Support letsencrypt proxy validation via CNAMEs

Allows to point other domains' `_acme-challenge.example.com` entries at
`example.com.letsencrypt.kosmos.chat` so we can validate from our side
without access to the other domain's DNS records.

Used for 5apps.com XMPP for now. Can be used for others later.

.gitmodules

@@ -4,9 +4,3 @@
 [submodule "site-cookbooks/openresty"]
 	path = site-cookbooks/openresty
 	url = https://github.com/67P/chef-openresty.git
-[submodule "site-cookbooks/strfry"]
-	path = site-cookbooks/strfry
-	url = git@gitea.kosmos.org:kosmos/strfry-cookbook.git
-[submodule "site-cookbooks/deno"]
-	path = site-cookbooks/deno
-	url = git@gitea.kosmos.org:kosmos/deno-cookbook.git

README.md

@@ -38,10 +38,6 @@ Clone this repository, `cd` into it, and run:
 
     knife zero bootstrap ubuntu@zerotier-ip-address -x ubuntu --sudo --run-list "role[base],role[kvm_guest]" --secret-file .chef/encrypted_data_bag_secret
 
-### Bootstrap a new VM with environment and role/app (postgres replica as example)
-
-    knife zero bootstrap ubuntu@10.1.1.134 -x ubuntu --sudo --environment production --run-list "role[base],role[kvm_guest],role[postgresql_replica]" --secret-file .chef/encrypted_data_bag_secret
-
 ### Run Chef Zero on a host server
 
     knife zero converge -p2222 name:server-name.kosmos.org

clients/akaunting-1.json

@@ -1,4 +0,0 @@
-{
-  "name": "akaunting-1",
-  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzmNpNWJh5DeXDsINDqAt\n5OtcGhnzLtqdILTD8A8KuPxWhoKI0k9xwvuT4yO2DLQqFMPyGefRuQkVsIq2OuU5\npK8B5c79E9MBHxti6mQZw4b/Jhmul+x2LGtOWYjPTDhFYXRsNNDtFDxwpwJGPede\nYts026yExHPhiF35Mt1JxA3TXJfPC8Vx0YGHu/6Ev+1fLmcKhFmhed5yKkA0gwod\nczdyQiCfw3ze9LuS90QmALpFOHHpekZeywemdwyPia207CoTrXsPLWj9KmuUEIQJ\nwL+OlEU2tVA6KaBKpl54n5/tMsccZmlicbNsVpgkk6LctrkNh6Kk+fW9ry3L/Gxg\nAwIDAQAB\n-----END PUBLIC KEY-----\n"
-}

clients/garage-10.json

@@ -1,4 +0,0 @@
-{
-  "name": "garage-10",
-  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw2+3Wo+KkXVJCOX1SxT9\nSdwKXgPbCDM3EI9uwoxhMxQfRyN53dxIsBDsQUVOIe1Z8yqm4FenMQlNmeDR+QLE\nvNFf1fisinW+D9VVRm+CjcJy96i/Dyt786Z6YRrDlB860HxCbfTL2Zv5BRtbyIKg\nhz5gO+9PMEpPVR2ij9iue4K6jbM1AAL2ia/P6zDWLJqeIzUocCeHV5N0Z3jXH6qr\nf444v78x35MMJ+3tg5h95SU1/PDCpdSTct4uHEuKIosiN7p4DlYMoM5iSyvVoujr\nflRQPEpGzS9qEt3rDo/F4ltzYMx6bf1tB/0QaBKD+zwPZWTTwf61tSBo5/NkGvJc\nFQIDAQAB\n-----END PUBLIC KEY-----\n"
-}

clients/garage-11.json

@@ -1,4 +0,0 @@
-{
-  "name": "garage-11",
-  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzfZcNEQojtmaogd9vGP/\nMsVPhAOlQ4kxKgrUas+p+XT7lXRan6b3M8UZEleIaL1HWsjSVwtFWRnNl8kg8rF8\nNEkLeOX8kHf7IoXDFOQa2TXanY8tSqrfh9/heFunt4Q3DluVt7S3bBdwukbDXm/n\nXJS2EQP33eJT4reL6FpVR0oVlFCzI3Vmf7ieSHIBXrbXy7AIvGC2+NVXvQle6pqp\nx0rqU6Wc6ef/VtIv+vK3YFnt9ue3tC63mexyeNKgRYf1YjDx61wo2bOY2t8rqN8y\nHeZ3dmAN8/Vwjk5VGnZqK7kRQ92G4IcE+mEp7MuwXcLqQ9WB960o+evay+o1R5JS\nhwIDAQAB\n-----END PUBLIC KEY-----\n"
-}

clients/garage-4.json

@@ -0,0 +1,4 @@
+{
+  "name": "garage-4",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8it7QtT6zDiJJqlyHKfQ\nLqwu6bLblD15WWxlUSiOdhz3njWDv1BIDCAdkCR3HAXgxvk8sMj9QkvWS7u1+bc4\nxvHrY4Tgfg+Tk1h3gGa7ukll8s1WLIbGjj89vrK8PFr4iuDqRytYRMmcdMsNzPkS\nKcsOjFYWGV7KM/OwoQGVIOUPB+WtkrFAvNkXtIU6Wd5orzFMjt/9DPF2aO7QegL8\nG1mQmXcPGl9NSDUXptn/kzFKm/p4n7pjy6OypFT192ak7OA/s+CvQlaVE2tb/M3c\ne4J6A+PInV5AGKY6BxI3QRQLZIlqE0FXawFKr1iRU4JP4tVnICXZqy+SDXQU1zar\nTQIDAQAB\n-----END PUBLIC KEY-----\n"
+}

clients/garage-5.json

@@ -0,0 +1,4 @@
+{
+  "name": "garage-5",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnJxLFOBbml94W/GAe7nm\ntZs1Ziy8IbqXySsm8bSwWhRMQ8UuseqQLG30R3Q5X5AoJbtNfd26l63qLtP2fFtL\n5km9dV+2FoIJWFetl8Wzr7CaLYAiNzTQSFHlV7+6DKmPMDcJ63GKrFR77vkSGOG6\nOWL1bJy5BOaClp/sKL/0WQ0+mRbTP6RCQ2eI+46clAg702SenBU6Nz9HDm+teKN7\nYlP1CvzXgfgfpDOsat7wGn5+oKcmKavZxcdn8bt5jRpg8v3JezaZIjMXt7XcNS4n\n0F4XO/efnZE5B5SN68j4BpD8N79zJw4HlRIGP+RaYv2qLtBeWgLHCCs9wXQXfj6b\nLwIDAQAB\n-----END PUBLIC KEY-----\n"
+}

clients/garage-6.json

@@ -0,0 +1,4 @@
+{
+  "name": "garage-6",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwasYgWLM8ShvirFiKRE6\nGWqc3pMlvcrk4YnWAUW5Y/H26EnyexxWNfnwlEcq8thJ3M3hs7zkoF3Yk4uqX869\n4/niYqXwYgeE1K3gzLp4K1+w3yVupYAFVFStVEHJyuMlLJ+ulDEGvNdQDuIfw7+E\nr6DcDLa1o92Eo0wL1ihYyMilduH0LdFTixL+tEBXbbPWBa3RDJJCFsRF1+UC6hAH\nzmaWL661Gdzdabxjm/FlGUYkdbDqeInZq/1GMQqv+9/DcNRkWA9H7i4Ykrfpx4/2\nRZ8xtx/DbnJVB1zYoORygFMMAkTu5E+R8ropeI7Wi77Yq0S7laiRlYQYQml3x9ak\nzQIDAQAB\n-----END PUBLIC KEY-----\n"
+}

clients/garage-9.json

@@ -1,4 +0,0 @@
-{
-  "name": "garage-9",
-  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnMHzKE8JBrsQkmRDeMjX\n71mBzvRzNM90cwA8xtvIkXesdTyGqohX9k/PJbCY5ySGK9PpMaYDPVAnwnUP8LFQ\n3G98aSbLxUjqU/PBzRsnWpihehr05uz9zYcNFzr4LTNvGQZsq47nN9Tk+LG3zHP7\nAZViv2mJ4ZRnukXf6KHlyoVvhuTu+tiBM8QzjTF97iP/aguNPzYHmrecy9Uf5bSA\nZrbNZT+ayxtgswC2OclhRucx7XLSuHXtpwFqsQzSAhiX1aQ3wwCyH9WJtVwpfUsE\nlxTjcQiSM9aPZ8iSC0shpBaKD1j3iF/2K2Jk+88++zMhJJPLermvaJxzsdePgvyk\nKQIDAQAB\n-----END PUBLIC KEY-----\n"
-}

clients/postgres-5.json

@@ -0,0 +1,4 @@
+{
+  "name": "postgres-5",
+  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXZv6Gk+dhIVkTXH9hJ1\nt2oqsMSLmTUj71uPN+4j0rxCQriXa095Nle9ifJAxfwzQyKEpWKyZd1Hpyye6bL1\nwgWATZ/u5ZS4B63NhRFyDxgPlHWBBohaZBN42zeq0Y0PNGHPVGDH/zFDrpP22Q9Q\nYScsyXTauE/Yf8a/rKR5jdnoVsVVMxk0LHxka8FcM2cqVsDAcK7GqIG6epqNFY8P\nUb1P+mVxRwnkzvf1VtG212ezV/yw9uiQcUkHS+JwZMAgbC34k9iDyRmk6l4sj/Zk\nNem20ImMqdDzsrX8zEe21K+KNvpejPH9fxaNCwR8W+woBMMzqD3I7P9PbLjc70Rx\nRwIDAQAB\n-----END PUBLIC KEY-----\n"
+}

clients/postgres-7.json

@@ -1,4 +0,0 @@
-{
-  "name": "postgres-7",
-  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArraIm6mXi0qgK4oWDs2I\nOIx+g/LPnfRd5aBXhoHcekGiJKttQTi5dRdN4+T6qVEC2h4Cc9qN47h2TZPLDh/M\neIZvu0AyicpectzXf6DtDZh0hFCnv47RDi9927op9tjMXk0SV1tLel7MN0dawATw\ny0vQkkr/5a3ZdiP4dFv+bdfVrj+Tuh85BYPVyX2mxq9F7Efxrt6rzVBiqr6uJLUY\nStpeB3CCalC4zQApKX2xrdtr2k8aJbqC6C//LiKbb7VKn+ZuZJ32L/+9HDEzQoFC\no0ZZPMhfnjcU+iSHYZuPMTJTNbwgRuOgpn9O8kZ239qYc59z7HEXwwWiYPDevbiM\nCQIDAQAB\n-----END PUBLIC KEY-----\n"
-}

clients/postgres-8.json

@@ -1,4 +0,0 @@
-{
-  "name": "postgres-8",
-  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx88DgM/x1UbKRzgPexXE\nSyfrAsqaDVjqZz7yF3tqAc9A52Ol0KOM6NESoPWBVMbS86WtAjBcMHcOoQBJ+ovp\nXcjNlRtO1Il6/d4uCRr4CEDX+yeS0Qrt0SOORnoTbVlkq9VlVljyCmxk8VBCILzk\ndHvFr62mahMy6vOEcpCQgCwYE3ISH2jlTDz2agoK/CjIyyqFTlB1N7mJVGLrJdcA\nA2JOxDRE8HqOdpY7bHcHj4uyMWaKuM3zxXK04lhrvuPRfJUhXgsK9r5jeTEa8407\nqV9K+mB17R1dBeHmWEPDRt02HELe2SUjYmlmyVX73H2mWKDLBFpAFjOfz86CJ6jf\nDQIDAQAB\n-----END PUBLIC KEY-----\n"
-}

clients/strfry-1.json

@@ -1,4 +0,0 @@
-{
-  "name": "strfry-1",
-  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzDV/RMGMXVDbvoA6PNh8\nQzhtHwYDCFcUSkbrwP6tzh6GpVunGEOdOdhj2V63T2tF1H+lujxQXh5pK7C0D6VZ\niO04ftJlo7/svyxUcwWr+znyN5sFdQRh3cBZiGSBYolizwoqgtPFlbNhmWAzV0Du\n9t8mhz70IK3B+UdwWyHtoK0NNsJGnQ9YzAvcjyDmEO/3sCjAhNnxVpmXftpcSmd9\nMonzFtIDBbRRll4AHZYRbmXCzx63+VmelvdnufnbY82liol0zzBwJaBD1wyNlG0y\ni96p3Kx03bLNlIaYVGbjZeJi+6oo2VDWJ4OloLLAYoHDSipeHT9qWfUdnE6ge4Lm\nywIDAQAB\n-----END PUBLIC KEY-----\n"
-}

data_bags/credentials/akaunting.json

@@ -1,31 +0,0 @@
-{
-  "id": "akaunting",
-  "app_key": {
-    "encrypted_data": "C7VVGHHrE/ESwtGeODf8zVraayO5uBSXaGR7f4yoj0MDq9WxPujItC3dIkMQ\ngjGzk8fH\n",
-    "iv": "4+d+RMLeuqaneFBa\n",
-    "auth_tag": "sBQDUVl6QbL/h9pd0kBQ0g==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "pg_database": {
-    "encrypted_data": "4mqHsMfDAqPvDmGsWgS9iE63qVeus7diSW8WiA==\n",
-    "iv": "6Cb1lVUcXBz+GA4u\n",
-    "auth_tag": "8O3N0m8jGhxs/YacdhgNHA==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "pg_username": {
-    "encrypted_data": "Nu0wiBhvqUwqC7PL2Qo8otq0b3faJqRsabqp2g==\n",
-    "iv": "1uA8mJc7itT0qHcx\n",
-    "auth_tag": "PRWw6LTlFrWs63SDRsovtQ==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "pg_password": {
-    "encrypted_data": "oXDKiXQ4aH5M2pVu1sx7dj0awKCORke03fq0uemjIfCMYbM=\n",
-    "iv": "snPyC8mocevc5kGH\n",
-    "auth_tag": "9wx4GPSydkYr2WGpZK5HZg==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  }
-}

data_bags/credentials/akkounts.json

@@ -1,72 +1,65 @@
 {
   "id": "akkounts",
   "postgresql_username": {
-    "encrypted_data": "ofLOjxGBj7no+lWrIvtxQQFoeozCh6mpfMTt\n",
+    "encrypted_data": "l00Lmdbl5xNq07XU4XmcnRxXsIJaYyMQQ6xI\n",
-    "iv": "/CF+o4GqZx2O5WOm\n",
+    "iv": "yxvL6hKwlVWmdMzl\n",
-    "auth_tag": "bjHXfgNQfXpQ2gucPLrUWA==\n",
+    "auth_tag": "mMCV9ewJW/0TfVE76WBSZw==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "postgresql_password": {
-    "encrypted_data": "f8Jfs4aqIjc6/6/NQlI2Fv8TzSgVmi5g0iYNhh9bAA==\n",
+    "encrypted_data": "Q6xWsH6bmI1GfMzme3mBRYrt3XmDwFJ7E4FjYg2Rrw==\n",
-    "iv": "vAzrZeUodmu4x5eB\n",
+    "iv": "jcQmuT7Jz3g3XE8d\n",
-    "auth_tag": "vx8eH2SY7I4IkZElXSC1Nw==\n",
+    "auth_tag": "nNMvf9UmP6ikf1BW93QZIw==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "sentry_dsn": {
-    "encrypted_data": "oxW5jGU8DlIp5A9enxBhcJXuKyaZ5HziXq8Zw+Rbvpbv4C/RTGkJkgZdKcH1\nVzW/wNAT8nTK+nEvWgcQ3svjE40ltj2jcOexIRqLbuCClJE=\n",
+    "encrypted_data": "V7cqlH2baN1Ix/ggQFeo9PY6dNKKpnDECaB1cO3XuCfy74oN2ot44nbpCQTA\nUl0+1LQv/qNn/L4gmJkqZfdIXZQqhR+iTc06UJxe3aTKJDw=\n",
-    "iv": "wpW9+VdX5GjocHSl\n",
+    "iv": "HJtdKYcApwaxhTXI\n",
-    "auth_tag": "1qrf1kZMrIR7WRiSaRjppQ==\n",
+    "auth_tag": "qyIYK9h6nciJTFXBWOjVOA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "rails_master_key": {
-    "encrypted_data": "KHVYYH7Nb9/SsoKkYfbjzhFwj3Ioj72hm5pfdCuinf+GQvjKumq99eQTlKdf\nBZM1n0XN\n",
+    "encrypted_data": "KAl2Kgq1TXjOm4TNxGwZkPwJeOSNLbLLKiRdb4fTyBFfUhIGGeCS9VvV9kIb\n9sQZ6HLU\n",
-    "iv": "x9AQZvw/vCinKQ8k\n",
+    "iv": "BBPvDNs6nBXDti5I\n",
-    "auth_tag": "mi0KHHOTBvVNhtvqk38BtQ==\n",
+    "auth_tag": "yjM/0nyUwt+5SSGuLC5qWA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "discourse_connect_secret": {
-    "encrypted_data": "WyLrV0DOsxyafSqyeQVj0BhVwm/0gvWeJLBsAbiqCGphryoYqUByPcum1T6R\n2H44nQ==\n",
+    "encrypted_data": "YHkZGzXeK3nDHaXt3JKmGtCcvMfgvv3yHbvS2C+CLKagOIOe+0+2/CiNuh4U\nxO1Pug==\n",
-    "iv": "lUtlJDv6Ieq8Bs5x\n",
+    "iv": "SnUxDpIMQum8ySfN\n",
-    "auth_tag": "ku22BlQKw/BhHxuANTF6yg==\n",
+    "auth_tag": "Ny6I+3EoCA1s74JLjjbbyQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "lndhub_admin_token": {
-    "encrypted_data": "DQuxQW8ks3sUzyHYEpQVyPg2f/U4/LWeRoCD9225Hd+c\n",
+    "encrypted_data": "dJHxB80Enwkm+2aNuIrp7lILAy2J5tQaChPJCl/BHwMo\n",
-    "iv": "mjxYi+YAcKGuurD2\n",
+    "iv": "zHLtD1jTIwvjMt1l\n",
-    "auth_tag": "8P3bFFNeQ5HQgpXDB5Sk5A==\n",
+    "auth_tag": "IC0adEzsS5YF5YHqabWw2A==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "btcpay_auth_token": {
-    "encrypted_data": "3wsY9osaUdX4SvBPfHprNLSbx6/rfI5BfXnDxsc6OET3nGn19qBhH6wgeiwZ\n/dweqdQ25HpbFPygddc=\n",
+    "encrypted_data": "YbM0HvgIijluKQBcgfKn6hmWvdbhr0ijR1xKc+BRZCZJsRaJBHTjCbwhH8T9\nVnBESruyjhxphtBetcc=\n",
-    "iv": "ccouibxktHLlUCQJ\n",
+    "iv": "3107v/c2Tonx6/cP\n",
-    "auth_tag": "pWuRC8O2EAkmztL/9V3now==\n",
+    "auth_tag": "jnO9fvoXJW5gbDMRjkdMPA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "s3_access_key": {
-    "encrypted_data": "hJGHa+hEmddtsZ4UncrYBkjRa/2Csqdh79tXpTVxUWbIsYGdlvyadk7C1UCj\n",
+    "encrypted_data": "PFjQKe1us12SNHlReQ4f0qctulPp4d2F3t5t+AGocp87PS/kZx77rtHQtruK\n",
-    "iv": "GlxNdnWiNzmNYthg\n",
+    "iv": "BGD8+XchqwPmhhwi\n",
-    "auth_tag": "hlRLkroUN01L7VzQFBU/IA==\n",
+    "auth_tag": "XefaZKCVs8hotszALN+kxQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "s3_secret_key": {
-    "encrypted_data": "LKdQJOKIfFIoiF3GvfTs1mg3AI//Aoi8r42zcw8QhEVPB8ONsSf0/vhM037C\nf5nzUk7xwglvTOveqbOM+UTBJF/4oblQfgwFW3VobWUGkJqjtKE=\n",
+    "encrypted_data": "ziO35x8P1YMaSeenMNQoTWug62b5ZVLFlkMlJEFGnYjHK5qTAn6ir06WnMJC\n0zErzTZsPpcr7KpE/ipWgWHRy7qVbGnd6iVO4t9tf5NjiU2OXfA=\n",
-    "iv": "tWTxzK/ccpjlLmQV\n",
+    "iv": "S3syCCxh2m+mylLu\n",
-    "auth_tag": "n2MFkTIquyqz4wqRNdSJcg==\n",
+    "auth_tag": "ZMkyBqXMXr3K3LGqxWvbtA==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "nostr_private_key": {
-    "encrypted_data": "CPMeNxzpYMReaQU4+v+EqpVESRsnaYc3a4y7OkHOhtn2gjaNEDERGKvRmlyd\nD6vxKPcIrwTCZ7neJ3YLOVOxPDNv6skqdtMHBwSgl7aBEOrx7tY=\n",
-    "iv": "AV1on2sw1avmFFuY\n",
-    "auth_tag": "9rb9qQBKrj5Xja1t+qROKQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }

data_bags/credentials/backup.json

@@ -1,38 +1,27 @@
 {
   "id": "backup",
   "s3_access_key_id": {
-    "encrypted_data": "245TrPvuoBRRTimhbt6qqsFb+JnnD377sPt1pguJy7Q2BXOy/jrX0wyMt+cP\nuA==\n",
+    "encrypted_data": "emGNH4v7TTEh05Go/DsI3k7CFnaK4p/4JxodC4BYpyWw47/Z3dsuRMu4vXM3\n3YLH\n",
-    "iv": "ylmRxSRO3AA4MSJN\n",
+    "iv": "Dau+ekb3UTYdl8w3fQKVcA==\n",
-    "auth_tag": "45tBcYZowPLrbv4Zu2P0Fw==\n",
+    "version": 1,
-    "version": 3,
+    "cipher": "aes-256-cbc"
-    "cipher": "aes-256-gcm"
   },
   "s3_secret_access_key": {
-    "encrypted_data": "jDIOjlBzTkBUzpj243T6KnBuH0qwyW7BUFMcqllljFSzxs7K8wYJOUreNbOP\ny8OpDWAuO0H4O4LuFMJXeM8=\n",
+    "encrypted_data": "Mxyly86JxrWUbubbSiqPdRosChzfI1Q8eBEG4n+2B9JJG4yExltO5Wc5kgSs\nX01MPXAc+PGLm+J9MngUtypo/g==\n",
-    "iv": "PzvZr37EkJqz6JtM\n",
+    "iv": "WRhBJGiuScYYsUsoT5j/UA==\n",
-    "auth_tag": "e3XW8oHVgmYibv/IBzj0yA==\n",
+    "version": 1,
-    "version": 3,
+    "cipher": "aes-256-cbc"
-    "cipher": "aes-256-gcm"
-  },
-  "s3_endpoint": {
-    "encrypted_data": "ErJIEChxrreW7WKEwRtuP2MyYlsZRtqLdGa/x5QY58qgO036FgR3Hs2Z3yce\n",
-    "iv": "HOSAOgUjO7XGwk50\n",
-    "auth_tag": "XE1bwMIXHHE72V9K2KOLnw==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
   },
   "s3_region": {
-    "encrypted_data": "8cNSaYu7HH95ftG66lFdUIPZD7soz907CPA=\n",
+    "encrypted_data": "2ZGxu0tVzKNfx3K1Wleg0SAwGaPkHCi/XfKpJ+J7q40=\n",
-    "iv": "pU21ulF75y/SIs3x\n",
+    "iv": "CNTZW2SEIgfw+IyzGI3TzQ==\n",
-    "auth_tag": "7WQQCbSbB2GybjY+C+5IvQ==\n",
+    "version": 1,
-    "version": 3,
+    "cipher": "aes-256-cbc"
-    "cipher": "aes-256-gcm"
   },
   "encryption_password": {
-    "encrypted_data": "l23CiIO2s1fIRn0NdoWZ+wK+Zhx3hCYDHf4ypjqMRekZ7xqafvXHHuogD5aj\npxYUKloH\n",
+    "encrypted_data": "tsBWKBwhQFfEAM0EWMPtljSbqU1c5mOJXPjYJjNT5RUFhPlqa7gsE8aJbs+D\nSPKjAQ62j+iHeqCk9mE9CCkgBA==\n",
-    "iv": "Dzx83eP9L7Jqqidh\n",
+    "iv": "uq5YAXuq2ynRLv9EIWoCFA==\n",
-    "auth_tag": "UVn5XA5Tgsikc1GdOt1MUQ==\n",
+    "version": 1,
-    "version": 3,
+    "cipher": "aes-256-cbc"
-    "cipher": "aes-256-gcm"
   }
 }

data_bags/credentials/dirsrv.json

@@ -1,30 +1,9 @@
 {
   "id": "dirsrv",
-  "admin_dn": {
-    "encrypted_data": "zRtz6Scb9WtUXGyjc0xyvsre0YvqupuaFz+RPApj7DEQTmYyZPVb\n",
-    "iv": "xfIXMhEBHBWqa4Dz\n",
-    "auth_tag": "BcA32u1njcnCZ+yrBGSceQ==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
   "admin_password": {
-    "encrypted_data": "7JpXl3JZDqKWDfYt/wuNbkbob+oRuONhkuAlpqUCCEIn+tY=\n",
+    "encrypted_data": "i71l5E129mXCcDAyME8sNMUkYUlQMgt7Eh6noyFcLNgbaMo=\n",
-    "iv": "Lcwc4NDzrfcBaIKQ\n",
+    "iv": "KNW2B8tpX7ywZwbg\n",
-    "auth_tag": "rrePS3Bhdnwbr2d/o8vMhg==\n",
+    "auth_tag": "GawQ+FSlA5v5YVyryeUxng==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "service_dn": {
-    "encrypted_data": "sqRFiZreLeTPQljSfhAuV3DmsPxSC8tzWjCdu+WSSbO67sBQA+xhmGtzBhBD\nDZPGJw+jtAxzuVvPdAjxgAVgxXO6C6WEo87L1tdJewE=\n",
-    "iv": "GUEGtyRJXrPhWcUs\n",
-    "auth_tag": "2USsrx//3V7RCyumGCbMkg==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "service_password": {
-    "encrypted_data": "f2wi8B8SEt6p5G0TF3dZ72j0vMFlvwcP1suxYnshBA==\n",
-    "iv": "rOnUoxbnkaJtodM+\n",
-    "auth_tag": "dVLCtBVMjxLfW2D8XjJBdQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }

data_bags/credentials/gandi_api.json

@@ -1,24 +0,0 @@
-{
-  "id": "gandi_api",
-  "key": {
-    "encrypted_data": "Ky1/PdywtEIl5vVXhzu3n2JetqOxnNjpjQ7yCao6qwIAn8oYxnv1c1hFAQ==\n",
-    "iv": "stAc2FxDvUqrh0kt\n",
-    "auth_tag": "rcK4Qt+f2O4Zo5IMmG0fkw==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "access_token": {
-    "encrypted_data": "J7zoLhEbPfPjnVWBmFmDdPKRer5GGw2o6Ad0uinznANugfaDiqjyYinOdEDF\nHlAqLmXv4J40rr3F+o4=\n",
-    "iv": "fAxFqVh9QqrfBsPW\n",
-    "auth_tag": "9ugi4frDLv8f7X0X1+k4DA==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "domains": {
-    "encrypted_data": "X0KOKlJp5GYbKcq/jzmlaMmTXV1U7exWSqi3UxX9Sw==\n",
-    "iv": "9JucnYLlYdQ9N6pd\n",
-    "auth_tag": "sERYPDnVUJwVfSS8/xrPpQ==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  }
-}

data_bags/credentials/gandi_api_5apps.json

@@ -0,0 +1,17 @@
+{
+  "id": "gandi_api_5apps",
+  "key": {
+    "encrypted_data": "AGYIkLdbnU3+O6OxGsFyLpZtTw531s2dbRC4Lik+8NYp3l4P0UMM2Pqf0g==\n",
+    "iv": "kPRHGpLwNIC3MpES\n",
+    "auth_tag": "wKth2tA+JxILFIKppHLDJg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "access_token": {
+    "encrypted_data": "+tKKFcWV0CZ5wEB/No5hou5+p1llsUkq7AXBvfnA7xsgbpa2q8AX/2UFf9Cf\nGtd9om1CeJJtz+o4ceA=\n",
+    "iv": "hLJSV77DQtqXZDbV\n",
+    "auth_tag": "8xgyudyDk4hq16LRkykGhQ==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  }
+}

data_bags/credentials/mastodon.json

@@ -1,114 +1,79 @@
 {
   "id": "mastodon",
-  "active_record_encryption_deterministic_key": {
-    "encrypted_data": "2ik8hqK7wrtxyC73DLI8FNezZiWp2rdjwaWZkTUFRj+iwvpSrGVEwMx6uxDI\nWa7zF3p/\n",
-    "iv": "XMp6wqwzStXZx+F3\n",
-    "auth_tag": "vloJOLqEcghfQXOYohVVlg==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "active_record_encryption_key_derivation_salt": {
-    "encrypted_data": "Nq/rHayMYmT/82k3tJUKU8YTvDKUKLoK204aT0CMGZertZaAD3dtA9AkprrA\nPK0D9CdL\n",
-    "iv": "tn9C+igusYMH6GyM\n",
-    "auth_tag": "+ReZRNrfpl6ZDwYQpwm6dw==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "active_record_encryption_primary_key": {
-    "encrypted_data": "UEDMuKHgZDBhpB9BwbPmtdmIDWHyS9/bSzaEbtTRvLcV8dGOE5q9lDVIIsQp\n2HE0c92p\n",
-    "iv": "tnB0pQ3OGDne3mN/\n",
-    "auth_tag": "kt234ms+bmcxJj/+FH/72Q==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
   "paperclip_secret": {
-    "encrypted_data": "AlsnNTRF6GEyHjMHnC4VdzF4swMlppz/Gcp1xr0OuMEgQiOcW1oSZjDRZCRV\nmuGqZXZx64wqZyzTsJZ6ayCLsmWlPq6L21odHWyO+P/C5ubenSXnuCjpUn3/\nHs8WLX3kwVmqCRnVgDl2vEZ5H4XedSLr7R7YM7gQkM0UX4muMDWWnOTR8/x/\ni1ecwBY5RjdewwyR\n",
+    "encrypted_data": "orOIbqFANPCkd4sUTCyyoh4z1o6SBudgH4wKJudTo9dANaHGhWcBUFKrhZi1\nMJTBQx/d0hiDI1P2XN3h+hROCg3JJ8OClUSJH9CfN5GlbWvXh0Nhq7hqy8L3\nLAPL+uigiXI6ObrnKQoD8LeJIB46233uwaCA/7zB6gah0ExJ2DXGH6qq9JSS\nqmTFiy+hT+VHGrUo\n",
-    "iv": "RWiLePhFyPekYSl9\n",
+    "iv": "U4E4NLYLkP0/tTTs\n",
-    "auth_tag": "sUq4ZX9CFKPbwDyuKQfNLQ==\n",
+    "auth_tag": "WKQ+pDPZp7B791lhC5j3iQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "secret_key_base": {
-    "encrypted_data": "K5CmIXFa9mS4/dODBQAN9Bw0SFpbLiZAB8ewiYpkB8NDXP6X/BX8aDjW2Y4F\ncMvpFyiFldRBhrh1MSKTVYQEoJ3JhlNL9HCdPsAYbBEW70AuEBpHvOtD5OxH\nqgbH4Reuk6JX5AI8SwDD3zGrdT12mTFVNgSujzuZMvpi1Sro2HtRGAkjmnaa\nMGKrBV21O1CREJJg\n",
+    "encrypted_data": "vweClhdY8SqQkK+p0OYUL2B6Fsz5eQDpEYWCtd/eRJfwwYAObbLcMWRC6MwE\neQVMw59bOqYc3RBuv/+WPLtENazA1bYCXBXQr1J6xqjJAz0Mo6KbRyxy5n78\nv8q6RSiao1VVIUXohtFlQgWeV6x5sz34bJxjlHinKvKsgiGXiuVBxYUUfzWQ\nuzrGug09cpZBqfpc\n",
-    "iv": "/yMMmz1YtKIs5HSd\n",
+    "iv": "Z0/csEBH5/X1+MR+\n",
-    "auth_tag": "WXgIVWjIdbMFlJhTD5J0JQ==\n",
+    "auth_tag": "fTvBN6eovi3JVEK0ZX97Nw==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "otp_secret": {
-    "encrypted_data": "OPLnYRySSIDOcVHy2A5V+pCrz9zVIPjdpAGmCdgQkXtJfsS9NzNtxOPwrXo6\nuQlV9iPjr1Y9ljGKYytbF0fPgAa5q6Z1oHMY9vOGs/LGKj8wHDmIvxQ+Gil1\nC+dZEePmqGaySlNSB/gNzcFIvjBH3mDxHJJe9hDxSv5miNS9l9f3UvQeLP2M\nU7/aHKagL9ZHOp/d\n",
+    "encrypted_data": "o1ts1bUgPIzFQXjJ2MpBMLntWkyPxDaJAaU1K3WzmNMXnw5MVlkKKCEFVccd\nPss/MwDuBkbNPhri3ZkH48m9SiayWETVYvw5GZzcVsw4TeMu915O44lfl9tX\nW3XHU+DBps1BVH9535R4X9M1aFW4W4XfwHtS5wcrZqtVhNhS3NSgE4JpN/Dz\nFdcFAOhflnt8fIAN\n",
-    "iv": "wqJBLdZhJ7M/KRG9\n",
+    "iv": "QLsxmIlX1NpxMyHz\n",
-    "auth_tag": "dv5YyZszZCrRnTleaiGd4A==\n",
+    "auth_tag": "j1h/PvIoqshTBN5c5IaAsA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "aws_access_key_id": {
-    "encrypted_data": "A1/gfcyrwT6i9W6aGTJ8pH4Dm4o8ACDxvooDroA/2N0szOiNyiYX\n",
+    "encrypted_data": "YQHUx0GugKu0AtlbGLRGocFEhTGAghWA0DUs1Nxs4Hd3bTIp4lyM\n",
-    "iv": "JNvf21KhdM3yoLGt\n",
+    "iv": "54zt2tkQhHtpY7sO\n",
-    "auth_tag": "2xaZql1ymPYuXuvXzT3ymA==\n",
+    "auth_tag": "ofBJx3QDsjHe66ga3nji8g==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "aws_secret_access_key": {
-    "encrypted_data": "T1tc01nACxhDgygKaiAq3LChGYSgmW8LAwr1aSxXmJ5D2NtypJDikiHrJbFZ\nfWFgm1qe4L8iD/k5+ro=\n",
+    "encrypted_data": "FAz6xZ+wsCz/KFA+DK6f4V04rxJt+9U/yXUGF9tvce0VqB3scH+T0KDDn1/n\nZ/0G0Tbxt2urRPbPUdI=\n",
-    "iv": "FDTPQQDLUMKW7TXx\n",
+    "iv": "iapSpeM6lfDMIfNk\n",
-    "auth_tag": "msY6PFFYhlwQ0X7gekSDiw==\n",
+    "auth_tag": "HlkwUnNeJlOUrZ3ieN5xAQ==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "ldap_bind_dn": {
-    "encrypted_data": "C/YNROVyOxmR4O2Cy52TX41EKli2bCOMzwYD+6Hz/SiKkgidnKUHlvHlbTDq\nkWwlRDM2o8esOCKaEAGPNWcNc9IHlaSsfwhr4YWnwe0=\n",
-    "iv": "QCQF0+vH+//+nDxr\n",
-    "auth_tag": "a0PbyO/7wjufqH2acDCqmQ==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "ldap_password": {
-    "encrypted_data": "SqwKeiyzfvvZGqH5gi35BdW3W+Fo/AQQjso1Yfp2XA==\n",
-    "iv": "md2/etFJ1r/BKaYg\n",
-    "auth_tag": "OlCCOoYSD7ukdH2yWCd6KA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "smtp_user_name": {
-    "encrypted_data": "0kzppmSSUg7lEyYnI5a0nf+xO0vSVx88rbxI+niIdzFOOBKSIL6uVHJ340dw\nMQ==\n",
+    "encrypted_data": "ivB09/mCRrUaz9X4NFRBiqytjgy/vxN5Nha7gopFq5eSu9v4K9MkaLRqHh1I\nYw==\n",
-    "iv": "lQR77ETTtIIyaG1r\n",
+    "iv": "a8WKhRKsUjqBtfmn\n",
-    "auth_tag": "smF2HRg8WdmD+MWwkT3TqA==\n",
+    "auth_tag": "ib5WJNNaO7bRIspdACmOLw==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "smtp_password": {
-    "encrypted_data": "1i0m9qiZA/8k8fMKo+04uyndl1UhagtHweBFICIorWALkB68edjb8OhUDxv9\nTubiXYRC\n",
+    "encrypted_data": "FxPz2e7fUNqcAu+DDJKlqn8rcSBLmnzigTFf5moZlQ1zz4YVl6pqHisa22Qz\nbfUx9rjU\n",
-    "iv": "IU2x4ips9HWmKoxi\n",
+    "iv": "GvRlNDV/b1WawtOP\n",
-    "auth_tag": "BZJTDfPBvt8cf6/MbKzUJQ==\n",
+    "auth_tag": "kyRCGfSJQelIwThDT4iQQQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "vapid_private_key": {
-    "encrypted_data": "+LmySMvzrV3z2z7BmJG9hpvkL06mGc87RG20XQhhdAJ2Z/5uMMjev2pUf7du\ntv2qvDJAimhkZajuDGL9R3eq\n",
+    "encrypted_data": "DlbEAhd+SkSJoOSuwGhd5bdFlJADnT0w4u0+6m8AJoWJjoSCGAnzzmdHWT/k\nVUDkwiBCkqmEPK0oTvxnl/a8\n",
-    "iv": "Mg7NhPl31O6Z4P+v\n",
+    "iv": "6e0Gay7GVrQad1rI\n",
-    "auth_tag": "qYWPInhgoWAjg0zQ+XXt5w==\n",
+    "auth_tag": "jjVundJ/ITxP/oYgEgzElg==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "vapid_public_key": {
-    "encrypted_data": "NOyc+Cech9qG2HhnhajDaJMWd1OU5Rp6hws6i4xF5mLPePMJ9mJTqzklkuMK\npYSEdtcxA3KmDt1HrFxfezYUc9xO9pvlm0BPA7XAFmF/PU7/AJbFqgPU6pX/\ntSDLSdFuMB3ky+cl4DJi+O4=\n",
+    "encrypted_data": "+m37w/eWYqdEjsEYQw27FvQC+37ucruOFjZAjo0OgCwA0SoVz4VHX2eSA2AK\njX4CnM91cY4e/WG/ZHKlOMN1PftyQn2bdGaw35nXDanep8z0ROa01JEEi5DE\nUFRKvBmPInTeR6xvemuj7GM=\n",
-    "iv": "rgUglYiHB/mhqGha\n",
+    "iv": "loYbGrAsWGLUZ+BK\n",
-    "auth_tag": "DEX7hdNsNLi/LIrMkdUe/Q==\n",
+    "auth_tag": "lAfpEEVQq+n7MLLm/kpmIA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "s3_key_id": {
-    "encrypted_data": "rPVzrYYIbcM+ssVpdL6wpCTdzLIEKXke1+eMlPLMG2gPuoh+W3eO3nFGb/s2\n",
+    "encrypted_data": "4B8OQ0iVCCna4FvC+EuS5prEUWaHRm1+tzXGmFoCQ4WZfhUA1HwT3x651e/R\n",
-    "iv": "/qI8F9cvnfKG7ZXE\n",
+    "iv": "1/zGwcQPQQQCiXIs\n",
-    "auth_tag": "z1+MPdkO/+SCaag2ULelPg==\n",
+    "auth_tag": "siK9ph1q3/VVEycy91wkqQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "s3_secret_key": {
-    "encrypted_data": "RMnB9kZ+slbQXfpo0udYld6S1QqBxqM1YbszdLfSAdKK9I0J3Kmvh/CQ5Fbx\nyov6LClmsl1rjtH16r7cY32M4Woq+6miERdtecyDrrYkNHz0xkA=\n",
+    "encrypted_data": "BSAc8dE/rQUiVvTGV6Ee/ZUDpq4HZlpoaCZ+lbQAbcnxui4ib0OTLPFwhVJ9\n4OQWahtSzkqxMc6MKWpadLT1a3oTnvnae9b3u40X5b2P3VyZYCM=\n",
-    "iv": "pO7bm3aOtjuwYjG/\n",
+    "iv": "bqw8GTqLMTs5vD5n\n",
-    "auth_tag": "SRvn4z1+Vd5VAGgjG64s+Q==\n",
+    "auth_tag": "+e48L1lYVNda7VE3uLOAHA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }

environments/production.json

@@ -3,7 +3,6 @@
   "override_attributes": {
     "akkounts": {
       "btcpay": {
-        "public_url": "https://btcpay.kosmos.org",
         "store_id": "FNJVVsrVkKaduPDAkRVchdegjwzsNhpceAdonCaXAwBX"
       },
       "ejabberd": {
@@ -12,10 +11,6 @@
       "lndhub": {
         "public_url": "https://lndhub.kosmos.org",
         "public_key": "024cd3be18617f39cf645851e3ba63f51fc13f0bb09e3bb25e6fd4de556486d946"
-      },
-      "nostr": {
-        "public_key": "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a",
-        "relay_url": "wss://nostr.kosmos.org"
       }
     },
     "discourse": {
@@ -38,7 +33,8 @@
         "hostmaster@kosmos.org":  "mail@kosmos.org",
         "postmaster@kosmos.org":  "mail@kosmos.org",
         "abuse@kosmos.org":       "mail@kosmos.org",
-        "mail@kosmos.org":        "foundation@kosmos.org"
+        "mail@kosmos.org":        "foundation@kosmos.org",
+        "hackerhouse@kosmos.org": "mail@lagrange6.com"
       }
     },
     "garage": {
@@ -77,7 +73,6 @@
     },
     "kosmos-mastodon": {
       "domain": "kosmos.social",
-      "user_address_domain": "kosmos.social",
       "s3_endpoint": "http://localhost:3900",
       "s3_region": "garage",
       "s3_bucket": "kosmos-social",
@@ -102,22 +97,6 @@
     },
     "sentry": {
       "allowed_ips": "10.1.1.0/24"
-    },
-    "strfry": {
-      "domain": "nostr.kosmos.org",
-      "real_ip_header": "x-real-ip",
-      "policy_path": "/opt/strfry/strfry-policy.ts",
-      "whitelist_pubkeys": [
-        "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a",
-        "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf"
-      ],
-      "info": {
-        "name": "Kosmos Relay",
-        "description": "Members-only nostr relay for kosmos.org users",
-        "pubkey": "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf",
-        "contact": "ops@kosmos.org",
-        "icon": "https://assets.kosmos.org/img/app-icon-256px.png"
-      }
     }
   }
 }

nodes/akaunting-1.json

@@ -1,66 +0,0 @@
-{
-  "name": "akaunting-1",
-  "chef_environment": "production",
-  "normal": {
-    "knife_zero": {
-      "host": "10.1.1.215"
-    }
-  },
-  "automatic": {
-    "fqdn": "akaunting-1",
-    "os": "linux",
-    "os_version": "5.15.0-1069-kvm",
-    "hostname": "akaunting-1",
-    "ipaddress": "192.168.122.162",
-    "roles": [
-      "base",
-      "kvm_guest",
-      "akaunting",
-      "postgresql_client"
-    ],
-    "recipes": [
-      "kosmos-base",
-      "kosmos-base::default",
-      "kosmos_kvm::guest",
-      "kosmos_postgresql::hostsfile",
-      "kosmos_akaunting",
-      "kosmos_akaunting::default",
-      "apt::default",
-      "timezone_iii::default",
-      "timezone_iii::debian",
-      "ntp::default",
-      "ntp::apparmor",
-      "kosmos-base::systemd_emails",
-      "apt::unattended-upgrades",
-      "kosmos-base::firewall",
-      "kosmos-postfix::default",
-      "postfix::default",
-      "postfix::_common",
-      "postfix::_attributes",
-      "postfix::sasl_auth",
-      "hostname::default",
-      "kosmos-nodejs::default",
-      "nodejs::nodejs_from_package",
-      "nodejs::repo"
-    ],
-    "platform": "ubuntu",
-    "platform_version": "22.04",
-    "cloud": null,
-    "chef_packages": {
-      "chef": {
-        "version": "18.5.0",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
-        "chef_effortless": null
-      },
-      "ohai": {
-        "version": "18.1.11",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
-      }
-    }
-  },
-  "run_list": [
-    "role[base]",
-    "role[kvm_guest]",
-    "role[akaunting]"
-  ]
-}

nodes/bitcoin-2.json

@@ -16,6 +16,7 @@
       "kvm_guest",
       "sentry_client",
       "bitcoind",
+      "cln",
       "lnd",
       "lndhub",
       "postgresql_client",
@@ -29,8 +30,10 @@
       "tor-full",
       "tor-full::default",
       "kosmos-bitcoin::bitcoind",
+      "kosmos-bitcoin::c-lightning",
       "kosmos-bitcoin::lnd",
       "kosmos-bitcoin::lnd-scb-s3",
+      "kosmos-bitcoin::boltz",
       "kosmos-bitcoin::rtl",
       "kosmos-bitcoin::peerswap-lnd",
       "kosmos_postgresql::hostsfile",
@@ -100,6 +103,7 @@
     "role[sentry_client]",
     "recipe[tor-full]",
     "role[bitcoind]",
+    "role[cln]",
     "role[lnd]",
     "role[lndhub]",
     "role[btcpay]"

nodes/draco.kosmos.org.json

@@ -54,10 +54,8 @@
       "kosmos_liquor-cabinet::nginx",
       "kosmos_rsk::nginx_testnet",
       "kosmos_rsk::nginx_mainnet",
-      "kosmos_strfry::nginx",
       "kosmos_website",
       "kosmos_website::default",
-      "kosmos_website::redirects",
       "kosmos-akkounts::nginx",
       "kosmos-akkounts::nginx_api",
       "kosmos-bitcoin::nginx_lndhub",

nodes/fornax.kosmos.org.json

@@ -48,10 +48,8 @@
       "kosmos_liquor-cabinet::nginx",
       "kosmos_rsk::nginx_testnet",
       "kosmos_rsk::nginx_mainnet",
-      "kosmos_strfry::nginx",
       "kosmos_website",
       "kosmos_website::default",
-      "kosmos_website::redirects",
       "kosmos-akkounts::nginx",
       "kosmos-akkounts::nginx_api",
       "kosmos-bitcoin::nginx_lndhub",

nodes/garage-4.json

@@ -1,17 +1,17 @@
 {
-  "name": "garage-10",
+  "name": "garage-4",
   "chef_environment": "production",
   "normal": {
     "knife_zero": {
-      "host": "10.1.1.27"
+      "host": "10.1.1.104"
     }
   },
   "automatic": {
-    "fqdn": "garage-10",
+    "fqdn": "garage-4",
     "os": "linux",
-    "os_version": "5.4.0-1090-kvm",
+    "os_version": "5.4.0-132-generic",
-    "hostname": "garage-10",
+    "hostname": "garage-4",
-    "ipaddress": "192.168.122.70",
+    "ipaddress": "192.168.122.123",
     "roles": [
       "base",
       "kvm_guest",
@@ -23,8 +23,7 @@
       "kosmos_kvm::guest",
       "kosmos_garage",
       "kosmos_garage::default",
-      "kosmos_garage::firewall_rpc",
+      "kosmos_garage::firewall",
-      "kosmos_garage::firewall_apis",
       "apt::default",
       "timezone_iii::default",
       "timezone_iii::debian",
@@ -39,20 +38,21 @@
       "postfix::_attributes",
       "postfix::sasl_auth",
       "hostname::default",
-      "firewall::default"
+      "firewall::default",
+      "chef-sugar::default"
     ],
     "platform": "ubuntu",
     "platform_version": "20.04",
     "cloud": null,
     "chef_packages": {
       "chef": {
-        "version": "18.5.0",
+        "version": "17.10.3",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.0.0/gems/chef-17.10.3/lib",
         "chef_effortless": null
       },
       "ohai": {
-        "version": "18.1.11",
+        "version": "17.9.0",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.0.0/gems/ohai-17.9.0/lib/ohai"
       }
     }
   },

nodes/garage-5.json

@@ -1,17 +1,17 @@
 {
-  "name": "garage-11",
+  "name": "garage-5",
   "chef_environment": "production",
   "normal": {
     "knife_zero": {
-      "host": "10.1.1.165"
+      "host": "10.1.1.33"
     }
   },
   "automatic": {
-    "fqdn": "garage-11",
+    "fqdn": "garage-5",
     "os": "linux",
-    "os_version": "5.15.0-1059-kvm",
+    "os_version": "5.15.0-84-generic",
-    "hostname": "garage-11",
+    "hostname": "garage-5",
-    "ipaddress": "192.168.122.9",
+    "ipaddress": "192.168.122.55",
     "roles": [
       "base",
       "kvm_guest",
@@ -46,13 +46,13 @@
     "cloud": null,
     "chef_packages": {
       "chef": {
-        "version": "18.5.0",
+        "version": "18.3.0",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.3.0/lib",
         "chef_effortless": null
       },
       "ohai": {
-        "version": "18.1.11",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
       }
     }
   },

nodes/garage-6.json

@@ -1,17 +1,17 @@
 {
-  "name": "garage-9",
+  "name": "garage-6",
   "chef_environment": "production",
   "normal": {
     "knife_zero": {
-      "host": "10.1.1.223"
+      "host": "10.1.1.161"
     }
   },
   "automatic": {
-    "fqdn": "garage-9",
+    "fqdn": "garage-6",
     "os": "linux",
     "os_version": "5.4.0-1090-kvm",
-    "hostname": "garage-9",
+    "hostname": "garage-6",
-    "ipaddress": "192.168.122.21",
+    "ipaddress": "192.168.122.213",
     "roles": [
       "base",
       "kvm_guest",
@@ -46,13 +46,13 @@
     "cloud": null,
     "chef_packages": {
       "chef": {
-        "version": "18.5.0",
+        "version": "18.3.0",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.3.0/lib",
         "chef_effortless": null
       },
       "ohai": {
-        "version": "18.1.11",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
       }
     }
   },

nodes/gitea-2.json

@@ -32,7 +32,6 @@
       "kosmos_postgresql::hostsfile",
       "kosmos_gitea",
       "kosmos_gitea::default",
-      "kosmos_gitea::backup",
       "kosmos_gitea::act_runner",
       "apt::default",
       "timezone_iii::default",
@@ -48,9 +47,7 @@
       "postfix::_attributes",
       "postfix::sasl_auth",
       "hostname::default",
-      "firewall::default",
+      "firewall::default"
-      "backup::default",
-      "logrotate::default"
     ],
     "platform": "ubuntu",
     "platform_version": "20.04",

nodes/her.json

@@ -9,7 +9,7 @@
   "automatic": {
     "fqdn": "her",
     "os": "linux",
-    "os_version": "5.15.0-101-generic",
+    "os_version": "5.15.0-84-generic",
     "hostname": "her",
     "ipaddress": "192.168.30.172",
     "roles": [

nodes/mail.kosmos.org.json

@@ -10,7 +10,7 @@
     "fqdn": "mail.kosmos.org",
     "os": "linux",
     "os_version": "5.15.0-1048-kvm",
-    "hostname": "mail.kosmos.org",
+    "hostname": "mail",
     "ipaddress": "192.168.122.131",
     "roles": [
       "base",

nodes/mastodon-3.json

@@ -14,7 +14,6 @@
     "ipaddress": "192.168.122.161",
     "roles": [
       "kvm_guest",
-      "ldap_client",
       "garage_gateway",
       "mastodon",
       "postgresql_client"
@@ -23,7 +22,6 @@
       "kosmos-base",
       "kosmos-base::default",
       "kosmos_kvm::guest",
-      "kosmos-dirsrv::hostsfile",
       "kosmos_garage",
       "kosmos_garage::default",
       "kosmos_garage::firewall_rpc",
@@ -63,6 +61,8 @@
       "redisio::disable_os_default",
       "redisio::configure",
       "redisio::enable",
+      "nodejs::npm",
+      "nodejs::install",
       "backup::default",
       "logrotate::default"
     ],
@@ -84,7 +84,6 @@
   "run_list": [
     "recipe[kosmos-base]",
     "role[kvm_guest]",
-    "role[ldap_client]",
     "role[garage_gateway]",
     "role[mastodon]"
   ]

nodes/postgres-5.json

@@ -1,29 +1,32 @@
 {
-  "name": "postgres-7",
+  "name": "postgres-5",
-  "chef_environment": "production",
   "normal": {
     "knife_zero": {
-      "host": "10.1.1.134"
+      "host": "10.1.1.54"
     }
   },
   "automatic": {
-    "fqdn": "postgres-7",
+    "fqdn": "postgres-5",
     "os": "linux",
-    "os_version": "5.4.0-1123-kvm",
+    "os_version": "5.4.0-153-generic",
-    "hostname": "postgres-7",
+    "hostname": "postgres-5",
-    "ipaddress": "192.168.122.89",
+    "ipaddress": "192.168.122.211",
     "roles": [
       "base",
       "kvm_guest",
-      "postgresql_replica"
+      "postgresql_primary"
     ],
     "recipes": [
       "kosmos-base",
       "kosmos-base::default",
       "kosmos_kvm::guest",
-      "kosmos_postgresql::hostsfile",
+      "kosmos_postgresql::primary",
-      "kosmos_postgresql::replica",
       "kosmos_postgresql::firewall",
+      "kosmos-bitcoin::lndhub-go_pg_db",
+      "kosmos-bitcoin::nbxplorer_pg_db",
+      "kosmos_drone::pg_db",
+      "kosmos_gitea::pg_db",
+      "kosmos-mastodon::pg_db",
       "apt::default",
       "timezone_iii::default",
       "timezone_iii::debian",
@@ -44,19 +47,19 @@
     "cloud": null,
     "chef_packages": {
       "chef": {
-        "version": "18.5.0",
+        "version": "18.2.7",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.2.7/lib",
         "chef_effortless": null
       },
       "ohai": {
-        "version": "18.1.11",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
       }
     }
   },
   "run_list": [
     "role[base]",
     "role[kvm_guest]",
-    "role[postgresql_replica]"
+    "role[postgresql_primary]"
   ]
 }

nodes/postgres-6.json

@@ -13,21 +13,12 @@
     "ipaddress": "192.168.122.60",
     "roles": [
       "base",
-      "kvm_guest",
+      "kvm_guest"
-      "postgresql_primary"
     ],
     "recipes": [
       "kosmos-base",
       "kosmos-base::default",
       "kosmos_kvm::guest",
-      "kosmos_postgresql::primary",
-      "kosmos_postgresql::firewall",
-      "kosmos_akaunting::pg_db",
-      "kosmos-bitcoin::lndhub-go_pg_db",
-      "kosmos-bitcoin::nbxplorer_pg_db",
-      "kosmos_drone::pg_db",
-      "kosmos_gitea::pg_db",
-      "kosmos-mastodon::pg_db",
       "apt::default",
       "timezone_iii::default",
       "timezone_iii::debian",
@@ -61,6 +52,6 @@
   "run_list": [
     "role[base]",
     "role[kvm_guest]",
-    "role[postgresql_primary]"
+    "role[postgresql_replica]"
   ]
 }

nodes/postgres-8.json

@@ -1,62 +0,0 @@
-{
-  "name": "postgres-8",
-  "chef_environment": "production",
-  "normal": {
-    "knife_zero": {
-      "host": "10.1.1.99"
-    }
-  },
-  "automatic": {
-    "fqdn": "postgres-8",
-    "os": "linux",
-    "os_version": "5.15.0-1059-kvm",
-    "hostname": "postgres-8",
-    "ipaddress": "192.168.122.100",
-    "roles": [
-      "base",
-      "kvm_guest",
-      "postgresql_replica"
-    ],
-    "recipes": [
-      "kosmos-base",
-      "kosmos-base::default",
-      "kosmos_kvm::guest",
-      "kosmos_postgresql::hostsfile",
-      "kosmos_postgresql::replica",
-      "kosmos_postgresql::firewall",
-      "apt::default",
-      "timezone_iii::default",
-      "timezone_iii::debian",
-      "ntp::default",
-      "ntp::apparmor",
-      "kosmos-base::systemd_emails",
-      "apt::unattended-upgrades",
-      "kosmos-base::firewall",
-      "kosmos-postfix::default",
-      "postfix::default",
-      "postfix::_common",
-      "postfix::_attributes",
-      "postfix::sasl_auth",
-      "hostname::default"
-    ],
-    "platform": "ubuntu",
-    "platform_version": "22.04",
-    "cloud": null,
-    "chef_packages": {
-      "chef": {
-        "version": "18.5.0",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
-        "chef_effortless": null
-      },
-      "ohai": {
-        "version": "18.1.11",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
-      }
-    }
-  },
-  "run_list": [
-    "role[base]",
-    "role[kvm_guest]",
-    "role[postgresql_replica]"
-  ]
-}

nodes/strfry-1.json

@@ -1,66 +0,0 @@
-{
-  "name": "strfry-1",
-  "chef_environment": "production",
-  "normal": {
-    "knife_zero": {
-      "host": "10.1.1.164"
-    }
-  },
-  "automatic": {
-    "fqdn": "strfry-1",
-    "os": "linux",
-    "os_version": "5.15.0-1060-kvm",
-    "hostname": "strfry-1",
-    "ipaddress": "192.168.122.54",
-    "roles": [
-      "base",
-      "kvm_guest",
-      "strfry",
-      "ldap_client"
-    ],
-    "recipes": [
-      "kosmos-base",
-      "kosmos-base::default",
-      "kosmos_kvm::guest",
-      "kosmos-dirsrv::hostsfile",
-      "strfry",
-      "strfry::default",
-      "kosmos_strfry::policies",
-      "kosmos_strfry::firewall",
-      "apt::default",
-      "timezone_iii::default",
-      "timezone_iii::debian",
-      "ntp::default",
-      "ntp::apparmor",
-      "kosmos-base::systemd_emails",
-      "apt::unattended-upgrades",
-      "kosmos-base::firewall",
-      "kosmos-postfix::default",
-      "postfix::default",
-      "postfix::_common",
-      "postfix::_attributes",
-      "postfix::sasl_auth",
-      "hostname::default",
-      "deno::default"
-    ],
-    "platform": "ubuntu",
-    "platform_version": "22.04",
-    "cloud": null,
-    "chef_packages": {
-      "chef": {
-        "version": "18.4.12",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.4.12/lib",
-        "chef_effortless": null
-      },
-      "ohai": {
-        "version": "18.1.11",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
-      }
-    }
-  },
-  "run_list": [
-    "role[base]",
-    "role[kvm_guest]",
-    "role[strfry]"
-  ]
-}

nodes/wiki-1.json

@@ -8,19 +8,16 @@
   "automatic": {
     "fqdn": "wiki-1",
     "os": "linux",
-    "os_version": "5.4.0-167-generic",
+    "os_version": "5.4.0-91-generic",
     "hostname": "wiki-1",
     "ipaddress": "192.168.122.26",
     "roles": [
-      "base",
+      "kvm_guest"
-      "kvm_guest",
-      "ldap_client"
     ],
     "recipes": [
       "kosmos-base",
       "kosmos-base::default",
       "kosmos_kvm::guest",
-      "kosmos-dirsrv::hostsfile",
       "kosmos-mediawiki",
       "kosmos-mediawiki::default",
       "apt::default",
@@ -44,6 +41,7 @@
       "php::package",
       "php::ini",
       "composer::global_configs",
+      "kosmos-dirsrv::hostsfile",
       "mediawiki::default",
       "mediawiki::database",
       "kosmos-nginx::default",

roles/akaunting.rb

@@ -1,6 +0,0 @@
-name "akaunting"
-
-run_list %w[
-  role[postgresql_client]
-  kosmos_akaunting::default
-]

roles/gitea.rb

@@ -3,5 +3,4 @@ name "gitea"
 run_list %w(
   role[postgresql_client]
   kosmos_gitea::default
-  kosmos_gitea::backup
 )

roles/lnd.rb

@@ -3,6 +3,7 @@ name "lnd"
 run_list %w(
   kosmos-bitcoin::lnd
   kosmos-bitcoin::lnd-scb-s3
+  kosmos-bitcoin::boltz
   kosmos-bitcoin::rtl
   kosmos-bitcoin::peerswap-lnd
 )

roles/openresty_proxy.rb

@@ -28,9 +28,7 @@ production_run_list = %w(
   kosmos_liquor-cabinet::nginx
   kosmos_rsk::nginx_testnet
   kosmos_rsk::nginx_mainnet
-  kosmos_strfry::nginx
   kosmos_website::default
-  kosmos_website::redirects
   kosmos-akkounts::nginx
   kosmos-akkounts::nginx_api
   kosmos-bitcoin::nginx_lndhub

roles/postgresql_primary.rb

@@ -3,7 +3,6 @@ name "postgresql_primary"
 run_list %w(
   kosmos_postgresql::primary
   kosmos_postgresql::firewall
-  kosmos_akaunting::pg_db
   kosmos-bitcoin::lndhub-go_pg_db
   kosmos-bitcoin::nbxplorer_pg_db
   kosmos_drone::pg_db

roles/strfry.rb

@@ -1,8 +0,0 @@
-name "strfry"
-
-run_list %w(
-  role[ldap_client]
-  strfry::default
-  kosmos_strfry::policies
-  kosmos_strfry::firewall
-)

site-cookbooks/backup/attributes/default.rb

@@ -42,5 +42,5 @@ default['backup']['orbit']['keep'] = 10
 default['backup']['cron']['hour'] = "05"
 default['backup']['cron']['minute'] = "7"
 
-default['backup']['s3']['keep'] = 10
+default['backup']['s3']['keep'] = 15
-default['backup']['s3']['bucket'] = "kosmos-backups"
+default['backup']['s3']['bucket'] = "kosmos-dev-backups"

site-cookbooks/backup/recipes/default.rb

@@ -28,7 +28,6 @@ template "#{backup_dir}/config.rb" do
   sensitive true
   variables s3_access_key_id: backup_data["s3_access_key_id"],
             s3_secret_access_key: backup_data["s3_secret_access_key"],
-            s3_endpoint: backup_data["s3_endpoint"],
             s3_region: backup_data["s3_region"],
             encryption_password: backup_data["encryption_password"],
             mail_from: "backups@kosmos.org",

site-cookbooks/backup/templates/default/config.rb.erb

@@ -23,10 +23,6 @@ Storage::S3.defaults do |s3|
   s3.secret_access_key = "<%= @s3_secret_access_key %>"
   s3.region            = "<%= @s3_region %>"
   s3.bucket            = "<%= node['backup']['s3']['bucket'] %>"
-  s3.fog_options       = {
-    endpoint: "<%= @s3_endpoint %>",
-    aws_signature_version: 2
-  }
 end
 
 Encryptor::OpenSSL.defaults do |encryption|
@@ -92,6 +88,7 @@ end
 
 preconfigure 'KosmosBackup' do
   split_into_chunks_of 250 # megabytes
+  store_with S3
   compress_with Bzip2
   encrypt_with OpenSSL
   notify_by Mail do |mail|

site-cookbooks/kosmos-akkounts/attributes/default.rb

@@ -1,5 +1,5 @@
 node.default['akkounts']['repo'] = 'https://gitea.kosmos.org/kosmos/akkounts.git'
-node.default['akkounts']['revision'] = 'live'
+node.default['akkounts']['revision'] = 'master'
 node.default['akkounts']['port'] = 3000
 node.default['akkounts']['domain'] = 'accounts.kosmos.org'
 node.default['akkounts']['primary_domain'] = 'kosmos.org'
@@ -11,7 +11,6 @@ node.default['akkounts']['smtp']['domain']          = 'kosmos.org'
 node.default['akkounts']['smtp']['auth_method']     = 'plain'
 node.default['akkounts']['smtp']['enable_starttls'] = 'auto'
 
-node.default['akkounts']['btcpay']['public_url'] = nil
 node.default['akkounts']['btcpay']['store_id'] = nil
 
 node.default['akkounts']['ejabberd']['admin_url'] = nil
@@ -21,9 +20,6 @@ node.default['akkounts']['lndhub']['public_url'] = nil
 node.default['akkounts']['lndhub']['public_key'] = nil
 node.default['akkounts']['lndhub']['postgres_db'] = 'lndhub'
 
-node.default['akkounts']['nostr']['public_key'] = nil
-node.default['akkounts']['nostr']['relay_url'] = nil
-
 node.default['akkounts']['s3_enabled'] = true
 node.default['akkounts']['s3_endpoint'] = "https://s3.kosmos.org"
 node.default['akkounts']['s3_region'] = "garage"

site-cookbooks/kosmos-akkounts/recipes/default.rb

@@ -75,7 +75,6 @@ end
 
 if btcpay_host
   env[:btcpay_api_url] = "http://#{btcpay_host}:23001/api/v1"
-  env[:btcpay_public_url] = node['akkounts']['btcpay']['public_url']
   env[:btcpay_store_id] = node['akkounts']['btcpay']['store_id']
   env[:btcpay_auth_token] = credentials["btcpay_auth_token"]
 end
@@ -149,7 +148,6 @@ end
 #
 
 env[:mastodon_public_url] = "https://#{node['kosmos-mastodon']['domain']}"
-env[:mastodon_address_domain] = node['kosmos-mastodon']['user_address_domain']
 
 #
 # MediaWiki
@@ -157,14 +155,6 @@ env[:mastodon_address_domain] = node['kosmos-mastodon']['user_address_domain']
 
 env[:mediawiki_public_url] = node['mediawiki']['url']
 
-#
-# Nostr
-#
-
-env[:nostr_private_key] = credentials['nostr_private_key']
-env[:nostr_public_key] = node['akkounts']['nostr']['public_key']
-env[:nostr_relay_url] = node['akkounts']['nostr']['relay_url']
-
 #
 # remoteStorage / Liquor Cabinet
 #

site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts.erb

@@ -14,10 +14,6 @@ server {
   listen [::]:443 ssl http2;
   server_name <%= @domain %>;
 
-  if ($host != $server_name) {
-    return 301 $scheme://$server_name$request_uri;
-  }
-
   ssl_certificate     <%= @ssl_cert %>;
   ssl_certificate_key <%= @ssl_key %>;
 
@@ -43,9 +39,6 @@ server {
 
   location @proxy {
     proxy_set_header Host $http_host;
-    set $x_forwarded_host $http_x_forwarded_host;
-    if ($x_forwarded_host = "") { set $x_forwarded_host $host; }
-    proxy_set_header X-Forwarded-Host $x_forwarded_host;
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto https;

site-cookbooks/kosmos-base/recipes/letsencrypt.rb

@@ -2,6 +2,27 @@
 # Cookbook Name:: kosmos-base
 # Recipe:: letsencrypt
 #
+# The MIT License (MIT)
+#
+# Copyright:: 2019, Kosmos Developers
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to deal
+# in the Software without restriction, including without limitation the rights
+# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+# copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+# THE SOFTWARE.
 
 unless platform?('ubuntu')
   raise "This recipe only supports Ubuntu installs"

site-cookbooks/kosmos-base/resources/tls_cert_for.rb

@@ -3,8 +3,6 @@ provides :tls_cert_for
 
 property :domain, [String, Array], name_property: true
 property :auth, [String, NilClass], default: nil
-property :deploy_hook, [String, NilClass], default: nil
-property :acme_domain, [String, NilClass], default: nil
 
 default_action :create
 
@@ -19,35 +17,13 @@ action :create do
 
   case new_resource.auth
   when "gandi_dns"
-    gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
+    gandi_api_data_bag_item = data_bag_item('credentials', 'gandi_api_5apps')
 
     hook_path = "/root/gandi_dns_certbot_hook.sh"
-    hook_auth_command = "#{hook_path} auth"
-    hook_cleanup_command = "#{hook_path} cleanup"
-
-    if new_resource.acme_domain
-      hook_auth_command += " #{new_resource.acme_domain}"
-      hook_cleanup_command += " #{new_resource.acme_domain}"
-    end
-
     template hook_path do
       cookbook "kosmos-base"
-      variables access_token: gandi_api_credentials["access_token"]
+      variables gandi_api_key: gandi_api_data_bag_item["key"]
-      mode 0700
+      mode 0770
-      sensitive true
-    end
-
-    if new_resource.deploy_hook
-      deploy_hook_path = "/etc/letsencrypt/renewal-hooks/#{domains.first}"
-
-      file deploy_hook_path do
-        content new_resource.deploy_hook
-        mode 0755
-        owner "root"
-        group "root"
-      end
-    elsif node.run_list.roles.include?("openresty_proxy")
-      deploy_hook_path = "/etc/letsencrypt/renewal-hooks/post/openresty"
     end
 
     # Generate a Let's Encrypt cert (only if no cert has been generated before).
@@ -56,11 +32,12 @@ action :create do
       command <<-CMD
       certbot certonly --manual -n \
         --preferred-challenges dns \
+        --manual-public-ip-logging-ok \
         --agree-tos \
-        --manual-auth-hook '#{hook_auth_command}' \
+        --manual-auth-hook '#{hook_path} auth' \
-        --manual-cleanup-hook '#{hook_cleanup_command}' \
+        --manual-cleanup-hook '#{hook_path} cleanup' \
         --email ops@kosmos.org \
-        #{"--deploy-hook #{deploy_hook_path}" if defined?(deploy_hook_path)} \
+        #{node.run_list.roles.include?("openresty_proxy") ? '--deploy-hook /etc/letsencrypt/renewal-hooks/post/openresty' : nil } \
         #{domains.map {|d| "-d #{d}" }.join(" ")}
       CMD
       not_if do

site-cookbooks/kosmos-base/templates/default/gandi_dns_certbot_hook.sh.erb

@@ -1,16 +1,21 @@
 #!/usr/bin/env bash
+#
+
 set -euf -o pipefail
 
 # ************** USAGE **************
 #
-# Example usage:
+# Example usage (with this hook file saved in /root/):
 #
+#   sudo su -
 #   certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos -d "5apps.com" -d muc.5apps.com -d "xmpp.5apps.com" \
 #     --manual-auth-hook "/root/letsencrypt_hook.sh auth" --manual-cleanup-hook "/root/letsencrypt_hook.sh cleanup"
 #
+# This hook requires configuration, continue reading.
+#
 # ************** CONFIGURATION **************
 #
-# ACCESS_TOKEN: Your Gandi Live API key
+# GANDI_API_KEY: Your Gandi Live API key
 #
 # PROVIDER_UPDATE_DELAY:
 #   How many seconds to wait after updating your DNS records. This may be required,
@@ -20,16 +25,10 @@ set -euf -o pipefail
 #
 #   Defaults to 30 seconds.
 #
-# VALIDATION_DOMAIN:
+GANDI_API_KEY="<%= @gandi_api_key %>"
-#   Domain to create ACME DNS entries on. Use this when redirecting ACME subdomains
-#   from the original domain to a proxy validation domain that we control.
-#
-ACCESS_TOKEN="<%= @access_token %>"
 PROVIDER_UPDATE_DELAY=10
-VALIDATION_DOMAIN="${2:-}"
 
 regex='.*\.(.*\..*)'
-
 if [[ $CERTBOT_DOMAIN =~ $regex ]]
 then
   DOMAIN="${BASH_REMATCH[1]}"
@@ -37,41 +36,25 @@ else
   DOMAIN="${CERTBOT_DOMAIN}"
 fi
 
-if [[ -n "$VALIDATION_DOMAIN" ]]
-then
-  if [[ $VALIDATION_DOMAIN =~ $regex ]]
-  then
-    ACME_BASE_DOMAIN="${BASH_REMATCH[1]}"
-  else
-    echo "Validation domain has to be a subdomain, but it is not: \"${VALIDATION_DOMAIN}\""
-    exit 1
-  fi
-  ACME_DOMAIN="${CERTBOT_DOMAIN}.${VALIDATION_DOMAIN}"
-else
-  ACME_BASE_DOMAIN="${DOMAIN}"
-  ACME_DOMAIN="_acme-challenge.${CERTBOT_DOMAIN}"
-fi
-
 # To be invoked via Certbot's --manual-auth-hook
 function auth {
-  curl -s -D- \
+    curl -s -D- -H "Content-Type: application/json" \
-       -H "Content-Type: application/json" \
+        -H "X-Api-Key: ${GANDI_API_KEY}" \
-       -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+        -d "{\"rrset_name\": \"_acme-challenge.${CERTBOT_DOMAIN}.\",
-       -d "{\"rrset_name\": \"${ACME_DOMAIN}.\",
+             \"rrset_type\": \"TXT\",
-            \"rrset_type\": \"TXT\",
+             \"rrset_ttl\": 3600,
-            \"rrset_ttl\": 300,
+             \"rrset_values\": [\"${CERTBOT_VALIDATION}\"]}" \
-            \"rrset_values\": [\"${CERTBOT_VALIDATION}\"]}" \
+        "https://dns.api.gandi.net/api/v5/domains/${DOMAIN}/records"
-       "https://api.gandi.net/v5/livedns/domains/${ACME_BASE_DOMAIN}/records"
 
-  sleep ${PROVIDER_UPDATE_DELAY}
+
+    sleep ${PROVIDER_UPDATE_DELAY}
 }
 
 # To be invoked via Certbot's --manual-cleanup-hook
 function cleanup {
-  curl -s -X DELETE \
+    curl -s -X DELETE -H "Content-Type: application/json" \
-       -H "Content-Type: application/json" \
+        -H "X-Api-Key: ${GANDI_API_KEY}" \
-       -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+        https://dns.api.gandi.net/api/v5/domains/${DOMAIN}/records/_acme-challenge.${CERTBOT_DOMAIN}./TXT
-       "https://api.gandi.net/v5/livedns/domains/${ACME_BASE_DOMAIN}/records/${ACME_DOMAIN}./TXT"
 }
 
 HANDLER=$1; shift;

site-cookbooks/kosmos-bitcoin/attributes/default.rb

@@ -1,5 +1,5 @@
-node.default['bitcoin']['version']   = '28.0'
+node.default['bitcoin']['version']   = '26.0'
-node.default['bitcoin']['checksum']  = '700ae2d1e204602eb07f2779a6e6669893bc96c0dca290593f80ff8e102ff37f'
+node.default['bitcoin']['checksum']  = 'ab1d99276e28db62d1d9f3901e85ac358d7f1ebcb942d348a9c4e46f0fcdc0a1'
 node.default['bitcoin']['username']  = 'satoshi'
 node.default['bitcoin']['usergroup'] = 'bitcoin'
 node.default['bitcoin']['network']   = 'mainnet'
@@ -24,8 +24,7 @@ node.default['bitcoin']['conf'] = {
   rpcbind: "127.0.0.1:8332",
   gen: 0,
   zmqpubrawblock: 'tcp://127.0.0.1:8337',
-  zmqpubrawtx: 'tcp://127.0.0.1:8338',
+  zmqpubrawtx: 'tcp://127.0.0.1:8338'
-  deprecatedrpc: 'warnings' # TODO remove when upgrading to LND 0.18.4
 }
 
 # Also enables Tor for LND
@@ -41,7 +40,7 @@ node.default['c-lightning']['log_level'] = 'info'
 node.default['c-lightning']['public_ip'] = '148.251.237.73'
 
 node.default['lnd']['repo'] = 'https://github.com/lightningnetwork/lnd'
-node.default['lnd']['revision'] = 'v0.18.3-beta'
+node.default['lnd']['revision'] = 'v0.17.3-beta'
 node.default['lnd']['source_dir'] = '/opt/lnd'
 node.default['lnd']['lnd_dir'] = "/home/#{node['bitcoin']['username']}/.lnd"
 node.default['lnd']['alias'] = 'ln2.kosmos.org'
@@ -59,13 +58,24 @@ node.default['lnd']['tor'] = {
   'skip-proxy-for-clearnet-targets' => 'true'
 }
 
+node.default['boltz']['repo'] = 'https://github.com/BoltzExchange/boltz-lnd.git'
+node.default['boltz']['revision'] = 'v1.2.7'
+node.default['boltz']['source_dir'] = '/opt/boltz'
+node.default['boltz']['boltz_dir'] = "/home/#{node['bitcoin']['username']}/.boltz-lnd"
+node.default['boltz']['grpc_host'] = '127.0.0.1'
+node.default['boltz']['grpc_port'] = '9002'
+node.default['boltz']['rest_disabled'] = 'false'
+node.default['boltz']['rest_host'] = '127.0.0.1'
+node.default['boltz']['rest_port'] = '9003'
+node.default['boltz']['no_macaroons'] = 'false'
+
 node.default['rtl']['repo'] = 'https://github.com/Ride-The-Lightning/RTL.git'
-node.default['rtl']['revision'] = 'v0.15.2'
+node.default['rtl']['revision'] = 'v0.15.0'
 node.default['rtl']['host'] = '10.1.1.163'
 node.default['rtl']['port'] = '3000'
 
 node.default['lndhub-go']['repo'] = 'https://github.com/getAlby/lndhub.go.git'
-node.default['lndhub-go']['revision'] = '1.0.2'
+node.default['lndhub-go']['revision'] = '0.14.0'
 node.default['lndhub-go']['source_dir'] = '/opt/lndhub-go'
 node.default['lndhub-go']['port'] = 3026
 node.default['lndhub-go']['domain'] = 'lndhub.kosmos.org'
@@ -73,10 +83,8 @@ node.default['lndhub-go']['postgres']['database'] = 'lndhub'
 node.default['lndhub-go']['postgres']['user'] = 'lndhub'
 node.default['lndhub-go']['postgres']['port'] = 5432
 node.default['lndhub-go']['default_rate_limit'] = 20
-node.default['lndhub-go']['strict_rate_limit'] = 1
+node.default['lndhub-go']['strict_rate_limit'] =  1
-node.default['lndhub-go']['burst_rate_limit'] = 10
+node.default['lndhub-go']['burst_rate_limit'] =  10
-node.default['lndhub-go']['service_fee'] = 1
-node.default['lndhub-go']['no_service_fee_up_to_amount'] = 1000
 node.default['lndhub-go']['branding'] = {
   'title' => 'LndHub - Kosmos Lightning',
   'desc' => 'Kosmos accounts for the Lightning Network',

site-cookbooks/kosmos-bitcoin/recipes/aws-client.rb

@@ -11,7 +11,6 @@ credentials = Chef::EncryptedDataBagItem.load('credentials', 'backup')
 
 file "/root/.aws/config" do
   mode "600"
-  sensitive true
   content lazy { <<-EOF
 [default]
 region = #{credentials["s3_region"]}

site-cookbooks/kosmos-bitcoin/recipes/bitcoind.rb

@@ -12,15 +12,8 @@ if node["bitcoin"]["blocksdir_mount_type"]
   include_recipe "kosmos-bitcoin::blocksdir-mount"
 end
 
-apt_repository "ubuntu-toolchain-r" do
+%w{ libtool autotools-dev make automake cmake curl g++-multilib libtool
-  # provides g++-13, needed for better c++-20 support
+    binutils-gold bsdmainutils pkg-config python3 patch }.each do |pkg|
-  uri "ppa:ubuntu-toolchain-r/test"
-end
-
-%w{
-  gcc-13 g++-13 libtool autotools-dev make automake cmake curl bison
-  binutils-gold pkg-config python3 patch
-}.each do |pkg|
   apt_package pkg
 end
 
@@ -33,21 +26,20 @@ end
 
 execute "compile_bitcoin-core_dependencies" do
   cwd "/usr/local/bitcoind/depends"
-  environment ({'CC' => 'gcc-13', 'CXX' => 'g++-13', 'NO_QT' => '1'})
+  command "make NO_QT=1"
-  command "make -j 2"
   action :nothing
   notifies :run, 'bash[compile_bitcoin-core]', :immediately
 end
 
 bash "compile_bitcoin-core" do
   cwd "/usr/local/bitcoind"
-  environment ({'CC' => 'gcc-13', 'CXX' => 'g++-13', 'NO_QT' => '1'})
   code <<-EOH
     ./autogen.sh
     ./configure --prefix=$PWD/depends/x86_64-pc-linux-gnu
     make
   EOH
   action :nothing
+  notifies :restart, "systemd_unit[bitcoind.service]", :delayed
 end
 
 link "/usr/local/bin/bitcoind" do

site-cookbooks/kosmos-bitcoin/recipes/boltz.rb

@@ -0,0 +1,87 @@
+#
+# Cookbook:: kosmos-bitcoin
+# Recipe:: boltz
+#
+
+include_recipe "git"
+include_recipe "kosmos-bitcoin::golang"
+
+git node['boltz']['source_dir'] do
+  repository node['boltz']['repo']
+  revision node['boltz']['revision']
+  action :sync
+  notifies :run, 'bash[compile_and_install_boltz]', :immediately
+end
+
+bash "compile_and_install_boltz" do
+  cwd node['boltz']['source_dir']
+  code <<-EOH
+go mod vendor && \
+make build && \
+make install
+  EOH
+  action :nothing
+  notifies :restart, "systemd_unit[boltzd.service]", :delayed
+end
+
+bitcoin_user  = node['bitcoin']['username']
+bitcoin_group = node['bitcoin']['usergroup']
+boltz_dir     = node['boltz']['boltz_dir']
+lnd_dir       = node['lnd']['lnd_dir']
+
+directory boltz_dir do
+  owner bitcoin_user
+  group bitcoin_group
+  mode '0750'
+  action :create
+end
+
+template "#{boltz_dir}/boltz.toml" do
+  source "boltz.toml.erb"
+  owner bitcoin_user
+  group bitcoin_group
+  mode '0640'
+  variables lnd_grpc_host: '127.0.0.1',
+            lnd_grpc_port: '10009',
+            lnd_macaroon_path: "#{lnd_dir}/data/chain/bitcoin/mainnet/admin.macaroon",
+            lnd_tlscert_path: "#{lnd_dir}/tls.cert",
+            boltz_config: node['boltz']
+  notifies :restart, "systemd_unit[boltzd.service]", :delayed
+end
+
+systemd_unit 'boltzd.service' do
+  content({
+    Unit: {
+      Description: 'Boltz Daemon',
+      Documentation: ['https://lnd.docs.boltz.exchange'],
+      Requires: 'lnd.service',
+      After: 'lnd.service'
+    },
+    Service: {
+      User: bitcoin_user,
+      Group: bitcoin_group,
+      Type: 'simple',
+      ExecStart: "/opt/boltz/boltzd",
+      Restart: 'always',
+      RestartSec: '30',
+      TimeoutSec: '240',
+      LimitNOFILE: '128000',
+      PrivateTmp: true,
+      ProtectSystem: 'full',
+      NoNewPrivileges: true,
+      PrivateDevices: true,
+      MemoryDenyWriteExecute: true
+    },
+    Install: {
+      WantedBy: 'multi-user.target'
+    }
+  })
+  verify false
+  triggers_reload true
+  action [:create, :enable, :start]
+end
+
+unless node.chef_environment == 'development'
+  node.override['backup']['archives']['boltz'] = [node['boltz']['boltz_dir']]
+  include_recipe 'backup'
+end

site-cookbooks/kosmos-bitcoin/recipes/golang.rb

@@ -5,7 +5,7 @@
 # Internal recipe for managing the Go installation in one place
 #
 
-node.override['golang']['version'] = "1.23.1"
+node.override['golang']['version'] = "1.20.3"
 include_recipe "golang"
 
 link '/usr/local/bin/go' do

site-cookbooks/kosmos-bitcoin/recipes/lnd-scb-s3.rb

@@ -10,14 +10,12 @@ include_recipe "kosmos-bitcoin::aws-client"
 package "inotify-tools"
 
 backup_script_path = "/opt/lnd-channel-backup-s3.sh"
-backup_credentials = Chef::EncryptedDataBagItem.load('credentials', 'backup')
 
 template backup_script_path do
   source "lnd-channel-backup-s3.sh.erb"
   mode '0740'
   variables lnd_dir: node['lnd']['lnd_dir'],
             bitcoin_network: node['bitcoin']['network'],
-            s3_endpoint: backup_credentials['s3_endpoint'],
             s3_bucket: node['backup']['s3']['bucket'],
             s3_scb_dir: "#{node['name']}/lnd/#{node['bitcoin']['network']}"
   notifies :restart, "systemd_unit[lnd-channel-backup.service]", :delayed

site-cookbooks/kosmos-bitcoin/recipes/lndhub-go.rb

@@ -66,8 +66,6 @@ template "#{source_dir}/.env" do
     default_rate_limit: node['lndhub-go']['default_rate_limit'],
     strict_rate_limit: node['lndhub-go']['strict_rate_limit'],
     burst_rate_limit: node['lndhub-go']['burst_rate_limit'],
-    service_fee: 1,
-    no_service_fee_up_to_amount: 1000,
     branding: node['lndhub-go']['branding'],
     webhook_url: node['lndhub-go']['webhook_url'],
     sentry_dsn: credentials['sentry_dsn']

site-cookbooks/kosmos-bitcoin/recipes/rtl.rb

@@ -46,22 +46,24 @@ rtl_config = {
   multiPassHashed: credentials["multiPassHashed"]
 }
 
+if node['boltz']
+  # TODO adapt for multi-node usage
+  rtl_config[:nodes][0][:Authentication][:boltzMacaroonPath] = "#{node['boltz']['boltz_dir']}/macaroons"
+  rtl_config[:nodes][0][:Settings][:boltzServerUrl] = "https://#{node['boltz']['rest_host']}:#{node['boltz']['rest_port']}"
+end
+
 git rtl_dir do
   user bitcoin_user
   group bitcoin_group
   repository node['rtl']['repo']
   revision node['rtl']['revision']
-  notifies :run, "execute[npm_install]", :immediately
   notifies :restart, "systemd_unit[#{app_name}.service]", :delayed
 end
 
-execute "npm_install" do
+execute "npm install" do
   cwd rtl_dir
   environment "HOME" => rtl_dir
   user bitcoin_user
-  # TODO remove --force when upstream dependency issues have been resolved
-  command "npm install --force"
-  action :nothing
 end
 
 file "#{rtl_dir}/RTL-Config.json" do

site-cookbooks/kosmos-bitcoin/templates/boltz.toml.erb

@@ -0,0 +1,32 @@
+[LND]
+# Host of the gRPC interface of LND
+host = "<%= @lnd_grpc_host %>"
+
+# Port of the gRPC interface of LND
+port = <%= @lnd_grpc_port %>
+
+# Path to a macaroon file of LND
+# The daemon needs to have permission to read various endpoints, generate addresses and pay invoices 
+macaroon = "<%= @lnd_macaroon_path %>"
+
+# Path to the TLS certificate of LND
+certificate = "<%= @lnd_tlscert_path %>"
+
+[RPC]
+# Host of the gRPC interface
+host = "<%= @boltz_config['grpc_host'] %>"
+
+# Port of the gRPC interface
+port = <%= @boltz_config['grpc_port'] %>
+
+# Whether the REST proxy for the gRPC interface should be disabled
+restDisabled = <%= @boltz_config['rest_disabled'] %>
+
+# Host of the REST proxy
+restHost = "<%= @boltz_config['rest_host'] %>"
+
+# Port of the REST proxy
+restPort = <%= @boltz_config['rest_port'] %>
+
+# Whether the macaroon authentication for the gRPC and REST interface should be disabled
+noMacaroons = <%= @boltz_config['no_macaroons'] %>

site-cookbooks/kosmos-bitcoin/templates/lnd-channel-backup-s3.sh.erb

@@ -3,5 +3,5 @@ set -xe -o pipefail
 
 while true; do
   inotifywait <%= @lnd_dir %>/data/chain/bitcoin/<%= @bitcoin_network %>/channel.backup
-  aws --endpoint <%= @s3_endpoint %> s3 cp <%= @lnd_dir %>/data/chain/bitcoin/<%= @bitcoin_network %>/channel.backup "s3://<%= @s3_bucket %>/<%= @s3_scb_dir %>/channel.backup"
+  aws s3 cp <%= @lnd_dir %>/data/chain/bitcoin/<%= @bitcoin_network %>/channel.backup "s3://<%= @s3_bucket %>/<%= @s3_scb_dir %>/channel.backup"
 done

site-cookbooks/kosmos-bitcoin/templates/lnd.conf.erb

@@ -12,6 +12,7 @@ minchansize=<%= @lnd_minchansize %>
 autopilot.active=0
 
 [Bitcoin]
+bitcoin.active=1
 bitcoin.mainnet=1
 bitcoin.node=bitcoind
 bitcoin.basefee=<%= @lnd_basefee %>

site-cookbooks/kosmos-ejabberd/recipes/default.rb

@@ -84,12 +84,6 @@ hosts = [
     sql_database: "ejabberd",
     ldap_enabled: true,
     ldap_password: ejabberd_credentials['kosmos_ldap_password'],
-    certfiles: [
-      "/opt/ejabberd/conf/kosmos.org.crt",
-      "/opt/ejabberd/conf/kosmos.org.key",
-      "/opt/ejabberd/conf/kosmos.chat.crt",
-      "/opt/ejabberd/conf/kosmos.chat.key"
-    ],
     append_host_config: <<-EOF
     modules:
       mod_disco:
@@ -120,10 +114,6 @@ hosts = [
     sql_database: "ejabberd_5apps",
     ldap_enabled: true,
     ldap_password: ejabberd_credentials['5apps_ldap_password'],
-    certfiles: [
-      "/opt/ejabberd/conf/5apps.com.crt",
-      "/opt/ejabberd/conf/5apps.com.key"
-    ],
     append_host_config: <<-EOF
     modules:
       mod_disco:
@@ -164,11 +154,6 @@ admin_users = ejabberd_credentials['admins']
 
 hosts.each do |host|
   ldap_rootdn = "uid=service,ou=#{host[:name]},cn=applications,dc=kosmos,dc=org"
-  if host[:name] == "kosmos.org"
-    ldap_filter = "(&(objectClass=person)(serviceEnabled=ejabberd))"
-  else
-    ldap_filter = "(objectClass=person)"
-  end
 
   template "/opt/ejabberd/conf/#{host[:name]}.yml" do
     source    "vhost.yml.erb"
@@ -182,8 +167,7 @@ hosts.each do |host|
               ldap_base: ldap_base,
               ldap_server: ldap_domain,
               ldap_rootdn: ldap_rootdn,
-              ldap_encryption_type: ldap_encryption_type,
+              ldap_encryption_type: ldap_encryption_type
-              ldap_filter: ldap_filter
     notifies :reload, "service[ejabberd]", :delayed
   end
 end

site-cookbooks/kosmos-ejabberd/recipes/letsencrypt.rb

@@ -15,7 +15,7 @@ set -e
 # letsencrypt live folder
 for domain in $RENEWED_DOMAINS; do
   case $domain in
-  kosmos.org|kosmos.chat|5apps.com)
+  kosmos.org|5apps.com)
     cp "${RENEWED_LINEAGE}/privkey.pem" /opt/ejabberd/conf/$domain.key
     cp "${RENEWED_LINEAGE}/fullchain.pem" /opt/ejabberd/conf/$domain.crt
     chown ejabberd:ejabberd /opt/ejabberd/conf/$domain.*
@@ -33,7 +33,7 @@ file "/etc/letsencrypt/renewal-hooks/post/ejabberd" do
   group "root"
 end
 
-gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
+gandi_api_credentials = data_bag_item('credentials', 'gandi_api_5apps')
 
 template "/root/gandi_dns_certbot_hook.sh" do
   variables access_token: gandi_api_credentials["access_token"]
@@ -42,24 +42,17 @@ end
 
 # Generate a Let's Encrypt cert (only if no cert has been generated before).
 # The systemd timer will take care of renewing
-execute "letsencrypt cert for kosmos.org domains" do
+execute "letsencrypt cert for kosmos xmpp" do
-  command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.org\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d uploads.xmpp.kosmos.org -n"
+  command "certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d kosmos.chat -d uploads.xmpp.kosmos.org -n"
   not_if do
     File.exist?("/etc/letsencrypt/live/kosmos.org/fullchain.pem")
   end
 end
 
-execute "letsencrypt cert for kosmos.chat" do
-  command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth letsencrypt.kosmos.org\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.org\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.chat -n"
-  not_if do
-    File.exist?("/etc/letsencrypt/live/kosmos.chat/fullchain.pem")
-  end
-end
-
 # Generate a Let's Encrypt cert (only if no cert has been generated before).
 # The systemd timer will take care of renewing
 execute "letsencrypt cert for 5apps xmpp" do
-  command "certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth letsencrypt.kosmos.org\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.org\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@5apps.com -d 5apps.com -d muc.5apps.com -d xmpp.5apps.com -d uploads.xmpp.5apps.com -n"
+  command "certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth letsencrypt.kosmos.chat\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.chat\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@5apps.com -d 5apps.com -d muc.5apps.com -d xmpp.5apps.com -d uploads.xmpp.5apps.com -n"
   not_if do
     File.exist?("/etc/letsencrypt/live/5apps.com/fullchain.pem")
   end

site-cookbooks/kosmos-ejabberd/templates/ejabberd.yml.erb

@@ -216,7 +216,7 @@ modules:
     access_createnode: pubsub_createnode
     ignore_pep_from_offline: false
     last_item_cache: false
-    max_items_node: 10000
+    max_items_node: 10
     plugins:
       - "flat"
       - "pep" # pep requires mod_caps

site-cookbooks/kosmos-ejabberd/templates/gandi_dns_certbot_hook.sh.erb

@@ -3,14 +3,17 @@ set -euf -o pipefail
 
 # ************** USAGE **************
 #
-# Example usage:
+# Example usage (with this hook file saved in /root/):
 #
+#   sudo su -
 #   certbot certonly --manual --preferred-challenges dns --manual-public-ip-logging-ok --agree-tos -d "5apps.com" -d muc.5apps.com -d "xmpp.5apps.com" \
 #     --manual-auth-hook "/root/letsencrypt_hook.sh auth" --manual-cleanup-hook "/root/letsencrypt_hook.sh cleanup"
 #
+# This hook requires configuration, continue reading.
+#
 # ************** CONFIGURATION **************
 #
-# ACCESS_TOKEN: Your Gandi Live API key
+# GANDI_API_KEY: Your Gandi Live API key
 #
 # PROVIDER_UPDATE_DELAY:
 #   How many seconds to wait after updating your DNS records. This may be required,
@@ -20,10 +23,6 @@ set -euf -o pipefail
 #
 #   Defaults to 30 seconds.
 #
-# VALIDATION_DOMAIN:
-#   Domain to create ACME DNS entries on. Use this when redirecting ACME subdomains
-#   from the original domain to a proxy validation domain that we control.
-#
 ACCESS_TOKEN="<%= @access_token %>"
 PROVIDER_UPDATE_DELAY=10
 VALIDATION_DOMAIN="${2:-}"

site-cookbooks/kosmos-ejabberd/templates/vhost.yml.erb

@@ -1,8 +1,7 @@
 # Generated by Chef for <%= @host[:name] %>
 certfiles:
-<% @host[:certfiles].each do |certfile| %>
+  - "/opt/ejabberd/conf/<%= @host[:name] %>.crt"
-  - <%= certfile %>
+  - "/opt/ejabberd/conf/<%= @host[:name] %>.key"
-<% end %>
 host_config:
   "<%= @host[:name] %>":
     sql_type: pgsql
@@ -17,7 +16,7 @@ host_config:
     ldap_password: "<%= @host[:ldap_password] %>"
     ldap_encrypt: <%= @ldap_encryption_type %>
     ldap_base: "ou=<%= @host[:name] %>,<%= @ldap_base %>"
-    ldap_filter: "<%= @ldap_filter %>"
+    ldap_filter: "(objectClass=person)"
   <% end -%>
 
 append_host_config:

site-cookbooks/kosmos-hubot/recipes/nginx_botka_irc-libera-chat.rb

@@ -4,7 +4,6 @@ upstream_host = search(:node, "role:hubot").first["knife_zero"]["host"]
 
 tls_cert_for domain do
   auth "gandi_dns"
-  acme_domain "letsencrypt.kosmos.org"
   action :create
 end
 

site-cookbooks/kosmos-hubot/recipes/nginx_hal8000_xmpp.rb

@@ -5,7 +5,6 @@ upstream_host = search(:node, "role:hubot").first["knife_zero"]["host"]
 
 tls_cert_for domain do
   auth "gandi_dns"
-  acme_domain "letsencrypt.kosmos.org"
   action :create
 end
 

site-cookbooks/kosmos-ipfs/attributes/default.rb

@@ -62,4 +62,4 @@ node.default['kosmos-ipfs']['ipfs']['config'] = {
 node.default['kosmos-ipfs']['nginx']['domain'] = "ipfs.kosmos.org"
 node.default['kosmos-ipfs']['nginx']['external_api_port'] = 5444
 
-node.default['kosmos-ipfs']['kredits-pinner']['revision'] = "v2.3.0"
+node.default['kosmos-ipfs']['kredits-pinner']['revision'] = "v2.2.0"

site-cookbooks/kosmos-mastodon/attributes/default.rb

@@ -1,5 +1,5 @@
 node.default["kosmos-mastodon"]["repo"]              = "https://gitea.kosmos.org/kosmos/mastodon.git"
-node.default["kosmos-mastodon"]["revision"]          = "production-4.3"
+node.default["kosmos-mastodon"]["revision"]          = "production"
 node.default["kosmos-mastodon"]["directory"]         = "/opt/mastodon"
 node.default["kosmos-mastodon"]["bind_ip"]           = "127.0.0.1"
 node.default["kosmos-mastodon"]["app_port"]          = 3000
@@ -10,7 +10,7 @@ node.default["kosmos-mastodon"]["redis_url"]         = "redis://localhost:6379/0
 node.default["kosmos-mastodon"]["sidekiq_threads"]   = 25
 node.default["kosmos-mastodon"]["allowed_private_addresses"] = "127.0.0.1"
 
-node.default["kosmos-mastodon"]["onion_address"] = nil
+node.default["kosmos-mastodon"]["onion_address"]     = nil
 
 # Allocate this amount of RAM to the Java heap for Elasticsearch
 node.default["kosmos-mastodon"]["elasticsearch"]["allocated_memory"] = "1536m"
@@ -20,10 +20,6 @@ node.default["kosmos-mastodon"]["s3_region"]     = nil
 node.default["kosmos-mastodon"]["s3_bucket"]     = nil
 node.default["kosmos-mastodon"]["s3_alias_host"] = nil
 
-node.default["kosmos-mastodon"]["sso_account_sign_up_url"] = "https://kosmos.org"
-node.default["kosmos-mastodon"]["sso_account_reset_password_url"] = "https://accounts.kosmos.org/users/password/new"
-node.default["kosmos-mastodon"]["sso_account_resend_confirmation_url"] = "https://accounts.kosmos.org/users/confirmation/new"
-
 node.default["kosmos-mastodon"]["default_locale"] = "en"
 node.default["kosmos-mastodon"]["libre_translate_endpoint"] = nil
 

site-cookbooks/kosmos-mastodon/recipes/backup.rb

@@ -6,12 +6,13 @@
 postgresql_data_bag_item = data_bag_item('credentials', 'postgresql')
 
 unless node.chef_environment == "development"
-  node.override['backup']['s3']['keep'] = 1
+  unless node["backup"]["postgresql"]["databases"].keys.include? 'mastodon'
-  node.override["backup"]["postgresql"]["host"] = "pg.kosmos.local"
+    node.override["backup"]["postgresql"]["host"] = "pg.kosmos.local"
-  node.override["backup"]["postgresql"]["databases"]["mastodon"] = {
+    node.override["backup"]["postgresql"]["databases"]["mastodon"] = {
-    username: "mastodon",
+      username: "mastodon",
-    password: postgresql_data_bag_item['mastodon_user_password']
+      password: postgresql_data_bag_item['mastodon_user_password']
-  }
+    }
+  end
 
   include_recipe "backup"
 end

site-cookbooks/kosmos-mastodon/recipes/default.rb

@@ -3,7 +3,7 @@
 # Recipe:: default
 #
 
-node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_18.x"
+node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_16.x"
 
 include_recipe "kosmos-nodejs"
 include_recipe "java"
@@ -44,7 +44,7 @@ end
 
 elasticsearch_service 'elasticsearch'
 
-postgresql_credentials = data_bag_item('credentials', 'postgresql')
+postgresql_data_bag_item = data_bag_item('credentials', 'postgresql')
 
 mastodon_path = node["kosmos-mastodon"]["directory"]
 mastodon_user = "mastodon"
@@ -71,7 +71,11 @@ package %w(build-essential imagemagick ffmpeg libxml2-dev libxslt1-dev file git
            curl pkg-config libprotobuf-dev protobuf-compiler libidn11
            libidn11-dev libjemalloc2 libpq-dev)
 
-ruby_version = "3.3.5"
+npm_package "yarn" do
+  version "1.22.4"
+end
+
+ruby_version = "3.3.0"
 
 ruby_path = "/opt/ruby_build/builds/#{ruby_version}"
 bundle_path = "#{ruby_path}/bin/bundle"
@@ -164,55 +168,32 @@ execute "restart mastodon services" do
   notifies :restart, "service[mastodon-streaming]", :delayed
 end
 
-credentials = data_bag_item('credentials', 'mastodon')
+mastodon_credentials = data_bag_item('credentials', 'mastodon')
-
-ldap_config = {
-  host: "ldap.kosmos.local",
-  port: 389,
-  method: "plain",
-  base: "ou=kosmos.org,cn=users,dc=kosmos,dc=org",
-  bind_dn: credentials["ldap_bind_dn"],
-  password: credentials["ldap_password"],
-  uid: "cn",
-  mail: "mail",
-  search_filter: "(&(|(cn=%{email})(mail=%{email}))(serviceEnabled=mastodon))",
-  uid_conversion_enabled: "true",
-  uid_conversion_search: "-",
-  uid_conversion_replace: "_"
-}
 
 template "#{mastodon_path}/.env.#{rails_env}" do
   source "env.erb"
   mode  "0640"
   owner mastodon_user
   group mastodon_user
-  sensitive true
   variables redis_url: node["kosmos-mastodon"]["redis_url"],
             domain: node["kosmos-mastodon"]["domain"],
             alternate_domains: node["kosmos-mastodon"]["alternate_domains"],
-            active_record_encryption_deterministic_key: credentials["active_record_encryption_deterministic_key"],
+            paperclip_secret: mastodon_credentials['paperclip_secret'],
-            active_record_encryption_key_derivation_salt: credentials["active_record_encryption_key_derivation_salt"],
+            secret_key_base: mastodon_credentials['secret_key_base'],
-            active_record_encryption_primary_key: credentials["active_record_encryption_primary_key"],
+            otp_secret: mastodon_credentials['otp_secret'],
-            paperclip_secret: credentials['paperclip_secret'],
+            smtp_login: mastodon_credentials['smtp_user_name'],
-            secret_key_base: credentials['secret_key_base'],
+            smtp_password: mastodon_credentials['smtp_password'],
-            otp_secret: credentials['otp_secret'],
-            ldap: ldap_config,
-            smtp_login: credentials['smtp_user_name'],
-            smtp_password: credentials['smtp_password'],
             smtp_from_address: "mail@#{node['kosmos-mastodon']['domain']}",
             s3_endpoint: node["kosmos-mastodon"]["s3_endpoint"],
             s3_region: node["kosmos-mastodon"]["s3_region"],
             s3_bucket: node["kosmos-mastodon"]["s3_bucket"],
             s3_alias_host: node["kosmos-mastodon"]["s3_alias_host"],
-            aws_access_key_id: credentials['s3_key_id'],
+            aws_access_key_id: mastodon_credentials['s3_key_id'],
-            aws_secret_access_key: credentials['s3_secret_key'],
+            aws_secret_access_key: mastodon_credentials['s3_secret_key'],
-            vapid_private_key: credentials['vapid_private_key'],
+            vapid_private_key: mastodon_credentials['vapid_private_key'],
-            vapid_public_key: credentials['vapid_public_key'],
+            vapid_public_key: mastodon_credentials['vapid_public_key'],
-            db_pass: postgresql_credentials['mastodon_user_password'],
+            db_pass: postgresql_data_bag_item['mastodon_user_password'],
             db_host: "pg.kosmos.local",
-            sso_account_sign_up_url: node["kosmos-mastodon"]["sso_account_sign_up_url"],
-            sso_account_reset_password_url: node["kosmos-mastodon"]["sso_account_reset_password_url"],
-            sso_account_resend_confirmation_url: node["kosmos-mastodon"]["sso_account_resend_confirmation_url"],
             default_locale: node["kosmos-mastodon"]["default_locale"],
             allowed_private_addresses: node["kosmos-mastodon"]["allowed_private_addresses"],
             libre_translate_endpoint: node["kosmos-mastodon"]["libre_translate_endpoint"]
@@ -230,7 +211,7 @@ execute "yarn install" do
   environment deploy_env
   user mastodon_user
   cwd mastodon_path
-  command "corepack prepare && yarn install --immutable"
+  command "yarn install --frozen-lockfile"
 end
 
 execute "rake assets:precompile" do

site-cookbooks/kosmos-mastodon/recipes/nginx.rb

@@ -28,15 +28,12 @@ template "#{node['openresty']['dir']}/snippets/mastodon.conf" do
   owner 'www-data'
   mode 0640
   variables web_root_dir: web_root_dir,
-            server_name:  server_name,
+            server_name:  server_name
-            s3_private_url: "#{node["kosmos-mastodon"]["s3_endpoint"]}/#{node["kosmos-mastodon"]["s3_bucket"]}/",
-            s3_public_url: "https://#{node["kosmos-mastodon"]["s3_alias_host"]}/"
   notifies :reload, 'service[openresty]', :delayed
 end
 
 tls_cert_for server_name do
   auth "gandi_dns"
-  acme_domain "letsencrypt.kosmos.org"
   action :create
 end
 

site-cookbooks/kosmos-mastodon/templates/default/env.erb

@@ -12,9 +12,6 @@ LOCAL_HTTPS=true
 
 # Application secrets
 # Generate each with the `rake secret` task (`docker-compose run --rm web rake secret` if you use docker compose)
-ACTIVE_RECORD_ENCRYPTION_DETERMINISTIC_KEY=<%= @active_record_encryption_deterministic_key %>
-ACTIVE_RECORD_ENCRYPTION_KEY_DERIVATION_SALT=<%= @active_record_encryption_key_derivation_salt %>
-ACTIVE_RECORD_ENCRYPTION_PRIMARY_KEY=<%= @active_record_encryption_primary_key %>
 PAPERCLIP_SECRET=<%= @paperclip_secret %>
 SECRET_KEY_BASE=<%= @secret_key_base %>
 OTP_SECRET=<%= @otp_secret %>
@@ -32,26 +29,6 @@ SMTP_LOGIN=<%= @smtp_login %>
 SMTP_PASSWORD=<%= @smtp_password %>
 SMTP_FROM_ADDRESS=<%= @smtp_from_address %>
 
-<% if @ldap %>
-# LDAP configuration
-LDAP_ENABLED=true
-LDAP_HOST=<%= @ldap[:host] %>
-LDAP_PORT=<%= @ldap[:port] %>
-LDAP_METHOD='<%= @ldap[:method] %>'
-LDAP_BASE='<%= @ldap[:base] %>'
-LDAP_BIND_DN='<%= @ldap[:bind_dn] %>'
-LDAP_PASSWORD='<%= @ldap[:password] %>'
-LDAP_UID=<%= @ldap[:uid] %>
-LDAP_MAIL=<%= @ldap[:mail] %>
-LDAP_SEARCH_FILTER='<%= @ldap[:search_filter] %>'
-LDAP_UID_CONVERSION_ENABLED=<%= @ldap[:uid_conversion_enabled] %>
-LDAP_UID_CONVERSION_SEARCH=<%= @ldap[:uid_conversion_search] %>
-LDAP_UID_CONVERSION_REPLACE=<%= @ldap[:uid_conversion_replace] %>
-SSO_ACCOUNT_SIGN_UP=<%= @sso_account_sign_up_url %>
-SSO_ACCOUNT_RESET_PASSWORD=<%= @sso_account_reset_password_url %>
-SSO_ACCOUNT_RESEND_CONFIRMATION=<%= @sso_account_resend_confirmation_url %>
-<% end %>
-
 # Optional asset host for multi-server setups
 # CDN_HOST=assets.example.com
 

site-cookbooks/kosmos-mastodon/templates/default/nginx_conf_mastodon.erb

@@ -32,12 +32,6 @@ server {
 <% if @onion_address %>
   add_header Onion-Location https://mastodon.<%= @onion_address %>$request_uri;
 <% end %>
-
-  location ~ ^/.well-known/(lnurlp|keysend) {
-    add_header 'Access-Control-Allow-Origin' '*';
-    proxy_ssl_server_name on;
-    proxy_pass https://accounts.kosmos.org;
-  }
 }
 
 <% if @onion_address %>

site-cookbooks/kosmos-mastodon/templates/default/nginx_conf_shared.erb

@@ -108,13 +108,11 @@ location @proxy {
 
   proxy_pass http://mastodon_app;
   proxy_buffering on;
+  proxy_redirect off;
   proxy_http_version 1.1;
   proxy_set_header Upgrade $http_upgrade;
   proxy_set_header Connection $connection_upgrade;
 
-  # https://github.com/mastodon/mastodon/issues/24380
-  proxy_redirect <%= @s3_private_url %> <%= @s3_public_url %>;
-
   tcp_nodelay on;
 }
 

site-cookbooks/kosmos_akaunting/.gitignore

@@ -1,25 +0,0 @@
-.vagrant
-*~
-*#
-.#*
-\#*#
-.*.sw[a-z]
-*.un~
-
-# Bundler
-Gemfile.lock
-gems.locked
-bin/*
-.bundle/*
-
-# test kitchen
-.kitchen/
-kitchen.local.yml
-
-# Chef Infra
-Berksfile.lock
-.zero-knife.rb
-Policyfile.lock.json
-
-.idea/
-

site-cookbooks/kosmos_akaunting/Policyfile.rb

@@ -1,16 +0,0 @@
-# Policyfile.rb - Describe how you want Chef Infra Client to build your system.
-#
-# For more information on the Policyfile feature, visit
-# https://docs.chef.io/policyfile/
-
-# A name that describes what the system you're building with Chef does.
-name 'kosmos_akaunting'
-
-# Where to find external cookbooks:
-default_source :supermarket
-
-# run_list: chef-client will run these recipes in the order specified.
-run_list 'kosmos_akaunting::default'
-
-# Specify a custom source for a single cookbook:
-cookbook 'kosmos_akaunting', path: '.'

site-cookbooks/kosmos_akaunting/README.md

@@ -1,4 +0,0 @@
-# kosmos_akaunting
-
-TODO: Enter the cookbook description here.
-

site-cookbooks/kosmos_akaunting/attributes/default.rb

@@ -1,5 +0,0 @@
-node.default["akaunting"]["user"] = "deploy"
-node.default["akaunting"]["group"] = "www-data"
-node.default["akaunting"]["repo"] = "https://github.com/akaunting/akaunting.git"
-node.default["akaunting"]["revision"] = "3.1.12"
-node.default["akaunting"]["port"] = 80

site-cookbooks/kosmos_akaunting/chefignore

@@ -1,115 +0,0 @@
-# Put files/directories that should be ignored in this file when uploading
-# to a Chef Infra Server or Supermarket.
-# Lines that start with '# ' are comments.
-
-# OS generated files #
-######################
-.DS_Store
-ehthumbs.db
-Icon?
-nohup.out
-Thumbs.db
-.envrc
-
-# EDITORS #
-###########
-.#*
-.project
-.settings
-*_flymake
-*_flymake.*
-*.bak
-*.sw[a-z]
-*.tmproj
-*~
-\#*
-REVISION
-TAGS*
-tmtags
-.vscode
-.editorconfig
-
-## COMPILED ##
-##############
-*.class
-*.com
-*.dll
-*.exe
-*.o
-*.pyc
-*.so
-*/rdoc/
-a.out
-mkmf.log
-
-# Testing #
-###########
-.circleci/*
-.codeclimate.yml
-.delivery/*
-.foodcritic
-.kitchen*
-.mdlrc
-.overcommit.yml
-.rspec
-.rubocop.yml
-.travis.yml
-.watchr
-.yamllint
-azure-pipelines.yml
-Dangerfile
-examples/*
-features/*
-Guardfile
-kitchen.yml*
-mlc_config.json
-Procfile
-Rakefile
-spec/*
-test/*
-
-# SCM #
-#######
-.git
-.gitattributes
-.gitconfig
-.github/*
-.gitignore
-.gitkeep
-.gitmodules
-.svn
-*/.bzr/*
-*/.git
-*/.hg/*
-*/.svn/*
-
-# Berkshelf #
-#############
-Berksfile
-Berksfile.lock
-cookbooks/*
-tmp
-
-# Bundler #
-###########
-vendor/*
-Gemfile
-Gemfile.lock
-
-# Policyfile #
-##############
-Policyfile.rb
-Policyfile.lock.json
-
-# Documentation #
-#############
-CODE_OF_CONDUCT*
-CONTRIBUTING*
-documentation/*
-TESTING*
-UPGRADING*
-
-# Vagrant #
-###########
-.vagrant
-Vagrantfile

site-cookbooks/kosmos_akaunting/kitchen.yml

@@ -1,31 +0,0 @@
----
-driver:
-  name: vagrant
-
-## The forwarded_port port feature lets you connect to ports on the VM guest
-## via localhost on the host.
-## see also: https://www.vagrantup.com/docs/networking/forwarded_ports
-
-#  network:
-#    - ["forwarded_port", {guest: 80, host: 8080}]
-
-provisioner:
-  name: chef_zero
-
-  ## product_name and product_version specifies a specific Chef product and version to install.
-  ## see the Chef documentation for more details: https://docs.chef.io/workstation/config_yml_kitchen/
-  #  product_name: chef
-  #  product_version: 17
-
-verifier:
-  name: inspec
-
-platforms:
-  - name: ubuntu-20.04
-  - name: centos-8
-
-suites:
-  - name: default
-    verifier:
-      inspec_tests:
-        - test/integration/default

site-cookbooks/kosmos_akaunting/metadata.rb

@@ -1,9 +0,0 @@
-name 'kosmos_akaunting'
-maintainer 'Kosmos Developers'
-maintainer_email 'mail@kosmos.org'
-license 'MIT'
-description 'Installs/configures akaunting for Kosmos'
-version '0.1.0'
-chef_version '>= 18.0'
-
-depends 'kosmos-nodejs'

site-cookbooks/kosmos_akaunting/recipes/default.rb

@@ -1,148 +0,0 @@
-#
-# Cookbook:: kosmos_akaunting
-# Recipe:: default
-#
-
-app_name     = "akaunting"
-deploy_user  = node["akaunting"]["user"]
-deploy_group = node["akaunting"]["group"]
-deploy_path  = "/opt/#{app_name}"
-credentials  = data_bag_item("credentials", "akaunting")
-pg_host      = search(:node, "role:postgresql_primary").first["knife_zero"]["host"] rescue "localhost"
-
-env = {
-  app_name: "Akaunting",
-  app_env: "production",
-  app_locale: "en-US",
-  app_installed: "true",
-  app_key: credentials["app_key"],
-  app_debug: "true",
-  app_schedule_time: "\"09:00\"",
-  app_url: "http://akaunting.kosmos.org",
-  db_connection: "pgsql",
-  db_host: pg_host,
-  db_port: "5432",
-  db_database: credentials["pg_database"],
-  db_username: credentials["pg_username"],
-  db_password: credentials["pg_password"],
-  log_level: "debug"
-  # mail_mailer: "mail",
-  # mail_host: "localhost",
-  # mail_port: "2525",
-  # mail_username: "null",
-  # mail_password: "null",
-  # mail_encryption: "null",
-  # mail_from_name: "null",
-  # mail_from_address: "null",
-}
-
-%w[
-  unzip nginx php8.1 php8.1-cli php8.1-bcmath php8.1-ctype php8.1-curl
-  php8.1-dom php8.1-fileinfo php8.1-intl php8.1-fpm php8.1-gd php8.1-mbstring
-  php8.1-pdo php8.1-pgsql php8.1-tokenizer php8.1-xml php8.1-zip
-].each do |pkg|
-  package pkg
-end
-
-# TODO install composer
-
-node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_18.x"
-include_recipe "kosmos-nodejs"
-
-group deploy_group
-
-user deploy_user do
-  group       deploy_group
-  manage_home true
-  shell       "/bin/bash"
-end
-
-directory deploy_path do
-  owner deploy_user
-  group deploy_group
-  mode "0775"
-end
-
-git deploy_path do
-  repository node[app_name]["repo"]
-  revision node[app_name]["revision"]
-  user deploy_user
-  group deploy_group
-  action :sync
-  notifies :run, "execute[composer_install]", :immediately
-  notifies :run, "execute[npm_install]", :immediately
-  notifies :restart, "service[php8.1-fpm]", :delayed
-end
-
-execute "composer_install" do
-  user deploy_user
-  cwd deploy_path
-  command "composer install"
-  action :nothing
-end
-
-execute "npm_install" do
-  user deploy_user
-  cwd deploy_path
-  command "npm install"
-  action :nothing
-  notifies :run, "execute[compile_assets]", :immediately
-end
-
-execute "compile_assets" do
-  user deploy_user
-  cwd deploy_path
-  command "npm run prod"
-  action :nothing
-end
-
-execute "set_storage_permissions" do
-  command "chown -R www-data:www-data #{deploy_path}/storage"
-end
-
-template "#{deploy_path}/.env" do
-  source 'env.erb'
-  owner deploy_user
-  group deploy_group
-  mode 0660
-  sensitive true
-  variables config: env
-  notifies :restart, "service[php8.1-fpm]", :delayed
-end
-
-template "/etc/nginx/sites-available/default" do
-  source 'nginx-local.conf.erb'
-  owner deploy_user
-  group deploy_group
-  mode 0660
-  variables deploy_path: deploy_path,
-            port: node["akaunting"]["port"]
-  notifies :restart, "service[nginx]", :delayed
-end
-
-# template "/etc/php/8.1/fpm/pool.d/akaunting.conf" do
-#   source 'php-fpm.pool.erb'
-#   owner deploy_user
-#   group deploy_group
-#   mode 0600
-#   variables user: deploy_user,
-#             group: deploy_group,
-#             chdir: deploy_path,
-#             port: node["akaunting"]["port"]
-#   notifies :restart, "service[php8.1-fpm]", :delayed
-# end
-
-service "php8.1-fpm" do
-  action [:enable, :start]
-end
-
-service "nginx" do
-  action [:enable, :start]
-end
-
-firewall_rule "akaunting_zerotier" do
-  command  :allow
-  port     node["akaunting"]["port"]
-  protocol :tcp
-  source   "10.1.1.0/24"
-end

site-cookbooks/kosmos_akaunting/recipes/pg_db.rb

@@ -1,16 +0,0 @@
-#
-# Cookbook:: kosmos_akaunting
-# Recipe:: pg_db
-#
-
-credentials = data_bag_item("credentials", "akaunting")
-
-postgresql_user credentials["pg_username"] do
-  action :create
-  password credentials["pg_password"]
-end
-
-postgresql_database credentials["pg_database"] do
-  owner credentials["pg_username"]
-  action :create
-end

site-cookbooks/kosmos_akaunting/templates/env.erb

@@ -1,11 +0,0 @@
-<% @config.each do |key, value| %>
-<% if value.is_a?(Hash) %>
-<% value.each do |k, v| %>
-<%= "#{key.upcase}_#{k.upcase}" %>=<%= v.to_s %>
-<% end %>
-<% else %>
-<% if value %>
-<%= key.upcase %>=<%= value.to_s %>
-<% end %>
-<% end %>
-<% end %>

site-cookbooks/kosmos_akaunting/templates/nginx-local.conf.erb

@@ -1,49 +0,0 @@
-server {
-  listen 80 default_server;
-
-  server_name akaunting.kosmos.org;
-
-  root <%= @deploy_path %>;
-
-  add_header X-Frame-Options "SAMEORIGIN";
-  add_header X-XSS-Protection "1; mode=block";
-  add_header X-Content-Type-Options "nosniff";
-
-  index index.html index.htm index.php;
-
-  charset utf-8;
-
-  location / {
-    try_files $uri $uri/ /index.php?$query_string;
-  }
-
-  # Prevent Direct Access To Protected Files
-  location ~ \.(env|log) {
-    deny all;
-  }
-
-  # Prevent Direct Access To Protected Folders
-  location ~ ^/(^app$|bootstrap|config|database|overrides|resources|routes|storage|tests|artisan) {
-    deny all;
-  }
-
-  # Prevent Direct Access To modules/vendor Folders Except Assets
-  location ~ ^/(modules|vendor)\/(.*)\.((?!ico|gif|jpg|jpeg|png|js\b|css|less|sass|font|woff|woff2|eot|ttf|svg|xls|xlsx).)*$ {
-    deny all;
-  }
-
-  error_page 404 /index.php;
-
-  # Pass PHP Scripts To FastCGI Server
-  location ~ \.php$ {
-    fastcgi_split_path_info ^(.+\.php)(/.+)$;
-    fastcgi_pass unix:/var/run/php/php8.1-fpm.sock; # Depends On The PHP Version
-    fastcgi_index index.php;
-    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-    include fastcgi_params;
-  }
-
-  location ~ /\.(?!well-known).* {
-    deny all;
-  }
-}

site-cookbooks/kosmos_akaunting/templates/php-fpm.pool.erb

@@ -1,18 +0,0 @@
-[akaunting]
-user = <%= @user %>
-group = <%= @group %>
-listen = 0.0.0.0:<%= @port %>
-listen.owner = <%= @user %>
-listen.group = <%= @group %>
-listen.mode = 0660
-
-pm = dynamic
-pm.max_children = 10
-pm.start_servers = 4
-pm.min_spare_servers = 2
-pm.max_spare_servers = 6
-pm.max_requests = 500
-
-chdir = <%= @chdir %>
-catch_workers_output = yes
-php_admin_flag[log_errors] = on

site-cookbooks/kosmos_akaunting/test/integration/default/default_test.rb

@@ -1,16 +0,0 @@
-# Chef InSpec test for recipe kosmos_akaunting::default
-
-# The Chef InSpec reference, with examples and extensive documentation, can be
-# found at https://docs.chef.io/inspec/resources/
-
-unless os.windows?
-  # This is an example test, replace with your own test.
-  describe user('root'), :skip do
-    it { should exist }
-  end
-end
-
-# This is an example test, replace it with your own test.
-describe port(80), :skip do
-  it { should_not be_listening }
-end

site-cookbooks/kosmos_email/recipes/default.rb

@@ -7,7 +7,6 @@ domain   = node["email"]["domain"]
 hostname = node["email"]["hostname"]
 root_dir = node["email"]["root_directory"]
 ip_addr  = node["knife_zero"]["host"]
-extra_hostnames = ["smtp.#{domain}", "imap.#{domain}"]
 
 node.override["set_fqdn"] = hostname
 include_recipe "hostname"
@@ -24,9 +23,7 @@ directory root_dir do
 end
 
 tls_cert_for hostname do
-  domain ([hostname]+extra_hostnames)
   auth "gandi_dns"
-  deploy_hook "systemctl reload postfix.service && systemctl reload dovecot.service"
   action :create
 end
 

site-cookbooks/kosmos_garage/recipes/nginx_web.rb

@@ -3,8 +3,6 @@
 # Recipe:: nginx_web
 #
 
-gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
-
 file "#{node['openresty']['dir']}/conf.d/garage.conf" do
   content <<-EOF
 upstream garage_web {
@@ -42,12 +40,8 @@ end
 #
 
 node['garage']['s3_web_domains'].each do |domain_name|
-  second_level_domain = domain_name.match(/(?:.*\.)?([^.]+\.[^.]+)$/) { $1 }
-  proxy_validation = !gandi_api_credentials["domains"].include?(second_level_domain)
-
   tls_cert_for domain_name do
     auth "gandi_dns"
-    acme_domain "letsencrypt.kosmos.org" if proxy_validation
     action :create
   end
 

site-cookbooks/kosmos_gitea/attributes/default.rb

@@ -1,5 +1,5 @@
-node.default["gitea"]["version"] = "1.22.5"
+node.default["gitea"]["version"] = "1.21.7"
-node.default["gitea"]["checksum"] = "ce2c7e4fff3c1e3ed59f5b5e00e3f2d301f012c34e329fccd564bc5129075460"
+node.default["gitea"]["checksum"] = "fa88e6404d3d34136bdd50c990a8c390d5e05f4cb2e31641559d14234e022bd6"
 node.default["gitea"]["working_directory"] = "/var/lib/gitea"
 node.default["gitea"]["port"] = 3000
 node.default["gitea"]["postgresql_host"] = "localhost:5432"

site-cookbooks/kosmos_gitea/recipes/backup.rb

@@ -8,6 +8,5 @@
 unless node.chef_environment == "development"
   # backup the data dir and the config files
   node.override["backup"]["archives"]["gitea"] = [node["gitea"]["working_directory"]]
-  node.override['backup']['s3']['keep'] = 2
   include_recipe "backup"
 end

site-cookbooks/kosmos_gitea/templates/default/app.ini.erb

@@ -112,7 +112,3 @@ MINIO_USE_SSL=<%= c["use_ssl"] %>
 [actions]
 ENABLED = true
 <% end %>
-
-[other]
-SHOW_FOOTER_VERSION = false
-SHOW_FOOTER_TEMPLATE_LOAD_TIME = false

site-cookbooks/kosmos_gitea/templates/default/nginx_conf_web.erb

@@ -21,13 +21,8 @@ server {
   location ~ ^/(avatars|repo-avatars)/.*$ {
     proxy_buffers 1024 8k;
     proxy_pass http://_gitea_web;
+    proxy_http_version 1.1;
     expires 30d;
-    proxy_set_header Connection $http_connection;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
   }
 
   # Docker registry
@@ -35,22 +30,12 @@ server {
     client_max_body_size 0;
     proxy_buffers 1024 8k;
     proxy_pass http://_gitea_web;
-    proxy_set_header Connection $http_connection;
+    proxy_http_version 1.1;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
   }
 
   location / {
     proxy_buffers 1024 8k;
     proxy_pass http://_gitea_web;
-    proxy_set_header Connection $http_connection;
+    proxy_http_version 1.1;
-    proxy_set_header Upgrade $http_upgrade;
-    proxy_set_header Host $host;
-    proxy_set_header X-Real-IP $remote_addr;
-    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header X-Forwarded-Proto $scheme;
   }
 }

site-cookbooks/kosmos_kvm/attributes/default.rb

@@ -1,10 +1,9 @@
-release = "20240514"
+ubuntu_server_cloud_image_release = "20230506"
-img_filename = "ubuntu-22.04-server-cloudimg-amd64-disk-kvm"
 
 node.default["kosmos_kvm"]["host"]["qemu_base_image"] = {
-  "url" => "https://cloud-images.ubuntu.com/releases/jammy/release-#{release}/#{img_filename}.img",
+  "url" => "https://cloud-images.ubuntu.com/releases/focal/release-#{ubuntu_server_cloud_image_release}/ubuntu-20.04-server-cloudimg-amd64-disk-kvm.img",
-  "checksum" => "2e7698b3ebd7caead06b08bd3ece241e6ce294a6db01f92ea12bcb56d6972c3f",
+  "checksum" => "27d2b91fd2b715729d739e2a3155dce70d1aaae4f05c177f338b9d4b60be638c",
-  "path" => "/var/lib/libvirt/images/base/#{img_filename}-#{release}.qcow2"
+  "path" => "/var/lib/libvirt/images/base/ubuntu-20.04-server-cloudimg-amd64-disk-kvm-#{ubuntu_server_cloud_image_release}.qcow2"
 }
 
 # A systemd.timer OnCalendar config value

site-cookbooks/kosmos_kvm/files/backup_vm.sh

@@ -22,5 +22,8 @@ borg create -v $REPOSITORY::$1_$(date +%F_%H-%M) \
         /var/lib/libvirt/images/$1.qcow2  \
         /root/backups/vm_meta/$1.xml
 
-echo "Pivoting base image back to original, and removing the snapshot image"
+echo "Pivoting base image back to original"
-virsh blockcommit $1 vda --pivot --base=/var/lib/libvirt/images/$1.qcow2 && rm /var/lib/libvirt/images/$1.hotswap.qcow2
+virsh blockcommit $1 vda --pivot --base=/var/lib/libvirt/images/$1.qcow2
+
+echo "Removing snapshot image"
+rm /var/lib/libvirt/images/$1.hotswap.qcow2