
|
||||
|
||||
cmd = Mixlib::ShellOut.new(
|
||||
gpg_check,
|
||||
user: new_resource.user,
|
||||
group: new_resource.group
|
||||
)
|
||||
|
||||
cmd.run_command
|
||||
|
||||
cmd.exitstatus == 0
|
||||
end
|
||||
|
||||
def gpg_opts(new_resource)
|
||||
if new_resource.override_default_keyring
|
||||
"--no-default-keyring --secret-keyring #{new_resource.secring_file} --keyring #{new_resource.pubring_file}"
|
||||
else
|
||||
false
|
||||
end
|
||||
end
|
||||
|
||||
def gpg_cmd
|
||||
"gpg2 --homedir #{new_resource.home_dir} "
|
||||
end
|
||||
|
||||
def gpg2_packages
|
||||
packages = %w(haveged)
|
||||
if platform_family?('suse')
|
||||
packages.push('gpg2')
|
||||
else
|
||||
packages.push('gnupg2')
|
||||
end
|
||||
packages
|
||||
end
|
||||
end
|
||||
end
|
||||
@@ -1,43 +0,0 @@
|
||||
{
|
||||
"name": "gpg",
|
||||
"description": "Installs/Configures gpg",
|
||||
"long_description": "",
|
||||
"maintainer": "Sous Chefs",
|
||||
"maintainer_email": "help@sous-chefs.org",
|
||||
"license": "Apache-2.0",
|
||||
"platforms": {
|
||||
"debian": ">= 0.0.0",
|
||||
"ubuntu": ">= 0.0.0",
|
||||
"centos": ">= 0.0.0",
|
||||
"redhat": ">= 0.0.0",
|
||||
"oracle": ">= 0.0.0",
|
||||
"amazon": ">= 0.0.0",
|
||||
"opensuse": ">= 0.0.0",
|
||||
"suse": ">= 0.0.0"
|
||||
},
|
||||
"dependencies": {
|
||||
"yum-epel": ">= 0.0.0"
|
||||
},
|
||||
"providing": {
|
||||
|
||||
},
|
||||
"recipes": {
|
||||
|
||||
},
|
||||
"version": "2.0.13",
|
||||
"source_url": "https://github.com/sous-chefs/gpg",
|
||||
"issues_url": "https://github.com/sous-chefs/gpg/issues",
|
||||
"privacy": false,
|
||||
"chef_versions": [
|
||||
[
|
||||
">= 15.3"
|
||||
]
|
||||
],
|
||||
"ohai_versions": [
|
||||
|
||||
],
|
||||
"gems": [
|
||||
|
||||
],
|
||||
"eager_load_libraries": true
|
||||
}
|
||||
@@ -1,20 +0,0 @@
|
||||
name 'gpg'
|
||||
maintainer 'Sous Chefs'
|
||||
maintainer_email 'help@sous-chefs.org'
|
||||
license 'Apache-2.0'
|
||||
description 'Installs/Configures gpg'
|
||||
source_url 'https://github.com/sous-chefs/gpg'
|
||||
issues_url 'https://github.com/sous-chefs/gpg/issues'
|
||||
version '2.0.13'
|
||||
chef_version '>= 15.3'
|
||||
|
||||
depends 'yum-epel'
|
||||
|
||||
supports 'debian'
|
||||
supports 'ubuntu'
|
||||
supports 'centos'
|
||||
supports 'redhat'
|
||||
supports 'oracle'
|
||||
supports 'amazon'
|
||||
supports 'opensuse'
|
||||
supports 'suse'
|
||||
@@ -1,18 +0,0 @@
|
||||
{
|
||||
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
|
||||
"extends": ["config:base"],
|
||||
"packageRules": [
|
||||
{
|
||||
"groupName": "Actions",
|
||||
"matchUpdateTypes": ["minor", "patch", "pin"],
|
||||
"automerge": true,
|
||||
"addLabels": ["Release: Patch", "Skip: Announcements"]
|
||||
},
|
||||
{
|
||||
"groupName": "Actions",
|
||||
"matchUpdateTypes": ["major"],
|
||||
"automerge": false,
|
||||
"addLabels": ["Release: Patch", "Skip: Announcements"]
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
unified_mode true
|
||||
|
||||
property :name, String, default: ''
|
||||
|
||||
action :install do
|
||||
include_recipe 'yum-epel' if platform_family?('rhel', 'amazon')
|
||||
|
||||
package gpg2_packages
|
||||
|
||||
service 'haveged' do
|
||||
supports [:status, :restart]
|
||||
action :start
|
||||
end
|
||||
end
|
||||
|
||||
action_class do
|
||||
include Gpg::Helpers
|
||||
end
|
||||
@@ -1,166 +0,0 @@
|
||||
unified_mode true
|
||||
|
||||
property :batch_name, String,
|
||||
name_property: true,
|
||||
description: 'Name of the key/batch to generate.'
|
||||
|
||||
property :override_default_keyring, [true, false],
|
||||
default: false,
|
||||
description: 'Set to true if you want to override the pubring_file and secring_file locations.'
|
||||
|
||||
property :pubring_file, String,
|
||||
description: 'Public keyring file location (override_default_keyring must be set to true or this option will be ignored)'
|
||||
|
||||
property :secring_file, String,
|
||||
description: 'Secret keyring file location (override_default_keyring must be set to true or this option will be ignored)'
|
||||
|
||||
property :user, String,
|
||||
default: 'root',
|
||||
description: 'User to generate the key for'
|
||||
|
||||
property :group, String,
|
||||
default: lazy { user },
|
||||
description: 'Group to run the generate command as'
|
||||
|
||||
property :key_type, String,
|
||||
default: '1', equal_to: %w(RSA 1 DSA 17 ),
|
||||
description: 'Corresponds to GPG option: Key-Type (RSA or DSA)'
|
||||
|
||||
property :key_length, String,
|
||||
default: '2048', equal_to: %w( 2048 4096 ),
|
||||
description: 'Corresponds to GPG option: Key-Length (2048 or 4096)'
|
||||
|
||||
property :name_real, String,
|
||||
default: lazy { "Chef Generated Default (#{batch_name})" },
|
||||
description: 'Corresponds to GPG option: Name-Real'
|
||||
|
||||
property :name_comment, String,
|
||||
default: 'generated by Chef',
|
||||
description: 'Corresponds to GPG option: Name-Comment'
|
||||
|
||||
property :name_email, String,
|
||||
default: lazy { "#{node.name}@example.com" },
|
||||
description: 'Corresponds to GPG option: Name-Email'
|
||||
|
||||
property :expire_date, String,
|
||||
default: '0',
|
||||
description: 'Corresponds to GPG option: Expire-Date. Defaults to 0 (no expiry)'
|
||||
|
||||
property :home_dir, String,
|
||||
default: lazy { ::File.expand_path("~#{user}/.gnupg") },
|
||||
description: 'Location to store the keyring. Defaults to ~/.gnupg'
|
||||
|
||||
property :batch_config_file, String,
|
||||
default: lazy { ::File.join(home_dir, "gpg_batch_config_#{batch_name}") },
|
||||
description: 'Batch config file name'
|
||||
|
||||
property :passphrase, String,
|
||||
sensitive: true,
|
||||
description: 'Passphrase for key'
|
||||
|
||||
property :key_file, String,
|
||||
description: 'Keyfile name'
|
||||
|
||||
property :key_fingerprint, String,
|
||||
description: 'Key finger print. Used to identify when deleting keys using the :delete action'
|
||||
|
||||
# Only Ubuntu > 16.04 supports the pinetree_mode. And requires it
|
||||
property :pinentry_mode, [String, FalseClass],
|
||||
default: platform?('ubuntu') && node['platform_version'].to_f > 16.04 ? 'loopback' : false,
|
||||
description: 'Pinentry mode. Set to loopback on Ubuntu and False (off) for all other platforms.'
|
||||
|
||||
property :batch, [true, false],
|
||||
default: true,
|
||||
description: 'Turn batch mode on or off when genrating keys'
|
||||
|
||||
action :generate do
|
||||
unless key_exists(new_resource)
|
||||
|
||||
config_dir = ::File.dirname(new_resource.batch_config_file)
|
||||
|
||||
directory config_dir do
|
||||
owner new_resource.user
|
||||
mode '0700'
|
||||
recursive true
|
||||
not_if { ::Dir.exist?(config_dir) }
|
||||
end
|
||||
|
||||
file new_resource.batch_config_file do
|
||||
content <<~EOS
|
||||
Key-Type: #{new_resource.key_type}
|
||||
Key-Length: #{new_resource.key_length}
|
||||
Name-Real: #{new_resource.name_real}
|
||||
Name-Comment: #{new_resource.name_comment}
|
||||
Name-Email: #{new_resource.name_email}
|
||||
Expire-Date: #{new_resource.expire_date}
|
||||
EOS
|
||||
|
||||
if new_resource.override_default_keyring
|
||||
content << "%pubring #{new_resource.pubring_file}\n"
|
||||
content << "%secring #{new_resource.secring_file}\n"
|
||||
end
|
||||
|
||||
content << "Passphrase: #{new_resource.passphrase}" if new_resource.passphrase
|
||||
content << "%commit\n"
|
||||
mode '0600'
|
||||
owner new_resource.user
|
||||
sensitive true
|
||||
end
|
||||
|
||||
cmd = gpg_cmd
|
||||
cmd << gpg_opts(new_resource) if new_resource.override_default_keyring
|
||||
cmd << " --passphrase #{new_resource.passphrase}"
|
||||
cmd << ' --yes'
|
||||
cmd << ' --batch' if new_resource.batch
|
||||
cmd << ' --pinentry-mode loopback' if new_resource.pinentry_mode
|
||||
cmd << " --gen-key #{new_resource.batch_config_file}"
|
||||
|
||||
execute 'gpg2: generate' do
|
||||
command cmd
|
||||
live_stream true
|
||||
user new_resource.user
|
||||
group new_resource.group
|
||||
end
|
||||
|
||||
end
|
||||
end
|
||||
|
||||
action :import do
|
||||
execute 'gpg2: import key' do
|
||||
command "#{gpg_cmd} --import #{new_resource.key_file}"
|
||||
user new_resource.user
|
||||
group new_resource.group
|
||||
not_if { key_exists(new_resource) }
|
||||
end
|
||||
end
|
||||
|
||||
action :export do
|
||||
execute 'gpg2: export key' do
|
||||
command "#{gpg_cmd} --export -a \"#{new_resource.name_real}\" > #{new_resource.key_file}"
|
||||
user new_resource.user
|
||||
group new_resource.group
|
||||
not_if { ::File.exist?(new_resource.key_file) }
|
||||
end
|
||||
end
|
||||
|
||||
action :delete_public_key do
|
||||
execute 'gpg2: delete key' do
|
||||
command "#{gpg_cmd} --batch --yes --delete-key \"#{new_resource.key_fingerprint}\""
|
||||
user new_resource.user
|
||||
group new_resource.group
|
||||
only_if { key_exists(new_resource) }
|
||||
end
|
||||
end
|
||||
|
||||
action :delete_secret_keys do
|
||||
execute 'gpg2: delete key' do
|
||||
command "#{gpg_cmd} --batch --yes --delete-secret-keys \"#{new_resource.key_fingerprint}\""
|
||||
user new_resource.user
|
||||
group new_resource.group
|
||||
only_if { key_exists(new_resource) }
|
||||
end
|
||||
end
|
||||
|
||||
action_class do
|
||||
include Gpg::Helpers
|
||||
end
|
||||
@@ -1,30 +1,9 @@
|
||||
{
|
||||
"id": "dirsrv",
|
||||
"admin_dn": {
|
||||
"encrypted_data": "zRtz6Scb9WtUXGyjc0xyvsre0YvqupuaFz+RPApj7DEQTmYyZPVb\n",
|
||||
"iv": "xfIXMhEBHBWqa4Dz\n",
|
||||
"auth_tag": "BcA32u1njcnCZ+yrBGSceQ==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"admin_password": {
|
||||
"encrypted_data": "7JpXl3JZDqKWDfYt/wuNbkbob+oRuONhkuAlpqUCCEIn+tY=\n",
|
||||
"iv": "Lcwc4NDzrfcBaIKQ\n",
|
||||
"auth_tag": "rrePS3Bhdnwbr2d/o8vMhg==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"service_dn": {
|
||||
"encrypted_data": "sqRFiZreLeTPQljSfhAuV3DmsPxSC8tzWjCdu+WSSbO67sBQA+xhmGtzBhBD\nDZPGJw+jtAxzuVvPdAjxgAVgxXO6C6WEo87L1tdJewE=\n",
|
||||
"iv": "GUEGtyRJXrPhWcUs\n",
|
||||
"auth_tag": "2USsrx//3V7RCyumGCbMkg==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
},
|
||||
"service_password": {
|
||||
"encrypted_data": "f2wi8B8SEt6p5G0TF3dZ72j0vMFlvwcP1suxYnshBA==\n",
|
||||
"iv": "rOnUoxbnkaJtodM+\n",
|
||||
"auth_tag": "dVLCtBVMjxLfW2D8XjJBdQ==\n",
|
||||
"encrypted_data": "i71l5E129mXCcDAyME8sNMUkYUlQMgt7Eh6noyFcLNgbaMo=\n",
|
||||
"iv": "KNW2B8tpX7ywZwbg\n",
|
||||
"auth_tag": "GawQ+FSlA5v5YVyryeUxng==\n",
|
||||
"version": 3,
|
||||
"cipher": "aes-256-gcm"
|
||||
}
|
||||
|
||||
@@ -14,8 +14,7 @@
|
||||
"public_key": "024cd3be18617f39cf645851e3ba63f51fc13f0bb09e3bb25e6fd4de556486d946"
|
||||
},
|
||||
"nostr": {
|
||||
"public_key": "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a",
|
||||
"relay_url": "wss://nostr.kosmos.org"
|
||||
"public_key": "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a"
|
||||
}
|
||||
},
|
||||
"discourse": {
|
||||
@@ -102,20 +101,6 @@
|
||||
},
|
||||
"sentry": {
|
||||
"allowed_ips": "10.1.1.0/24"
|
||||
},
|
||||
"strfry": {
|
||||
"domain": "nostr.kosmos.org",
|
||||
"real_ip_header": "x-real-ip",
|
||||
"policy_path": "/opt/strfry/strfry-policy.ts",
|
||||
"whitelist_pubkeys": [
|
||||
"b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a"
|
||||
],
|
||||
"info": {
|
||||
"name": "Kosmos Relay",
|
||||
"description": "Members-only nostr relay for kosmos.org users",
|
||||
"pubkey": "1f79058c77a224e5be226c8f024cacdad4d741855d75ed9f11473ba8eb86e1cb",
|
||||
"contact": "ops@kosmos.org"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -54,10 +54,8 @@
|
||||
"kosmos_liquor-cabinet::nginx",
|
||||
"kosmos_rsk::nginx_testnet",
|
||||
"kosmos_rsk::nginx_mainnet",
|
||||
"kosmos_strfry::nginx",
|
||||
"kosmos_website",
|
||||
"kosmos_website::default",
|
||||
"kosmos_website::redirects",
|
||||
"kosmos-akkounts::nginx",
|
||||
"kosmos-akkounts::nginx_api",
|
||||
"kosmos-bitcoin::nginx_lndhub",
|
||||
|
||||
@@ -48,10 +48,8 @@
|
||||
"kosmos_liquor-cabinet::nginx",
|
||||
"kosmos_rsk::nginx_testnet",
|
||||
"kosmos_rsk::nginx_mainnet",
|
||||
"kosmos_strfry::nginx",
|
||||
"kosmos_website",
|
||||
"kosmos_website::default",
|
||||
"kosmos_website::redirects",
|
||||
"kosmos-akkounts::nginx",
|
||||
"kosmos-akkounts::nginx_api",
|
||||
"kosmos-bitcoin::nginx_lndhub",
|
||||
|
||||
@@ -1,66 +0,0 @@
|
||||
{
|
||||
"name": "strfry-1",
|
||||
"chef_environment": "production",
|
||||
"normal": {
|
||||
"knife_zero": {
|
||||
"host": "10.1.1.164"
|
||||
}
|
||||
},
|
||||
"automatic": {
|
||||
"fqdn": "strfry-1",
|
||||
"os": "linux",
|
||||
"os_version": "5.15.0-1060-kvm",
|
||||
"hostname": "strfry-1",
|
||||
"ipaddress": "192.168.122.54",
|
||||
"roles": [
|
||||
"base",
|
||||
"kvm_guest",
|
||||
"strfry",
|
||||
"ldap_client"
|
||||
],
|
||||
"recipes": [
|
||||
"kosmos-base",
|
||||
"kosmos-base::default",
|
||||
"kosmos_kvm::guest",
|
||||
"kosmos-dirsrv::hostsfile",
|
||||
"strfry",
|
||||
"strfry::default",
|
||||
"kosmos_strfry::policies",
|
||||
"kosmos_strfry::firewall",
|
||||
"apt::default",
|
||||
"timezone_iii::default",
|
||||
"timezone_iii::debian",
|
||||
"ntp::default",
|
||||
"ntp::apparmor",
|
||||
"kosmos-base::systemd_emails",
|
||||
"apt::unattended-upgrades",
|
||||
"kosmos-base::firewall",
|
||||
"kosmos-postfix::default",
|
||||
"postfix::default",
|
||||
"postfix::_common",
|
||||
"postfix::_attributes",
|
||||
"postfix::sasl_auth",
|
||||
"hostname::default",
|
||||
"deno::default"
|
||||
],
|
||||
"platform": "ubuntu",
|
||||
"platform_version": "22.04",
|
||||
"cloud": null,
|
||||
"chef_packages": {
|
||||
"chef": {
|
||||
"version": "18.4.12",
|
||||
"chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.4.12/lib",
|
||||
"chef_effortless": null
|
||||
},
|
||||
"ohai": {
|
||||
"version": "18.1.11",
|
||||
"ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
|
||||
}
|
||||
}
|
||||
},
|
||||
"run_list": [
|
||||
"role[base]",
|
||||
"role[kvm_guest]",
|
||||
"role[strfry]"
|
||||
]
|
||||
}
|
||||
@@ -28,9 +28,7 @@ production_run_list = %w(
|
||||
kosmos_liquor-cabinet::nginx
|
||||
kosmos_rsk::nginx_testnet
|
||||
kosmos_rsk::nginx_mainnet
|
||||
kosmos_strfry::nginx
|
||||
kosmos_website::default
|
||||
kosmos_website::redirects
|
||||
kosmos-akkounts::nginx
|
||||
kosmos-akkounts::nginx_api
|
||||
kosmos-bitcoin::nginx_lndhub
|
||||
|
||||
@@ -1,8 +0,0 @@
|
||||
name "strfry"
|
||||
|
||||
run_list %w(
|
||||
role[ldap_client]
|
||||
strfry::default
|
||||
kosmos_strfry::policies
|
||||
kosmos_strfry::firewall
|
||||
)
|
||||
Submodule site-cookbooks/deno deleted from 617f7959ab
@@ -22,7 +22,6 @@ node.default['akkounts']['lndhub']['public_key'] = nil
|
||||
node.default['akkounts']['lndhub']['postgres_db'] = 'lndhub'
|
||||
|
||||
node.default['akkounts']['nostr']['public_key'] = nil
|
||||
node.default['akkounts']['nostr']['relay_url'] = nil
|
||||
|
||||
node.default['akkounts']['s3_enabled'] = true
|
||||
node.default['akkounts']['s3_endpoint'] = "https://s3.kosmos.org"
|
||||
|
||||
@@ -163,7 +163,6 @@ env[:mediawiki_public_url] = node['mediawiki']['url']
|
||||
|
||||
env[:nostr_private_key] = credentials['nostr_private_key']
|
||||
env[:nostr_public_key] = node['akkounts']['nostr']['public_key']
|
||||
env[:nostr_relay_url] = node['akkounts']['nostr']['relay_url']
|
||||
|
||||
#
|
||||
# remoteStorage / Liquor Cabinet
|
||||
|
||||
@@ -28,9 +28,7 @@ template "#{node['openresty']['dir']}/snippets/mastodon.conf" do
|
||||
owner 'www-data'
|
||||
mode 0640
|
||||
variables web_root_dir: web_root_dir,
|
||||
server_name: server_name,
|
||||
s3_private_url: "#{node["kosmos-mastodon"]["s3_endpoint"]}/#{node["kosmos-mastodon"]["s3_bucket"]}/",
|
||||
s3_public_url: "https://#{node["kosmos-mastodon"]["s3_alias_host"]}/"
|
||||
server_name: server_name
|
||||
notifies :reload, 'service[openresty]', :delayed
|
||||
end
|
||||
|
||||
|
||||
@@ -108,13 +108,11 @@ location @proxy {
|
||||
|
||||
proxy_pass http://mastodon_app;
|
||||
proxy_buffering on;
|
||||
proxy_redirect off;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection $connection_upgrade;
|
||||
|
||||
# https://github.com/mastodon/mastodon/issues/24380
|
||||
proxy_redirect <%= @s3_private_url %> <%= @s3_public_url %>;
|
||||
|
||||
tcp_nodelay on;
|
||||
}
|
||||
|
||||
|
||||
@@ -4,11 +4,6 @@ node.default["gitea"]["working_directory"] = "/var/lib/gitea"
|
||||
node.default["gitea"]["port"] = 3000
|
||||
node.default["gitea"]["postgresql_host"] = "localhost:5432"
|
||||
node.default["gitea"]["domain"] = "gitea.kosmos.org"
|
||||
node.default["gitea"]["commit_signing"] = {
|
||||
"name_real" => "Gitea",
|
||||
"name_comment" => "commit signing",
|
||||
"name_email" => "git@#{node["gitea"]["domain"]}"
|
||||
}
|
||||
|
||||
node.default["gitea"]["config"] = {
|
||||
"actions": {
|
||||
|
||||
@@ -8,7 +8,6 @@ version '0.2.0'
|
||||
chef_version '>= 14.0'
|
||||
|
||||
depends "firewall"
|
||||
depends "gpg"
|
||||
depends "kosmos_openresty"
|
||||
depends "kosmos_postgresql"
|
||||
depends "backup"
|
||||
|
||||
@@ -77,22 +77,6 @@ if node.chef_environment == "production"
|
||||
}
|
||||
end
|
||||
|
||||
if node["gitea"]["commit_signing"]
|
||||
gpg_install
|
||||
|
||||
gpg_key "git" do
|
||||
user "git"
|
||||
group "git"
|
||||
name_real node["gitea"]["commit_signing"]["name_real"]
|
||||
name_comment node["gitea"]["commit_signing"]["name_comment"]
|
||||
name_email node["gitea"]["commit_signing"]["name_email"]
|
||||
end
|
||||
|
||||
execute "enable git commit signing for all repositories" do
|
||||
command "su - git -c 'git config --global commit.gpgsign true'"
|
||||
end
|
||||
end
|
||||
|
||||
config_variables = {
|
||||
working_directory: working_directory,
|
||||
git_home_directory: git_home_directory,
|
||||
@@ -109,7 +93,6 @@ config_variables = {
|
||||
smtp_user: smtp_credentials["user_name"],
|
||||
smtp_password: smtp_credentials["password"],
|
||||
config: node["gitea"]["config"],
|
||||
commit_signing: node["gitea"]["commit_signing"],
|
||||
s3_key_id: gitea_data_bag_item["s3_key_id"],
|
||||
s3_secret_key: gitea_data_bag_item["s3_secret_key"],
|
||||
s3_bucket: gitea_data_bag_item["s3_bucket"]
|
||||
|
||||
@@ -28,15 +28,6 @@ SSL_MODE = disable
|
||||
[repository]
|
||||
ROOT = <%= @repository_root_directory %>
|
||||
|
||||
<% if @commit_signing %>
|
||||
[repository.signing]
|
||||
SIGNING_KEY = default
|
||||
INITIAL_COMMIT = always
|
||||
CRUD_ACTIONS = always
|
||||
MERGES = always
|
||||
WIKI = never
|
||||
<% end %>
|
||||
|
||||
# [indexer]
|
||||
# ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
|
||||
|
||||
|
||||
@@ -21,13 +21,8 @@ server {
|
||||
location ~ ^/(avatars|repo-avatars)/.*$ {
|
||||
proxy_buffers 1024 8k;
|
||||
proxy_pass http://_gitea_web;
|
||||
proxy_http_version 1.1;
|
||||
expires 30d;
|
||||
proxy_set_header Connection $http_connection;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
|
||||
# Docker registry
|
||||
@@ -35,22 +30,12 @@ server {
|
||||
client_max_body_size 0;
|
||||
proxy_buffers 1024 8k;
|
||||
proxy_pass http://_gitea_web;
|
||||
proxy_set_header Connection $http_connection;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_http_version 1.1;
|
||||
}
|
||||
|
||||
location / {
|
||||
proxy_buffers 1024 8k;
|
||||
proxy_pass http://_gitea_web;
|
||||
proxy_set_header Connection $http_connection;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_http_version 1.1;
|
||||
}
|
||||
}
|
||||
|
||||
@@ -1,10 +1,9 @@
|
||||
release = "20240514"
|
||||
img_filename = "ubuntu-22.04-server-cloudimg-amd64-disk-kvm"
|
||||
ubuntu_server_cloud_image_release = "20231026"
|
||||
|
||||
node.default["kosmos_kvm"]["host"]["qemu_base_image"] = {
|
||||
"url" => "https://cloud-images.ubuntu.com/releases/jammy/release-#{release}/#{img_filename}.img",
|
||||
"checksum" => "2e7698b3ebd7caead06b08bd3ece241e6ce294a6db01f92ea12bcb56d6972c3f",
|
||||
"path" => "/var/lib/libvirt/images/base/#{img_filename}-#{release}.qcow2"
|
||||
"url" => "https://cloud-images.ubuntu.com/releases/jammy/release-#{ubuntu_server_cloud_image_release}/ubuntu-22.04-server-cloudimg-amd64-disk-kvm.img",
|
||||
"checksum" => "b5d1f937341fbb3afb50d28c4a17f41419df4d87a96d5e737a39b6cb42e1dff3",
|
||||
"path" => "/var/lib/libvirt/images/base/ubuntu-22.04-server-cloudimg-amd64-disk-kvm-#{ubuntu_server_cloud_image_release}.qcow2"
|
||||
}
|
||||
|
||||
# A systemd.timer OnCalendar config value
|
||||
|
||||
@@ -17,7 +17,7 @@ DISKSIZE=${4:-10} # 10GB default
|
||||
# Directory where image files will be stored
|
||||
IMAGE_DIR=/var/lib/libvirt/images
|
||||
IMAGE_PATH=$IMAGE_DIR/${VMNAME}.qcow2
|
||||
CIDATA_PATH=${IMAGE_DIR}/cidata-${VMNAME}.iso
|
||||
CIDATA_PATH=${IMAGE_DIR}/${VMNAME}-cloudinit
|
||||
BASE_FILE=<%= @base_image_path %>
|
||||
|
||||
# Create the VM image if it does not already exist
|
||||
@@ -38,9 +38,8 @@ qemu-img info "$IMAGE_PATH"
|
||||
# Check if the cloud-init metadata file exists
|
||||
# if not, generate it
|
||||
if [ ! -r $CIDATA_PATH ]; then
|
||||
pushd $(dirname $CIDATA_PATH)
|
||||
mkdir -p $VMNAME
|
||||
cd $VMNAME
|
||||
mkdir -p $CIDATA_PATH
|
||||
pushd $CIDATA_PATH
|
||||
|
||||
cat > user-data <<-EOS
|
||||
#cloud-config
|
||||
@@ -62,25 +61,19 @@ instance-id: $VMNAME
|
||||
local-hostname: $VMNAME
|
||||
EOS
|
||||
|
||||
genisoimage -output "$CIDATA_PATH" -volid cidata -joliet -rock user-data meta-data
|
||||
chown libvirt-qemu:kvm "$CIDATA_PATH"
|
||||
chmod 600 "$CIDATA_PATH"
|
||||
popd
|
||||
fi
|
||||
|
||||
# setting --os-variant to ubuntu20.04 and ubuntu18.04 breaks SSH and networking
|
||||
virt-install \
|
||||
--name "$VMNAME" \
|
||||
--ram "$RAM" \
|
||||
--vcpus "$CPUS" \
|
||||
--cpu host \
|
||||
--arch x86_64 \
|
||||
--os-type linux \
|
||||
--os-variant ubuntu16.04 \
|
||||
--osinfo detect=on,name=ubuntujammy \
|
||||
--hvm \
|
||||
--virt-type kvm \
|
||||
--disk "$IMAGE_PATH" \
|
||||
--cdrom "$CIDATA_PATH" \
|
||||
--boot hd \
|
||||
--network=bridge=virbr0,model=virtio \
|
||||
--graphics none \
|
||||
@@ -88,4 +81,5 @@ virt-install \
|
||||
--console pty \
|
||||
--channel unix,mode=bind,path=/var/lib/libvirt/qemu/$VMNAME.guest_agent.0,target_type=virtio,name=org.qemu.guest_agent.0 \
|
||||
--autostart \
|
||||
--import
|
||||
--import \
|
||||
--cloud-init root-password-generate=off,disable=on,meta-data=$CIDATA_PATH/meta-data,user-data=$CIDATA_PATH/user-data
|
||||
|
||||
@@ -1,20 +0,0 @@
|
||||
Copyright (c) 2024 Kosmos Developers
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining
|
||||
a copy of this software and associated documentation files (the
|
||||
"Software"), to deal in the Software without restriction, including
|
||||
without limitation the rights to use, copy, modify, merge, publish,
|
||||
distribute, sublicense, and/or sell copies of the Software, and to
|
||||
permit persons to whom the Software is furnished to do so, subject to
|
||||
the following conditions:
|
||||
|
||||
The above copyright notice and this permission notice shall be
|
||||
included in all copies or substantial portions of the Software.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
|
||||
NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
|
||||
LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
|
||||
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
|
||||
WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
@@ -1,4 +0,0 @@
|
||||
kosmos_strfry
|
||||
=============
|
||||
|
||||
Installs/configures a strfry relay and its reverse proxy config
|
||||
@@ -1,2 +0,0 @@
|
||||
node.default["strfry"]["ldap_search_dn"] = "ou=kosmos.org,cn=users,dc=kosmos,dc=org"
|
||||
node.default["strfry"]["extras_dir"] = "/opt/strfry"
|
||||
@@ -1,10 +0,0 @@
|
||||
name 'kosmos_strfry'
|
||||
maintainer 'Kosmos'
|
||||
maintainer_email 'mail@kosmos.org'
|
||||
license 'MIT'
|
||||
description 'strfry wrapper cookbook'
|
||||
long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
|
||||
version '0.1.0'
|
||||
|
||||
depends 'kosmos_openresty'
|
||||
depends 'deno'
|
||||
@@ -1,13 +0,0 @@
|
||||
#
|
||||
# Cookbook Name:: kosmos_strfry
|
||||
# Recipe:: firewall
|
||||
#
|
||||
|
||||
include_recipe "kosmos-base::firewall"
|
||||
|
||||
firewall_rule "strfry" do
|
||||
port node["strfry"]["port"]
|
||||
source "10.1.1.0/24"
|
||||
protocol :tcp
|
||||
command :allow
|
||||
end
|
||||
@@ -1,29 +0,0 @@
|
||||
#
|
||||
# Cookbook Name:: kosmos_strfry
|
||||
# Recipe:: nginx
|
||||
#
|
||||
|
||||
domain = node["strfry"]["domain"]
|
||||
|
||||
upstream_hosts = []
|
||||
search(:node, 'role:strfry').each do |node|
|
||||
upstream_hosts << node['knife_zero']['host']
|
||||
end
|
||||
if upstream_hosts.empty?
|
||||
Chef::Log.warn("No node found with 'strfry' role. Not configuring nginx site.")
|
||||
return
|
||||
end
|
||||
|
||||
tls_cert_for domain do
|
||||
auth "gandi_dns"
|
||||
action :create
|
||||
end
|
||||
|
||||
openresty_site domain do
|
||||
template "nginx_conf_strfry.erb"
|
||||
variables domain: domain,
|
||||
upstream_port: node['strfry']['port'],
|
||||
upstream_hosts: upstream_hosts,
|
||||
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
|
||||
end
|
||||
@@ -1,83 +0,0 @@
|
||||
#
|
||||
# Cookbook Name:: kosmos_strfry
|
||||
# Recipe:: policies
|
||||
#
|
||||
|
||||
include_recipe "deno"
|
||||
|
||||
#
|
||||
# config
|
||||
#
|
||||
|
||||
ldap_credentials = Chef::EncryptedDataBagItem.load('credentials', 'dirsrv')
|
||||
|
||||
extras_dir = node["strfry"]["extras_dir"]
|
||||
|
||||
directory extras_dir do
|
||||
owner node["strfry"]["user"]
|
||||
group node["strfry"]["group"]
|
||||
mode "0755"
|
||||
end
|
||||
|
||||
env = {
|
||||
ldap_url: 'ldap://ldap.kosmos.local:389', # requires "ldap_client" role
|
||||
ldap_bind_dn: ldap_credentials["service_dn"],
|
||||
ldap_password: ldap_credentials["service_password"],
|
||||
ldap_search_dn: node["strfry"]["ldap_search_dn"],
|
||||
whitelist_pubkeys: node["strfry"]["whitelist_pubkeys"].join(",")
|
||||
}
|
||||
|
||||
template "#{extras_dir}/.env" do
|
||||
source 'env.erb'
|
||||
owner node["strfry"]["user"]
|
||||
group node["strfry"]["group"]
|
||||
mode 0600
|
||||
sensitive true
|
||||
variables config: env
|
||||
notifies :restart, "service[strfry]", :delayed
|
||||
end
|
||||
|
||||
#
|
||||
# strfry deno scripts
|
||||
#
|
||||
|
||||
base_url = "https://gitea.kosmos.org/kosmos/akkounts/raw/branch/live/extras/strfry"
|
||||
|
||||
remote_file "#{extras_dir}/deno.json" do
|
||||
source "#{base_url}/deno.json"
|
||||
owner node["strfry"]["user"]
|
||||
group node["strfry"]["group"]
|
||||
mode "0644"
|
||||
notifies :restart, "service[strfry]", :delayed
|
||||
end
|
||||
|
||||
remote_file "#{extras_dir}/deno.lock" do
|
||||
source "#{base_url}/deno.lock"
|
||||
owner node["strfry"]["user"]
|
||||
group node["strfry"]["group"]
|
||||
mode "0644"
|
||||
notifies :restart, "service[strfry]", :delayed
|
||||
end
|
||||
|
||||
remote_file "#{extras_dir}/strfry-policy.ts" do
|
||||
source "#{base_url}/strfry-policy.ts"
|
||||
owner node["strfry"]["user"]
|
||||
group node["strfry"]["group"]
|
||||
mode "0755"
|
||||
notifies :restart, "service[strfry]", :delayed
|
||||
end
|
||||
|
||||
remote_file "#{extras_dir}/ldap-policy.ts" do
|
||||
source "#{base_url}/ldap-policy.ts"
|
||||
owner node["strfry"]["user"]
|
||||
group node["strfry"]["group"]
|
||||
mode "0644"
|
||||
notifies :restart, "service[strfry]", :delayed
|
||||
end
|
||||
|
||||
remote_file "#{extras_dir}/strfry-sync.ts" do
|
||||
source "#{base_url}/strfry-sync.ts"
|
||||
owner node["strfry"]["user"]
|
||||
group node["strfry"]["group"]
|
||||
mode "0644"
|
||||
end
|
||||
@@ -1,11 +0,0 @@
|
||||
<% @config.each do |key, value| %>
|
||||
<% if value.is_a?(Hash) %>
|
||||
<% value.each do |k, v| %>
|
||||
<%= "#{key.upcase}_#{k.upcase}" %>=<%= v.to_s %>
|
||||
<% end %>
|
||||
<% else %>
|
||||
<% if value %>
|
||||
<%= key.upcase %>=<%= value.to_s %>
|
||||
<% end %>
|
||||
<% end %>
|
||||
<% end %>
|
||||
@@ -1,25 +0,0 @@
|
||||
upstream _strfry {
|
||||
<% @upstream_hosts.each do |host| %>
|
||||
server <%= host %>:<%= @upstream_port || "7777" %>;
|
||||
<% end %>
|
||||
}
|
||||
|
||||
server {
|
||||
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
|
||||
server_name <%= @domain %>;
|
||||
|
||||
access_log "/var/log/nginx/<%= @domain %>.access.log";
|
||||
error_log "/var/log/nginx/<%= @domain %>.error.log";
|
||||
|
||||
ssl_certificate <%= @ssl_cert %>;
|
||||
ssl_certificate_key <%= @ssl_key %>;
|
||||
|
||||
location / {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_pass http://_strfry;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "upgrade";
|
||||
}
|
||||
}
|
||||
@@ -1,4 +1,3 @@
|
||||
node.default["kosmos_website"]["domain"] = "kosmos.org"
|
||||
node.default["kosmos_website"]["repo"] = "https://gitea.kosmos.org/kosmos/website.git"
|
||||
node.default["kosmos_website"]["revision"] = "chore/content"
|
||||
node.default["kosmos_website"]["accounts_url"] = "https://accounts.kosmos.org"
|
||||
node.default["kosmos_website"]["domain"] = "kosmos.org"
|
||||
node.default["kosmos_website"]["repo"] = "https://gitea.kosmos.org/kosmos/website.git"
|
||||
node.default["kosmos_website"]["revision"] = "chore/content"
|
||||
|
||||
@@ -23,7 +23,6 @@ end
|
||||
openresty_site domain do
|
||||
template "nginx_conf_website.erb"
|
||||
variables domain: domain,
|
||||
accounts_url: node.default["kosmos_website"]["accounts_url"],
|
||||
ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
|
||||
end
|
||||
|
||||
@@ -1,35 +0,0 @@
|
||||
#
|
||||
# Cookbook:: kosmos_website
|
||||
# Recipe:: redirects
|
||||
#
|
||||
|
||||
redirects = [
|
||||
{
|
||||
domain: "kosmos.chat",
|
||||
target: "https://kosmos.org",
|
||||
http_status: 307
|
||||
},
|
||||
{
|
||||
domain: "kosmos.cash",
|
||||
acme_domain: "letsencrypt.kosmos.org",
|
||||
target: "https://kosmos.org",
|
||||
http_status: 307
|
||||
}
|
||||
]
|
||||
|
||||
redirects.each do |redirect|
|
||||
tls_cert_for redirect[:domain] do
|
||||
auth "gandi_dns"
|
||||
acme_domain redirect[:acme_domain] unless redirect[:acme_domain].nil?
|
||||
action :create
|
||||
end
|
||||
|
||||
openresty_site redirect[:domain] do
|
||||
template "nginx_conf_redirect.erb"
|
||||
variables domain: redirect[:domain],
|
||||
target: redirect[:target],
|
||||
http_status: redirect[:http_status],
|
||||
ssl_cert: "/etc/letsencrypt/live/#{redirect[:domain]}/fullchain.pem",
|
||||
ssl_key: "/etc/letsencrypt/live/#{redirect[:domain]}/privkey.pem"
|
||||
end
|
||||
end
|
||||
@@ -1,20 +0,0 @@
|
||||
# Generated by Chef
|
||||
|
||||
server {
|
||||
server_name <%= @domain %>;
|
||||
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
access_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.access.log;
|
||||
error_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.error.log warn;
|
||||
|
||||
gzip_static on;
|
||||
gzip_comp_level 5;
|
||||
|
||||
ssl_certificate <%= @ssl_cert %>;
|
||||
ssl_certificate_key <%= @ssl_key %>;
|
||||
|
||||
location / {
|
||||
return <%= @http_status || 301 %> <%= @target %>;
|
||||
}
|
||||
}
|
||||
@@ -1,18 +0,0 @@
|
||||
# Generated by Chef
|
||||
|
||||
server {
|
||||
server_name <%= @domain %>;
|
||||
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
root /var/www/<%= @domain %>/public;
|
||||
|
||||
access_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.access.log;
|
||||
error_log <%= node[:openresty][:log_dir] %>/<%= @domain %>.error.log warn;
|
||||
|
||||
gzip_static on;
|
||||
gzip_comp_level 5;
|
||||
|
||||
ssl_certificate <%= @ssl_cert %>;
|
||||
ssl_certificate_key <%= @ssl_key %>;
|
||||
}
|
||||
@@ -1,18 +1,9 @@
|
||||
# Generated by Chef
|
||||
|
||||
server {
|
||||
server_name _;
|
||||
listen 80 default_server;
|
||||
|
||||
location / {
|
||||
return 301 https://<%= @domain %>;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
server_name <%= @domain %>;
|
||||
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2 default_server;
|
||||
listen [::]:443 ssl http2 default_server;
|
||||
listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
|
||||
listen [::]:443 ssl http2;
|
||||
|
||||
root /var/www/<%= @domain %>/public;
|
||||
|
||||
@@ -27,10 +18,8 @@ server {
|
||||
ssl_certificate <%= @ssl_cert %>;
|
||||
ssl_certificate_key <%= @ssl_key %>;
|
||||
|
||||
<% if @accounts_url %>
|
||||
location ~ ^/.well-known/(webfinger|nostr|lnurlp|keysend) {
|
||||
proxy_ssl_server_name on;
|
||||
proxy_pass https://accounts.kosmos.org;
|
||||
}
|
||||
<% end %>
|
||||
}
|
||||
|
||||
@@ -18,7 +18,6 @@ end
|
||||
|
||||
tls_cert_for domain do
|
||||
auth "gandi_dns"
|
||||
acme_domain "letsencrypt.kosmos.org"
|
||||
action :create
|
||||
end
|
||||
|
||||
|
||||
Submodule site-cookbooks/strfry deleted from a4756377b4
Reference in New Issue
Block a user