Upgrade ejabberd to 24.02

Co-authored-by: Greg Karékinian <greg@karekinian.com>

Berksfile

@@ -13,6 +13,9 @@ cookbook 'ipfs',
 cookbook 'mediawiki',
   git: 'https://github.com/67P/mediawiki-cookbook.git',
   ref: 'nginx'
+cookbook 'postfix',
+  git: 'https://gitea.kosmos.org/kosmos/postfix-cookbook.git',
+  ref: 'bugfix/sasl_attributes'
 
 cookbook 'apache2',                '= 3.3.0'
 cookbook 'apt',                    '~> 7.3.0'
@@ -32,7 +35,6 @@ cookbook 'ntp',                    '= 3.4.0'
 cookbook 'ohai',                   '~> 5.2.5'
 cookbook 'openssl',                '~> 8.5.5'
 cookbook 'php',                    '~> 8.0.0'
-cookbook 'postfix',                '~> 6.0.26'
 cookbook 'timezone_iii',           '= 1.0.4'
 cookbook 'ulimit',                 '~> 1.0.0'
 cookbook 'users',                  '~> 5.3.1'

Berksfile.lock

@@ -28,7 +28,10 @@ DEPENDENCIES
   ohai (~> 5.2.5)
   openssl (~> 8.5.5)
   php (~> 8.0.0)
-  postfix (~> 6.0.26)
+  postfix
+    git: https://gitea.kosmos.org/kosmos/postfix-cookbook.git
+    revision: dd6598572a775ae73f17527260ec8097b52d385b
+    ref: bugfix/
   redisio (~> 6.4.1)
   ruby_build (~> 2.5.0)
   timezone_iii (= 1.0.4)
@@ -90,7 +93,7 @@ GRAPH
   openssl (8.5.5)
   php (8.0.1)
     yum-epel (>= 0.0.0)
-  postfix (6.0.26)
+  postfix (6.4.1)
   redisio (6.4.1)
     selinux (>= 0.0.0)
   ruby_build (2.5.0)

clients/akaunting-1.json

@@ -1,4 +0,0 @@
-{
-  "name": "akaunting-1",
-  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzmNpNWJh5DeXDsINDqAt\n5OtcGhnzLtqdILTD8A8KuPxWhoKI0k9xwvuT4yO2DLQqFMPyGefRuQkVsIq2OuU5\npK8B5c79E9MBHxti6mQZw4b/Jhmul+x2LGtOWYjPTDhFYXRsNNDtFDxwpwJGPede\nYts026yExHPhiF35Mt1JxA3TXJfPC8Vx0YGHu/6Ev+1fLmcKhFmhed5yKkA0gwod\nczdyQiCfw3ze9LuS90QmALpFOHHpekZeywemdwyPia207CoTrXsPLWj9KmuUEIQJ\nwL+OlEU2tVA6KaBKpl54n5/tMsccZmlicbNsVpgkk6LctrkNh6Kk+fW9ry3L/Gxg\nAwIDAQAB\n-----END PUBLIC KEY-----\n"
-}

cookbooks/postfix/.markdownlint-cli2.yaml

@@ -3,3 +3,5 @@ config:
   line-length: false # MD013
   no-duplicate-heading: false # MD024
   reference-links-images: false # MD052
+ignores:
+  - .github/copilot-instructions.md

cookbooks/postfix/.vscode/extensions.json

@@ -0,0 +1,8 @@
+{
+  "recommendations": [
+    "chef-software.chef",
+    "Shopify.ruby-lsp",
+    "editorconfig.editorconfig",
+    "DavidAnson.vscode-markdownlint"
+  ]
+}

cookbooks/postfix/CHANGELOG.md

@@ -2,9 +2,48 @@
 
 This file is used to list changes made in each version of the postfix cookbook.
 
+## Unreleased
+
+## 6.4.1 - *2025-09-04*
+
+## 6.4.0 - *2025-07-30* ## 6.4.0 - *2025-07-30*
+
+Standardise files with files in sous-chefs/repo-management
+
+## 6.4.0 - *2025-07-30*
+
+## 6.3.0 - *2025-07-30*
+
+- Use LMDB instead of hash on el10
+
+## 6.3.0 - *2025-07-30*
+
+## 6.2.2 - *2025-01-30*
+
+## 6.2.1 - *2025-01-30*
+
+## 6.2.0 - *2025-01-30*
+
+## 6.2.0
+
+- Correctly fix aliases quoting logic
+- Convert all serverspec tests to inspec
+- Add Github actions
+- Update platforms to test
+
+## 6.0.29 - *2024-11-18*
+
+- Standardise files with files in sous-chefs/repo-management
+
+## 6.0.28 - *2024-07-15*
+
+- Standardise files with files in sous-chefs/repo-management
+
+## 6.0.27 - *2024-05-06*
+
 ## 6.0.26 - *2023-10-03*
 
-- add installation of postfix addon packages for RHEL 8
+- Add installation of postfix addon packages for RHEL 8
 
 ## 6.0.25 - *2023-10-03*
 

cookbooks/postfix/attributes/default.rb

@@ -13,9 +13,10 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-
+default['postfix']['packages'] = value_for_platform(
-default['postfix']['packages'] = %w(postfix)
+  amazon: { '>= 2023' => %w(postfix postfix-lmdb) },
-
+  default: %w(postfix)
+)
 # Generic cookbook attributes
 default['postfix']['mail_type'] = 'client'
 default['postfix']['relayhost_role'] = 'relayhost'
@@ -37,11 +38,19 @@ default['postfix']['master_template_source'] = 'postfix'
 default['postfix']['sender_canonical_map_entries'] = {}
 default['postfix']['smtp_generic_map_entries'] = {}
 default['postfix']['recipient_canonical_map_entries'] = {}
-default['postfix']['access_db_type'] = 'hash'
+
-default['postfix']['aliases_db_type'] = 'hash'
+default['postfix']['db_type'] = value_for_platform(
-default['postfix']['transport_db_type'] = 'hash'
+  %w(centos redhat almalinux rocky oracle) => { '>= 10' => 'lmdb' },
-default['postfix']['virtual_alias_db_type'] = 'hash'
+  amazon: { '>= 2023' => 'lmdb' },
-default['postfix']['virtual_alias_domains_db_type'] = 'hash'
+  %w(opensuseleap suse) => { '>= 15' => 'lmdb' },
+  default: 'hash'
+)
+
+default['postfix']['access_db_type'] = lazy { node['postfix']['db_type'] }
+default['postfix']['aliases_db_type'] = lazy { node['postfix']['db_type'] }
+default['postfix']['transport_db_type'] = lazy { node['postfix']['db_type'] }
+default['postfix']['virtual_alias_db_type'] = lazy { node['postfix']['db_type'] }
+default['postfix']['virtual_alias_domains_db_type'] = lazy { node['postfix']['db_type'] }
 
 case node['platform']
 when 'smartos'
@@ -96,6 +105,9 @@ default['postfix']['main']['smtp_sasl_auth_enable'] = 'no'
 default['postfix']['main']['mailbox_size_limit'] = 0
 default['postfix']['main']['mynetworks'] = nil
 default['postfix']['main']['inet_interfaces'] = 'loopback-only'
+default['postfix']['main']['default_database_type'] = lazy { node['postfix']['db_type'] }
+default['postfix']['main']['alias_database'] = lazy { "#{node['postfix']['db_type']}:#{node['postfix']['aliases_db']}" }
+default['postfix']['main']['alias_maps'] = lazy { "#{node['postfix']['db_type']}:#{node['postfix']['aliases_db']}" }
 
 # Conditional attributes, also reference _attributes recipe
 case node['platform_family']
@@ -407,4 +419,4 @@ default['postfix']['aliases'] = if platform?('freebsd')
                                   {}
                                 end
 
-default['postfix']['main']['smtpd_relay_restrictions'] = "hash:#{node['postfix']['relay_restrictions_db']}, reject" if node['postfix']['use_relay_restrictions_maps']
+default['postfix']['main']['smtpd_relay_restrictions'] = lazy { "#{node['postfix']['db_type']}:#{node['postfix']['relay_restrictions_db']}, reject" if node['postfix']['use_relay_restrictions_maps'] }

cookbooks/postfix/metadata.json

@@ -26,7 +26,7 @@
   "recipes": {
 
   },
-  "version": "6.0.26",
+  "version": "6.4.1",
   "source_url": "https://github.com/sous-chefs/postfix",
   "issues_url": "https://github.com/sous-chefs/postfix/issues",
   "privacy": false,

cookbooks/postfix/metadata.rb

@@ -3,7 +3,7 @@ maintainer        'Sous Chefs'
 maintainer_email  'help@sous-chefs.org'
 license           'Apache-2.0'
 description       'Installs and configures postfix for client or outbound relayhost, or to do SASL auth'
-version           '6.0.26'
+version           '6.4.1'
 source_url        'https://github.com/sous-chefs/postfix'
 issues_url        'https://github.com/sous-chefs/postfix/issues'
 chef_version      '>= 12.15'

cookbooks/postfix/recipes/_attributes.rb

@@ -29,24 +29,22 @@ end
 
 if node['postfix']['main']['smtp_sasl_auth_enable'] == 'yes'
   node.default_unless['postfix']['sasl_password_file'] = "#{node['postfix']['conf_dir']}/sasl_passwd"
-  node.default_unless['postfix']['main']['smtp_sasl_password_maps'] = "hash:#{node['postfix']['sasl_password_file']}"
+  node.default_unless['postfix']['main']['smtp_sasl_password_maps'] = "#{node['postfix']['db_type']}:#{node['postfix']['sasl_password_file']}"
   node.default_unless['postfix']['main']['smtp_sasl_security_options'] = 'noanonymous'
-  node.default_unless['postfix']['sasl']['smtp_sasl_user_name'] = ''
-  node.default_unless['postfix']['sasl']['smtp_sasl_passwd']    = ''
   node.default_unless['postfix']['main']['relayhost'] = ''
 end
 
-node.default_unless['postfix']['main']['alias_maps'] = ["hash:#{node['postfix']['aliases_db']}"] if node['postfix']['use_alias_maps']
+node.default_unless['postfix']['main']['alias_maps'] = ["#{node['postfix']['db_type']}:#{node['postfix']['aliases_db']}"] if node['postfix']['use_alias_maps']
 
-node.default_unless['postfix']['main']['transport_maps'] = ["hash:#{node['postfix']['transport_db']}"] if node['postfix']['use_transport_maps']
+node.default_unless['postfix']['main']['transport_maps'] = ["#{node['postfix']['db_type']}:#{node['postfix']['transport_db']}"] if node['postfix']['use_transport_maps']
 
-node.default_unless['postfix']['main']['access_maps'] = ["hash:#{node['postfix']['access_db']}"] if node['postfix']['use_access_maps']
+node.default_unless['postfix']['main']['access_maps'] = ["#{node['postfix']['db_type']}:#{node['postfix']['access_db']}"] if node['postfix']['use_access_maps']
 
 node.default_unless['postfix']['main']['virtual_alias_maps'] = ["#{node['postfix']['virtual_alias_db_type']}:#{node['postfix']['virtual_alias_db']}"] if node['postfix']['use_virtual_aliases']
 
 node.default_unless['postfix']['main']['virtual_alias_domains'] = ["#{node['postfix']['virtual_alias_domains_db_type']}:#{node['postfix']['virtual_alias_domains_db']}"] if node['postfix']['use_virtual_aliases_domains']
 
-node.default_unless['postfix']['main']['smtpd_relay_restrictions'] = "hash:#{node['postfix']['relay_restrictions_db']}, reject" if node['postfix']['use_relay_restrictions_maps']
+node.default_unless['postfix']['main']['smtpd_relay_restrictions'] = "#{node['postfix']['db_type']}:#{node['postfix']['relay_restrictions_db']}, reject" if node['postfix']['use_relay_restrictions_maps']
 
 node.default_unless['postfix']['main']['maildrop_destination_recipient_limit'] = 1 if node['postfix']['master']['maildrop']['active']
 

cookbooks/postfix/recipes/_common.rb

@@ -155,7 +155,7 @@ unless node['postfix']['sender_canonical_map_entries'].empty?
     notifies :reload, 'service[postfix]'
   end
 
-  node.default['postfix']['main']['sender_canonical_maps'] = "hash:#{node['postfix']['conf_dir']}/sender_canonical" unless node['postfix']['main'].key?('sender_canonical_maps')
+  node.default['postfix']['main']['sender_canonical_maps'] = "#{node['postfix']['db_type']}:#{node['postfix']['conf_dir']}/sender_canonical" unless node['postfix']['main'].key?('sender_canonical_maps')
 end
 
 execute 'update-postfix-smtp_generic' do
@@ -172,7 +172,7 @@ unless node['postfix']['smtp_generic_map_entries'].empty?
     notifies :reload, 'service[postfix]'
   end
 
-  node.default['postfix']['main']['smtp_generic_maps'] = "hash:#{node['postfix']['conf_dir']}/smtp_generic" unless node['postfix']['main'].key?('smtp_generic_maps')
+  node.default['postfix']['main']['smtp_generic_maps'] = "#{node['postfix']['db_type']}:#{node['postfix']['conf_dir']}/smtp_generic" unless node['postfix']['main'].key?('smtp_generic_maps')
 end
 
 execute 'update-postfix-recipient_canonical' do
@@ -189,7 +189,7 @@ unless node['postfix']['recipient_canonical_map_entries'].empty?
     notifies :reload, 'service[postfix]'
   end
 
-  node.default['postfix']['main']['recipient_canonical_maps'] = "hash:#{node['postfix']['conf_dir']}/recipient_canonical" unless node['postfix']['main'].key?('recipient_canonical_maps')
+  node.default['postfix']['main']['recipient_canonical_maps'] = "#{node['postfix']['db_type']}:#{node['postfix']['conf_dir']}/recipient_canonical" unless node['postfix']['main'].key?('recipient_canonical_maps')
 end
 
 service 'postfix' do

cookbooks/postfix/recipes/maps.rb

@@ -18,8 +18,8 @@ node['postfix']['maps'].each do |type, maps|
     package "postfix-#{type}" if %w(pgsql mysql ldap cdb).include?(type)
   end
 
-  if platform?('redhat') && node['platform_version'].to_i == 8
+  if platform_family?('rhel') && node['platform_version'].to_i >= 8
-    package "postfix-#{type}" if %w(pgsql mysql ldap cdb).include?(type)
+    package "postfix-#{type}" if %w(pgsql mysql ldap cdb lmdb).include?(type)
   end
 
   separator = if %w(pgsql mysql ldap memcache sqlite).include?(type)
@@ -32,7 +32,7 @@ node['postfix']['maps'].each do |type, maps|
       command "postmap #{file}"
       environment PATH: "#{ENV['PATH']}:/opt/omni/bin:/opt/omni/sbin" if platform_family?('omnios')
       action :nothing
-    end if %w(btree cdb dbm hash sdbm).include?(type)
+    end if %w(btree cdb dbm hash lmdb sdbm).include?(type)
     template "#{file}-#{type}" do
       path file
       source 'maps.erb'
@@ -41,7 +41,7 @@ node['postfix']['maps'].each do |type, maps|
         map: content,
         separator: separator
       )
-      notifies :run, "execute[update-postmap-#{file}]" if %w(btree cdb dbm hash sdbm).include?(type)
+      notifies :run, "execute[update-postmap-#{file}]" if %w(btree cdb dbm hash lmdb sdbm).include?(type)
       notifies :restart, 'service[postfix]'
     end
   end

cookbooks/postfix/renovate.json

@@ -1,9 +1,10 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:base"],
-  "packageRules": [{
+  "packageRules": [
+    {
       "groupName": "Actions",
-      "matchUpdateTypes": ["patch", "pin", "digest"],
+      "matchUpdateTypes": ["minor", "patch", "pin"],
       "automerge": true,
       "addLabels": ["Release: Patch", "Skip: Announcements"]
     },

cookbooks/postfix/templates/aliases.erb

@@ -6,5 +6,5 @@
 postmaster:    root
 
 <% node['postfix']['aliases'].each do |name, value| %>
-<%= name %>: <%= [value].flatten.map{|x| if (x.include?("@")) then x else %Q("#{x}") end}.join(', ') %>
+<%= name.match?(/[\s#:@]/) ? "\"#{name}\"" : name %>: <%= [value].flatten.map{|x| x.include?("|") ? "\"#{x}\"" : x}.join(',') %>
 <% end unless node['postfix']['aliases'].nil? %>

data_bags/credentials/akaunting.json

@@ -1,31 +0,0 @@
-{
-  "id": "akaunting",
-  "app_key": {
-    "encrypted_data": "C7VVGHHrE/ESwtGeODf8zVraayO5uBSXaGR7f4yoj0MDq9WxPujItC3dIkMQ\ngjGzk8fH\n",
-    "iv": "4+d+RMLeuqaneFBa\n",
-    "auth_tag": "sBQDUVl6QbL/h9pd0kBQ0g==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "pg_database": {
-    "encrypted_data": "4mqHsMfDAqPvDmGsWgS9iE63qVeus7diSW8WiA==\n",
-    "iv": "6Cb1lVUcXBz+GA4u\n",
-    "auth_tag": "8O3N0m8jGhxs/YacdhgNHA==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "pg_username": {
-    "encrypted_data": "Nu0wiBhvqUwqC7PL2Qo8otq0b3faJqRsabqp2g==\n",
-    "iv": "1uA8mJc7itT0qHcx\n",
-    "auth_tag": "PRWw6LTlFrWs63SDRsovtQ==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "pg_password": {
-    "encrypted_data": "oXDKiXQ4aH5M2pVu1sx7dj0awKCORke03fq0uemjIfCMYbM=\n",
-    "iv": "snPyC8mocevc5kGH\n",
-    "auth_tag": "9wx4GPSydkYr2WGpZK5HZg==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  }
-}

data_bags/credentials/akkounts.json

@@ -1,72 +1,93 @@
 {
   "id": "akkounts",
-  "postgresql_username": {
+  "rails_master_key": {
-    "encrypted_data": "ofLOjxGBj7no+lWrIvtxQQFoeozCh6mpfMTt\n",
+    "encrypted_data": "q/0BtGuFZJQhw+iG4ZmFG12DPaWQDGTb/nCmRoxOnsACkANqMv/zZ39CoNFe\nLPtZiItY\n",
-    "iv": "/CF+o4GqZx2O5WOm\n",
+    "iv": "JV8R0iu6TrqcZRxL\n",
-    "auth_tag": "bjHXfgNQfXpQ2gucPLrUWA==\n",
+    "auth_tag": "YxZIhEUnrd3XrwR6f9wO4A==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
-  "postgresql_password": {
+  "rails_secret_key_base": {
-    "encrypted_data": "f8Jfs4aqIjc6/6/NQlI2Fv8TzSgVmi5g0iYNhh9bAA==\n",
+    "encrypted_data": "JmDQew3+OR6+yJ1xErwXeTn6jw8N2HwTc9yvAVJ3G+7w1s3N7rKDM6+M50ez\n2zP4Lm/eXzH4WTsTZlQcodlyNpi66pvUCGAkNM36rwTN5yvnhqPUmuSQi7AG\nDTBronBwr9ENvwA/gRuugyyhrRB1iuStpzpYKCMhZ2ae9Mrxdux0+ezfSLn4\nuP22uUrEqdQ/BWsW\n",
-    "iv": "vAzrZeUodmu4x5eB\n",
+    "iv": "U/+YncCk13U6bYMz\n",
-    "auth_tag": "vx8eH2SY7I4IkZElXSC1Nw==\n",
+    "auth_tag": "2wPYJ/uVPv4jLKpAW/x6sw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "rails_encryption_primary_key": {
+    "encrypted_data": "u/7z91Og/2eM7PWi2JWYAQMhYX4S5+bMMeVpkFPu778Gqj6Td9pagsWIak/d\nb7AU1zjF\n",
+    "iv": "wYhrJWcuWbY8yo8S\n",
+    "auth_tag": "WEoEdNy6VBvB2d5gb8DTXw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "rails_encryption_key_derivation_salt": {
+    "encrypted_data": "noOwTZuxfhsH94bjOT9rWCKS9rb3wAoXELGrc4nJZeNrb/B9XnOLTuK/wen8\nfmtoym0P\n",
+    "iv": "jiFWs3VXhJdQBNqk\n",
+    "auth_tag": "XDpJFgadYp7LyRqU7SO+Fg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "postgresql": {
+    "encrypted_data": "Xorg8R8COxE/Swivu8MqZiwstD6rD+8FmgDx70pFscZ/CTb6WQRpyqGSrGZt\nZ7oL9WrqZs+mQgBb30odU+Sgdr6x\n",
+    "iv": "6QWZc3+MY0hBCc/s\n",
+    "auth_tag": "ZM+7OYyx5E9PciNG2OILhg==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  },
+  "ldap": {
+    "encrypted_data": "mr2Z7hXF1GOn8RmqeZMMdaUcmiVP4ZeKtTX6RYW1cR+FQiUwoITwTPBE9XUx\n2cqZ9Mcd8uJicmf9vd+PfwPtRtoZFwqHQ4LDRFLW64hBZyiEkZWxWW+HzgPr\n",
+    "iv": "k1AkyEplnJ4IZO1Z\n",
+    "auth_tag": "zAOcrPex3VLDfRFq38n7fA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "sentry_dsn": {
-    "encrypted_data": "oxW5jGU8DlIp5A9enxBhcJXuKyaZ5HziXq8Zw+Rbvpbv4C/RTGkJkgZdKcH1\nVzW/wNAT8nTK+nEvWgcQ3svjE40ltj2jcOexIRqLbuCClJE=\n",
+    "encrypted_data": "51cAERaRBCRg/sMb5c13EcnJzsz6VEf7jx6X3ooUSzm9wHoEfC5Hs/qakr/D\nqm9x3s3aGURRzyLUIEoe9jCohGguh6ehrXYVrun0B6pghVU=\n",
-    "iv": "wpW9+VdX5GjocHSl\n",
+    "iv": "hJsiiW6dFQMEQ+2p\n",
-    "auth_tag": "1qrf1kZMrIR7WRiSaRjppQ==\n",
+    "auth_tag": "TOIahNrUhhsdQGlzp6UV5g==\n",
-    "version": 3,
-    "cipher": "aes-256-gcm"
-  },
-  "rails_master_key": {
-    "encrypted_data": "KHVYYH7Nb9/SsoKkYfbjzhFwj3Ioj72hm5pfdCuinf+GQvjKumq99eQTlKdf\nBZM1n0XN\n",
-    "iv": "x9AQZvw/vCinKQ8k\n",
-    "auth_tag": "mi0KHHOTBvVNhtvqk38BtQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "discourse_connect_secret": {
-    "encrypted_data": "WyLrV0DOsxyafSqyeQVj0BhVwm/0gvWeJLBsAbiqCGphryoYqUByPcum1T6R\n2H44nQ==\n",
+    "encrypted_data": "pvKcwuZgUJsAvClQ4V0BwhwEg09EUEWVxoSx+mFlfG1KpvZE4Cu3u3PalPSD\nldyKsw==\n",
-    "iv": "lUtlJDv6Ieq8Bs5x\n",
+    "iv": "ED85d6PKyaKB3Wlv\n",
-    "auth_tag": "ku22BlQKw/BhHxuANTF6yg==\n",
+    "auth_tag": "XVCU/WigC97tNe0bUK6okQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "lndhub_admin_token": {
-    "encrypted_data": "DQuxQW8ks3sUzyHYEpQVyPg2f/U4/LWeRoCD9225Hd+c\n",
+    "encrypted_data": "LvCgahQblsKOxK9iNbwDd31atBfemVppHqV7s3K/sR4j\n",
-    "iv": "mjxYi+YAcKGuurD2\n",
+    "iv": "zObzh2jEsqXk2vD2\n",
-    "auth_tag": "8P3bFFNeQ5HQgpXDB5Sk5A==\n",
+    "auth_tag": "n9m/sBYBfzggwQLWrGpR2Q==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "btcpay_auth_token": {
-    "encrypted_data": "3wsY9osaUdX4SvBPfHprNLSbx6/rfI5BfXnDxsc6OET3nGn19qBhH6wgeiwZ\n/dweqdQ25HpbFPygddc=\n",
+    "encrypted_data": "M4kGd6+jresm90nWrJG25mX6rfhaU+VlJlIVd/IjOAUsDABryyulJul3GZFh\nFPSI4uEhgIWtn56I0bA=\n",
-    "iv": "ccouibxktHLlUCQJ\n",
+    "iv": "hvqHm7A/YfUOJwRJ\n",
-    "auth_tag": "pWuRC8O2EAkmztL/9V3now==\n",
+    "auth_tag": "DhtT6IeixD1MSRX+D7JxZA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "s3_access_key": {
-    "encrypted_data": "hJGHa+hEmddtsZ4UncrYBkjRa/2Csqdh79tXpTVxUWbIsYGdlvyadk7C1UCj\n",
+    "encrypted_data": "FPRpLZoIbLcVWPJhOlX7ZeXGv6TZIWYAD+BKTsJOyOHxDG3eRULqQc89cGWi\n",
-    "iv": "GlxNdnWiNzmNYthg\n",
+    "iv": "f9WiiGLmDxtygp60\n",
-    "auth_tag": "hlRLkroUN01L7VzQFBU/IA==\n",
+    "auth_tag": "lGnq4itmByuF/Yp20/6coQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "s3_secret_key": {
-    "encrypted_data": "LKdQJOKIfFIoiF3GvfTs1mg3AI//Aoi8r42zcw8QhEVPB8ONsSf0/vhM037C\nf5nzUk7xwglvTOveqbOM+UTBJF/4oblQfgwFW3VobWUGkJqjtKE=\n",
+    "encrypted_data": "JnnwISbHJ+d7JZB/C0NH0fb8p+bDSwoq5t5knSi+bSTltSxKcq6PRX9K6bov\nEbo0GTdWePbuc5NCsyYxfrkzCtpLXTIxeCROtinRmFIgMFNwaOA=\n",
-    "iv": "tWTxzK/ccpjlLmQV\n",
+    "iv": "pKPCaANDqGtbFV3V\n",
-    "auth_tag": "n2MFkTIquyqz4wqRNdSJcg==\n",
+    "auth_tag": "S//hn2HOhuZH8+UfCNBWDg==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "nostr_private_key": {
-    "encrypted_data": "CPMeNxzpYMReaQU4+v+EqpVESRsnaYc3a4y7OkHOhtn2gjaNEDERGKvRmlyd\nD6vxKPcIrwTCZ7neJ3YLOVOxPDNv6skqdtMHBwSgl7aBEOrx7tY=\n",
+    "encrypted_data": "AKfFiLow+veDyEWBwmCDuLerT3l+o2aJUCeHg2mZZIyoH4oeo/9crZwIdjBn\n70reouqnHNG9mBHuO/+IPGfj53mHLo+oGHh+6LkL3ImI4MFBofY=\n",
-    "iv": "AV1on2sw1avmFFuY\n",
+    "iv": "bPlOKk2qkJAzdKf+\n",
-    "auth_tag": "9rb9qQBKrj5Xja1t+qROKQ==\n",
+    "auth_tag": "VIp1IOjBGatn2MN5LHVymg==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }

data_bags/credentials/gandi_api.json

@@ -1,23 +1,23 @@
 {
   "id": "gandi_api",
   "key": {
-    "encrypted_data": "Ky1/PdywtEIl5vVXhzu3n2JetqOxnNjpjQ7yCao6qwIAn8oYxnv1c1hFAQ==\n",
+    "encrypted_data": "lU7/xYTmP5Sb6SsK5TNNIyegWozzBtUzpg7oDdl6gcz9FEMmG2ft0Ljh5Q==\n",
-    "iv": "stAc2FxDvUqrh0kt\n",
+    "iv": "EZPQD3C+wsP/mBhF\n",
-    "auth_tag": "rcK4Qt+f2O4Zo5IMmG0fkw==\n",
+    "auth_tag": "vF9E8Pj4Z8quJJdOMg/QTw==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "access_token": {
-    "encrypted_data": "J7zoLhEbPfPjnVWBmFmDdPKRer5GGw2o6Ad0uinznANugfaDiqjyYinOdEDF\nHlAqLmXv4J40rr3F+o4=\n",
+    "encrypted_data": "1Uw69JkNrmb8LU/qssuod1SlqxxrWR7TJQZeeivRrNzrMIVTEW/1uwJIYL6b\nM4GeeYl9lIRlMMmLBkc=\n",
-    "iv": "fAxFqVh9QqrfBsPW\n",
+    "iv": "cc1GJKu6Cf4DkIgX\n",
-    "auth_tag": "9ugi4frDLv8f7X0X1+k4DA==\n",
+    "auth_tag": "ERem4S7ozG695kjvWIMghw==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "domains": {
-    "encrypted_data": "X0KOKlJp5GYbKcq/jzmlaMmTXV1U7exWSqi3UxX9Sw==\n",
+    "encrypted_data": "scZ5blsSjs54DlitR7KZ3enLbyceOR5q0wjHw1golQ==\n",
-    "iv": "9JucnYLlYdQ9N6pd\n",
+    "iv": "oDcHm7shAzW97b4t\n",
-    "auth_tag": "sERYPDnVUJwVfSS8/xrPpQ==\n",
+    "auth_tag": "62Zais9yf68SwmZRsmZ3hw==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }

data_bags/credentials/kosmos-rs.json

@@ -0,0 +1,10 @@
+{
+  "id": "kosmos-rs",
+  "auth_tokens": {
+    "encrypted_data": "fiznpRw7VKlm232+U6XV1rqkAf2Z8CpoD8KyvuvOH2JniaymlcTHgazGWQ8s\nGeqK4RU9l4d29e9i+Mh0k4vnhO4q\n",
+    "iv": "SvurcL2oNSNWjlxp\n",
+    "auth_tag": "JLQ7vGXAuYYJpLEpL6C+Rw==\n",
+    "version": 3,
+    "cipher": "aes-256-gcm"
+  }
+}

data_bags/credentials/lndhub-go.json

@@ -1,30 +1,30 @@
 {
   "id": "lndhub-go",
   "jwt_secret": {
-    "encrypted_data": "3T4JYnoISKXCnatCBeLCXyE8wVjzphw5/JU5A0vHfQ2xSDZreIRQ\n",
+    "encrypted_data": "lJsKBTCRzI83xmRHXzpnuRH/4cuMOR+Rd+SBU50G9HdibadIEDhS\n",
-    "iv": "bGQZjCk6FtD/hqVj\n",
+    "iv": "f/SvsWtZIYOVc54X\n",
-    "auth_tag": "CS87+UK1ZIFMiNcNaoyO6w==\n",
+    "auth_tag": "YlJ78EuJbcPfjCPc2eH+ug==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "postgresql_password": {
-    "encrypted_data": "u8kf/6WdSTzyIz2kF+24JgOPLndWH2WmTFZ3CToJsnay\n",
+    "encrypted_data": "aT0yNlWjvk/0S4z2kZB4Ye1u/ngk5J6fGPbwZSfdq6cy\n",
-    "iv": "KqLtV2UuaAzJx7C8\n",
+    "iv": "OgUttF4LlSrL/7gH\n",
-    "auth_tag": "3aqx45+epb2NFkNfOfG89A==\n",
+    "auth_tag": "pcbbGqbQ2RjU+i9dt8c3OQ==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "admin_token": {
-    "encrypted_data": "Z737fXqRE9JHfunRhc2GG281dFFN1bvBvTzTDzl/Vb8O\n",
+    "encrypted_data": "I9EsqCCxMIw+fX6sfu6KX8B5fJj9DX5Y4tbX30jdnmxr\n",
-    "iv": "oKLQJbD67tiz2235\n",
+    "iv": "vnERvIWYInO6+Y8q\n",
-    "auth_tag": "SlVIqC9d9SRoO78M7cBjTw==\n",
+    "auth_tag": "gO+MprZUQgPEWJQUmSF1sA==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   },
   "sentry_dsn": {
-    "encrypted_data": "gmDHGDWkTIvaXjcWMs1dnKnbqtsADPJ2mLmWw8Idj6RVevU5CabjvviAxEo1\n3hs2LWuObumRSCQt2QKap191uMq3CL2+da53hbsv+JUkxl4=\n",
+    "encrypted_data": "+sUXWgl6dXpA1/0FqjKC3Jnl54aor6gtM+19EM/NsHwg4qu672YnSgxV+c9x\nHM3JZBYxBYvJ+HYGAvMmhlGvaOOEIvLmFUpCCJeVUXR32S8=\n",
-    "iv": "Yt0fSsxL4SNicwUY\n",
+    "iv": "82+DzAnHiptaX7sO\n",
-    "auth_tag": "j7BWbcNnymHHMNTADWmCNw==\n",
+    "auth_tag": "CDx44iRBVhSIF8DOxb2c+w==\n",
     "version": 3,
     "cipher": "aes-256-gcm"
   }

doc/mastodon.md

@@ -0,0 +1,15 @@
+# Mastodon
+
+Running on kosmos.social
+
+## Ops
+
+### Enable maintance mode
+
+Return a 503 and maintance page for all requests:
+
+    knife ssh -p2222 -a knife_zero.host "role:openresty_proxy" "sudo cp -p /var/www/maintenance.html /var/www/kosmos.social/public/ && sudo systemctl reload openresty"
+
+### Stop maintenance mode
+
+    knife ssh -p2222 -a knife_zero.host "role:openresty_proxy" "sudo rm /var/www/kosmos.social/public/maintenance.html && sudo systemctl reload openresty"

environments/production.json

@@ -105,19 +105,39 @@
     },
     "strfry": {
       "domain": "nostr.kosmos.org",
-      "real_ip_header": "x-real-ip",
+      "config": {
-      "policy_path": "/opt/strfry/strfry-policy.ts",
+        "events": {
-      "whitelist_pubkeys": [
+          "max_event_size": "524288"
-        "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a",
+        },
-        "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf"
+        "relay": {
-      ],
+          "bind": "0.0.0.0",
-      "info": {
+          "real_ip_header": "x-real-ip",
-        "name": "Kosmos Relay",
+          "info": {
-        "description": "Members-only nostr relay for kosmos.org users",
+            "name": "Kosmos Relay",
-        "pubkey": "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf",
+            "description": "Members-only nostr relay for kosmos.org users",
-        "contact": "ops@kosmos.org",
+            "pubkey": "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf",
-        "icon": "https://assets.kosmos.org/img/app-icon-256px.png"
+            "contact": "ops@kosmos.org",
+            "icon": "https://assets.kosmos.org/img/app-icon-256px.png"
+          },
+          "write_policy": {
+            "plugin": "/opt/strfry/strfry-policy.ts"
+          },
+          "logging": {
+            "dump_in_all": true
+          }
+        }
+      },
+      "known_pubkeys": {
+        "_": "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf",
+        "accounts": "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a",
+        "bitcoincore": "47750177bb6bb113784e4973f6b2e3dd27ef1eff227d6e38d0046d618969e41a",
+        "fiatjaf": "3bf0c63fcb93463407af97a5e5ee64fa883d107ef9e558472c4eb9aaaefa459d"
       }
+    },
+    "substr": {
+      "relay_urls": [
+        "ws://localhost:7777"
+      ]
     }
   }
 }

nodes/akaunting-1.json

@@ -1,66 +0,0 @@
-{
-  "name": "akaunting-1",
-  "chef_environment": "production",
-  "normal": {
-    "knife_zero": {
-      "host": "10.1.1.215"
-    }
-  },
-  "automatic": {
-    "fqdn": "akaunting-1",
-    "os": "linux",
-    "os_version": "5.15.0-1069-kvm",
-    "hostname": "akaunting-1",
-    "ipaddress": "192.168.122.162",
-    "roles": [
-      "base",
-      "kvm_guest",
-      "akaunting",
-      "postgresql_client"
-    ],
-    "recipes": [
-      "kosmos-base",
-      "kosmos-base::default",
-      "kosmos_kvm::guest",
-      "kosmos_postgresql::hostsfile",
-      "kosmos_akaunting",
-      "kosmos_akaunting::default",
-      "apt::default",
-      "timezone_iii::default",
-      "timezone_iii::debian",
-      "ntp::default",
-      "ntp::apparmor",
-      "kosmos-base::systemd_emails",
-      "apt::unattended-upgrades",
-      "kosmos-base::firewall",
-      "kosmos-postfix::default",
-      "postfix::default",
-      "postfix::_common",
-      "postfix::_attributes",
-      "postfix::sasl_auth",
-      "hostname::default",
-      "kosmos-nodejs::default",
-      "nodejs::nodejs_from_package",
-      "nodejs::repo"
-    ],
-    "platform": "ubuntu",
-    "platform_version": "22.04",
-    "cloud": null,
-    "chef_packages": {
-      "chef": {
-        "version": "18.5.0",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
-        "chef_effortless": null
-      },
-      "ohai": {
-        "version": "18.1.11",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
-      }
-    }
-  },
-  "run_list": [
-    "role[base]",
-    "role[kvm_guest]",
-    "role[akaunting]"
-  ]
-}

nodes/akkounts-1.json

@@ -9,7 +9,7 @@
   "automatic": {
     "fqdn": "akkounts-1",
     "os": "linux",
-    "os_version": "5.4.0-148-generic",
+    "os_version": "5.4.0-216-generic",
     "hostname": "akkounts-1",
     "ipaddress": "192.168.122.160",
     "roles": [
@@ -38,6 +38,7 @@
       "timezone_iii::debian",
       "ntp::default",
       "ntp::apparmor",
+      "kosmos-base::journald_conf",
       "kosmos-base::systemd_emails",
       "apt::unattended-upgrades",
       "kosmos-base::firewall",

nodes/bitcoin-2.json

@@ -38,11 +38,13 @@
       "kosmos-bitcoin::dotnet",
       "kosmos-bitcoin::nbxplorer",
       "kosmos-bitcoin::btcpay",
+      "kosmos-bitcoin::price_tracking",
       "apt::default",
       "timezone_iii::default",
       "timezone_iii::debian",
       "ntp::default",
       "ntp::apparmor",
+      "kosmos-base::journald_conf",
       "kosmos-base::systemd_emails",
       "apt::unattended-upgrades",
       "kosmos-base::firewall",
@@ -102,6 +104,7 @@
     "role[bitcoind]",
     "role[lnd]",
     "role[lndhub]",
-    "role[btcpay]"
+    "role[btcpay]",
+    "recipe[kosmos-bitcoin::price_tracking]"
   ]
 }

nodes/draco.kosmos.org.json

@@ -20,7 +20,7 @@
   "automatic": {
     "fqdn": "draco.kosmos.org",
     "os": "linux",
-    "os_version": "5.4.0-54-generic",
+    "os_version": "5.4.0-187-generic",
     "hostname": "draco",
     "ipaddress": "148.251.237.73",
     "roles": [

nodes/drone-1.json

@@ -8,26 +8,27 @@
   "automatic": {
     "fqdn": "drone-1",
     "os": "linux",
-    "os_version": "5.4.0-1058-kvm",
+    "os_version": "5.4.0-1133-kvm",
     "hostname": "drone-1",
     "ipaddress": "192.168.122.200",
     "roles": [
+      "kvm_guest",
       "drone",
-      "postgresql_client",
+      "postgresql_client"
-      "kvm_guest"
     ],
     "recipes": [
       "kosmos-base",
       "kosmos-base::default",
+      "kosmos_kvm::guest",
       "kosmos_postgresql::hostsfile",
       "kosmos_drone",
       "kosmos_drone::default",
-      "kosmos_kvm::guest",
       "apt::default",
       "timezone_iii::default",
       "timezone_iii::debian",
       "ntp::default",
       "ntp::apparmor",
+      "kosmos-base::journald_conf",
       "kosmos-base::systemd_emails",
       "apt::unattended-upgrades",
       "kosmos-base::firewall",
@@ -43,13 +44,13 @@
     "cloud": null,
     "chef_packages": {
       "chef": {
-        "version": "17.9.52",
+        "version": "18.7.10",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.0.0/gems/chef-17.9.52/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.7.10/lib",
         "chef_effortless": null
       },
       "ohai": {
-        "version": "17.9.0",
+        "version": "18.2.5",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.0.0/gems/ohai-17.9.0/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.5/lib/ohai"
       }
     }
   },
@@ -58,4 +59,4 @@
     "role[kvm_guest]",
     "role[drone]"
   ]
-}
+}

nodes/gitea-2.json

@@ -9,7 +9,7 @@
   "automatic": {
     "fqdn": "gitea-2",
     "os": "linux",
-    "os_version": "5.4.0-1096-kvm",
+    "os_version": "5.4.0-1123-kvm",
     "hostname": "gitea-2",
     "ipaddress": "192.168.122.189",
     "roles": [
@@ -39,6 +39,7 @@
       "timezone_iii::debian",
       "ntp::default",
       "ntp::apparmor",
+      "kosmos-base::journald_conf",
       "kosmos-base::systemd_emails",
       "apt::unattended-upgrades",
       "kosmos-base::firewall",
@@ -49,6 +50,13 @@
       "postfix::sasl_auth",
       "hostname::default",
       "firewall::default",
+      "kosmos_gitea::compile_from_source",
+      "git::default",
+      "git::package",
+      "kosmos-nodejs::default",
+      "nodejs::nodejs_from_package",
+      "nodejs::repo",
+      "golang::default",
       "backup::default",
       "logrotate::default"
     ],

nodes/her.json

@@ -9,7 +9,7 @@
   "automatic": {
     "fqdn": "her",
     "os": "linux",
-    "os_version": "5.15.0-101-generic",
+    "os_version": "5.15.0-84-generic",
     "hostname": "her",
     "ipaddress": "192.168.30.172",
     "roles": [

nodes/mastodon-3.json

@@ -37,6 +37,7 @@
       "timezone_iii::debian",
       "ntp::default",
       "ntp::apparmor",
+      "kosmos-base::journald_conf",
       "kosmos-base::systemd_emails",
       "apt::unattended-upgrades",
       "kosmos-base::firewall",

nodes/postgres-6.json

@@ -22,7 +22,7 @@
       "kosmos_kvm::guest",
       "kosmos_postgresql::primary",
       "kosmos_postgresql::firewall",
-      "kosmos_akaunting::pg_db",
+      "kosmos-akkounts::pg_db",
       "kosmos-bitcoin::lndhub-go_pg_db",
       "kosmos-bitcoin::nbxplorer_pg_db",
       "kosmos_drone::pg_db",

nodes/postgres-7.json

@@ -29,6 +29,7 @@
       "timezone_iii::debian",
       "ntp::default",
       "ntp::apparmor",
+      "kosmos-base::journald_conf",
       "kosmos-base::systemd_emails",
       "apt::unattended-upgrades",
       "kosmos-base::firewall",

nodes/strfry-1.json

@@ -27,11 +27,13 @@
       "strfry::default",
       "kosmos_strfry::policies",
       "kosmos_strfry::firewall",
+      "kosmos_strfry::substr",
       "apt::default",
       "timezone_iii::default",
       "timezone_iii::debian",
       "ntp::default",
       "ntp::apparmor",
+      "kosmos-base::journald_conf",
       "kosmos-base::systemd_emails",
       "apt::unattended-upgrades",
       "kosmos-base::firewall",

roles/akaunting.rb

@@ -1,6 +0,0 @@
-name "akaunting"
-
-run_list %w[
-  role[postgresql_client]
-  kosmos_akaunting::default
-]

roles/gitea.rb

@@ -5,3 +5,11 @@ run_list %w(
   kosmos_gitea::default
   kosmos_gitea::backup
 )
+
+override_attributes(
+  "gitea" => {
+    "repo" => "https://github.com/67P/gitea.git",
+    "revision" => "ldap_sync",
+    "log" => { "level" => "Info" }
+  },
+)

roles/postgresql_primary.rb

@@ -3,7 +3,7 @@ name "postgresql_primary"
 run_list %w(
   kosmos_postgresql::primary
   kosmos_postgresql::firewall
-  kosmos_akaunting::pg_db
+  kosmos-akkounts::pg_db
   kosmos-bitcoin::lndhub-go_pg_db
   kosmos-bitcoin::nbxplorer_pg_db
   kosmos_drone::pg_db

roles/strfry.rb

@@ -5,4 +5,5 @@ run_list %w(
   strfry::default
   kosmos_strfry::policies
   kosmos_strfry::firewall
+  kosmos_strfry::substr
 )

site-cookbooks/kosmos-akkounts/recipes/default.rb

@@ -24,13 +24,12 @@ package "libvips"
 
 include_recipe 'redisio::default'
 include_recipe 'redisio::enable'
+
+node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_20.x"
 include_recipe 'kosmos-nodejs'
+npm_package "bun"
 
-npm_package "yarn" do
+ruby_version = "3.3.8"
-  version "1.22.4"
-end
-
-ruby_version = "3.3.0"
 ruby_path = "/opt/ruby_build/builds/#{ruby_version}"
 bundle_path = "#{ruby_path}/bin/bundle"
 rails_env = node.chef_environment == "development" ? "development" : "production"
@@ -48,7 +47,28 @@ webhooks_allowed_ips = [lndhub_host].compact.uniq.join(',')
 env = {
   primary_domain: node['akkounts']['primary_domain'],
   akkounts_domain: node['akkounts']['domain'],
-  rails_serve_static_files: true
+  rails_serve_static_files: true,
+  secret_key_base: credentials["rails_secret_key_base"],
+  encryption_primary_key: credentials["rails_encryption_primary_key"],
+  encryption_key_derivation_salt: credentials["rails_encryption_key_derivation_salt"],
+  db_adapter: "postgresql",
+  pg_host: "pg.kosmos.local",
+  pg_port: 5432,
+  pg_database: "akkounts",
+  pg_database_queue: "akkounts_queue",
+  pg_username: credentials["postgresql"]["username"],
+  pg_password: credentials["postgresql"]["password"]
+}
+
+env[:ldap] = {
+  host: "ldap.kosmos.local",
+  port: 389,
+  use_tls: false,
+  uid_attr: "cn",
+  base: "ou=kosmos.org,cn=users,dc=kosmos,dc=org",
+  admin_user: credentials["ldap"]["admin_user"],
+  admin_password: credentials["ldap"]["admin_password"],
+  suffix: "dc=kosmos,dc=org"
 }
 
 smtp_server, smtp_port = smtp_credentials[:relayhost].split(":")
@@ -138,9 +158,9 @@ if lndhub_host
   if postgres_readonly_host
     env[:lndhub_admin_ui] = true
     env[:lndhub_pg_host] = postgres_readonly_host
-    env[:lndhub_pg_database] = node['akkounts']['lndhub']['postgres_db']
+    env[:lndhub_pg_database] = node["akkounts"]["lndhub"]["postgres_db"]
-    env[:lndhub_pg_username] = credentials['postgresql_username']
+    env[:lndhub_pg_username] = credentials["postgresql"]["username"]
-    env[:lndhub_pg_password] = credentials['postgresql_password']
+    env[:lndhub_pg_password] = credentials["postgresql"]["password"]
   end
 end
 
@@ -208,7 +228,7 @@ systemd_unit "akkounts.service" do
       Type: "simple",
       User: deploy_user,
       WorkingDirectory: deploy_path,
-      Environment: "RAILS_ENV=#{rails_env}",
+      Environment: "RAILS_ENV=#{rails_env} SOLID_QUEUE_IN_PUMA=true",
       ExecStart: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid",
       ExecStop: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid stop",
       ExecReload: "#{bundle_path} exec pumactl -F config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid phased-restart",
@@ -225,36 +245,6 @@ systemd_unit "akkounts.service" do
   action [:create, :enable]
 end
 
-systemd_unit "akkounts-sidekiq.service" do
-  content({
-    Unit: {
-      Description: "Kosmos Accounts async/background jobs",
-      Documentation: ["https://gitea.kosmos.org/kosmos/akkounts"],
-      Requires: "redis@6379.service",
-      After: "syslog.target network.target redis@6379.service"
-    },
-    Service: {
-      Type: "notify",
-      User: deploy_user,
-      WorkingDirectory: deploy_path,
-      Environment: "MALLOC_ARENA_MAX=2",
-      ExecStart: "#{bundle_path} exec sidekiq -C #{deploy_path}/config/sidekiq.yml -e #{rails_env}",
-      WatchdogSec: "10",
-      Restart: "on-failure",
-      RestartSec: "1",
-      StandardOutput: "syslog",
-      StandardError: "syslog",
-      SyslogIdentifier: "sidekiq"
-    },
-    Install: {
-      WantedBy: "multi-user.target"
-    }
-  })
-  verify false
-  triggers_reload true
-  action [:create, :enable]
-end
-
 deploy_env = {
   "HOME" => deploy_path,
   "PATH" => "#{ruby_path}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin",
@@ -267,15 +257,7 @@ git deploy_path do
   revision node[app_name]["revision"]
   user  deploy_user
   group deploy_group
-  # Restart services on deployments
-  notifies :run, "execute[restart #{app_name} services]", :delayed
-end
-
-execute "restart #{app_name} services" do
-  command "true"
-  action :nothing
   notifies :restart, "service[#{app_name}]", :delayed
-  notifies :restart, "service[#{app_name}-sidekiq]", :delayed
 end
 
 file "#{deploy_path}/config/master.key" do
@@ -283,7 +265,7 @@ file "#{deploy_path}/config/master.key" do
   mode '0400'
   owner deploy_user
   group deploy_group
-  notifies :run, "execute[restart #{app_name} services]", :delayed
+  notifies :restart, "service[#{app_name}]", :delayed
 end
 
 template "#{deploy_path}/.env.#{rails_env}" do
@@ -293,7 +275,7 @@ template "#{deploy_path}/.env.#{rails_env}" do
   mode 0600
   sensitive true
   variables config: env
-  notifies :run, "execute[restart #{app_name} services]", :delayed
+  notifies :restart, "service[#{app_name}]", :delayed
 end
 
 execute "bundle install" do
@@ -303,13 +285,6 @@ execute "bundle install" do
   command "bundle install --without development,test --deployment"
 end
 
-execute "yarn install" do
-  environment deploy_env
-  user deploy_user
-  cwd deploy_path
-  command "yarn install --pure-lockfile"
-end
-
 execute 'rake db:migrate' do
   environment deploy_env
   user deploy_user
@@ -330,10 +305,6 @@ service "akkounts" do
   action [:enable, :start]
 end
 
-service "akkounts-sidekiq" do
-  action [:enable, :start]
-end
-
 firewall_rule "akkounts_zerotier" do
   command  :allow
   port     node["akkounts"]["port"]

site-cookbooks/kosmos-akkounts/recipes/pg_db.rb

@@ -0,0 +1,22 @@
+#
+# Cookbook:: kosmos-akkounts
+# Recipe:: pg_db
+#
+
+credentials = data_bag_item("credentials", "akkounts")
+pg_username = credentials["postgresql"]["username"]
+pg_password = credentials["postgresql"]["password"]
+
+postgresql_user pg_username do
+  action :create
+  password pg_password
+end
+
+databases = ["akkounts", "akkounts_queue"]
+
+databases.each do |database|
+  postgresql_database database do
+    owner pg_username
+    action :create
+  end
+end

site-cookbooks/kosmos-base/attributes/default.rb

@@ -0,0 +1,2 @@
+node.default["kosmos-base"]["journald"]["system_max_use"] = "256M"
+node.default["kosmos-base"]["journald"]["max_retention_sec"] = "7d"

site-cookbooks/kosmos-base/recipes/default.rb

@@ -27,11 +27,19 @@
 include_recipe 'apt'
 include_recipe 'timezone_iii'
 include_recipe 'ntp'
+include_recipe 'kosmos-base::journald_conf'
 include_recipe 'kosmos-base::systemd_emails'
 
+node.override["apt"]["unattended_upgrades"]["enable"] = true
+node.override["apt"]["unattended_upgrades"]["mail_only_on_error"] = false
+node.override["apt"]["unattended_upgrades"]["sender"] = "ops@kosmos.org"
 node.override["apt"]["unattended_upgrades"]["allowed_origins"] = [
   "${distro_id}:${distro_codename}-security",
-  "${distro_id}:${distro_codename}-updates"
+  "${distro_id}:${distro_codename}-updates",
+  "${distro_id}ESMApps:${distro_codename}-apps-security",
+  "${distro_id}ESMApps:${distro_codename}-apps-updates",
+  "${distro_id}ESM:${distro_codename}-infra-security",
+  "${distro_id}ESM:${distro_codename}-infra-updates"
 ]
 node.override["apt"]["unattended_upgrades"]["mail"] = "ops@kosmos.org"
 node.override["apt"]["unattended_upgrades"]["syslog_enable"] = true

site-cookbooks/kosmos-base/recipes/journald_conf.rb

@@ -0,0 +1,14 @@
+#
+# Cookbook Name:: kosmos-base
+# Recipe:: journald_conf
+#
+
+service "systemd-journald"
+
+template "/etc/systemd/journald.conf" do
+  source "journald.conf.erb"
+  variables system_max_use: node["kosmos-base"]["journald"]["system_max_use"],
+            max_retention_sec: node["kosmos-base"]["journald"]["max_retention_sec"]
+  # Restarting journald is required
+  notifies :restart, "service[systemd-journald]", :delayed
+end

site-cookbooks/kosmos-base/templates/default/journald.conf.erb

@@ -0,0 +1,6 @@
+[Journal]
+# Set the maximum size of the journal logs in bytes
+SystemMaxUse=<%= @system_max_use %>
+
+# Set the number of days after which logs will be deleted
+MaxRetentionSec=<%= @max_retention_sec %>

site-cookbooks/kosmos-bitcoin/attributes/default.rb

@@ -1,5 +1,5 @@
-node.default['bitcoin']['version']   = '28.0'
+node.default['bitcoin']['version']   = '29.0'
-node.default['bitcoin']['checksum']  = '700ae2d1e204602eb07f2779a6e6669893bc96c0dca290593f80ff8e102ff37f'
+node.default['bitcoin']['checksum']  = '882c782c34a3bf2eacd1fae5cdc58b35b869883512f197f7d6dc8f195decfdaa'
 node.default['bitcoin']['username']  = 'satoshi'
 node.default['bitcoin']['usergroup'] = 'bitcoin'
 node.default['bitcoin']['network']   = 'mainnet'
@@ -41,7 +41,7 @@ node.default['c-lightning']['log_level'] = 'info'
 node.default['c-lightning']['public_ip'] = '148.251.237.73'
 
 node.default['lnd']['repo'] = 'https://github.com/lightningnetwork/lnd'
-node.default['lnd']['revision'] = 'v0.18.3-beta'
+node.default['lnd']['revision'] = 'v0.19.1-beta'
 node.default['lnd']['source_dir'] = '/opt/lnd'
 node.default['lnd']['lnd_dir'] = "/home/#{node['bitcoin']['username']}/.lnd"
 node.default['lnd']['alias'] = 'ln2.kosmos.org'
@@ -90,7 +90,7 @@ node.default['dotnet']['ms_packages_src_url'] = "https://packages.microsoft.com/
 node.default['dotnet']['ms_packages_src_checksum'] = "4df5811c41fdded83eb9e2da9336a8dfa5594a79dc8a80133bd815f4f85b9991"
 
 node.default['nbxplorer']['repo'] = 'https://github.com/dgarage/NBXplorer'
-node.default['nbxplorer']['revision'] = 'v2.5.0'
+node.default['nbxplorer']['revision'] = 'v2.5.26'
 node.default['nbxplorer']['source_dir'] = '/opt/nbxplorer'
 node.default['nbxplorer']['config_path'] = "/home/#{node['bitcoin']['username']}/.nbxplorer/Main/settings.config"
 node.default['nbxplorer']['port'] = '24445'
@@ -98,7 +98,7 @@ node.default['nbxplorer']['postgres']['database'] = 'nbxplorer'
 node.default['nbxplorer']['postgres']['user'] = 'nbxplorer'
 
 node.default['btcpay']['repo'] = 'https://github.com/btcpayserver/btcpayserver'
-node.default['btcpay']['revision'] = 'v1.12.5'
+node.default['btcpay']['revision'] = 'v2.1.1'
 node.default['btcpay']['source_dir'] = '/opt/btcpay'
 node.default['btcpay']['config_path'] = "/home/#{node['bitcoin']['username']}/.btcpayserver/Main/settings.config"
 node.default['btcpay']['log_path'] = "/home/#{node['bitcoin']['username']}/.btcpayserver/debug.log"
@@ -111,3 +111,5 @@ node.default['btcpay']['postgres']['user'] = 'satoshi'
 node.default['peerswap']['repo'] = 'https://github.com/ElementsProject/peerswap.git'
 node.default['peerswap']['revision'] = 'master'
 node.default['peerswap-lnd']['source_dir'] = '/opt/peerswap'
+
+node.default['price_tracking']['rs_base_url'] = "https://storage.kosmos.org/kosmos/public/btc-price"

site-cookbooks/kosmos-bitcoin/recipes/bitcoind.rb

@@ -34,7 +34,7 @@ end
 execute "compile_bitcoin-core_dependencies" do
   cwd "/usr/local/bitcoind/depends"
   environment ({'CC' => 'gcc-13', 'CXX' => 'g++-13', 'NO_QT' => '1'})
-  command "make -j 2"
+  command "make -j $(($(nproc)/2))"
   action :nothing
   notifies :run, 'bash[compile_bitcoin-core]', :immediately
 end
@@ -43,21 +43,13 @@ bash "compile_bitcoin-core" do
   cwd "/usr/local/bitcoind"
   environment ({'CC' => 'gcc-13', 'CXX' => 'g++-13', 'NO_QT' => '1'})
   code <<-EOH
-    ./autogen.sh
+    cmake -B build --toolchain depends/x86_64-pc-linux-gnu/toolchain.cmake
-    ./configure --prefix=$PWD/depends/x86_64-pc-linux-gnu
+    cmake --build build -j $(($(nproc)/2))
-    make
+    cmake --install build
   EOH
   action :nothing
 end
 
-link "/usr/local/bin/bitcoind" do
-  to "/usr/local/bitcoind/src/bitcoind"
-end
-
-link "/usr/local/bin/bitcoin-cli" do
-  to "/usr/local/bitcoind/src/bitcoin-cli"
-end
-
 bitcoin_user      = node['bitcoin']['username']
 bitcoin_group     = node['bitcoin']['usergroup']
 bitcoin_datadir   = node['bitcoin']['datadir']

site-cookbooks/kosmos-bitcoin/recipes/btcpay.rb

@@ -21,6 +21,7 @@ bash 'build_btcpay' do
     systemctl stop btcpayserver.service
     ./build.sh
   EOH
+  environment "DOTNET_CLI_TELEMETRY_OPTOUT" => 1
   action :nothing
   notifies :restart, "service[btcpayserver]", :delayed
 end
@@ -87,7 +88,7 @@ systemd_unit 'btcpayserver.service' do
       Group: node['bitcoin']['usergroup'],
       Type: 'simple',
       WorkingDirectory: node['btcpay']['source_dir'],
-      Environment: defined?(nbxpg_connect) ? "'BTCPAY_EXPLORERPOSTGRES=#{nbxpg_connect}'" : '',
+      Environment: "'BTCPAY_EXPLORERPOSTGRES=#{nbxpg_connect}' 'DOTNET_CLI_TELEMETRY_OPTOUT=1'",
       ExecStart: "#{node['btcpay']['source_dir']}/run.sh --conf=#{node['btcpay']['config_path']}",
       PIDFile: '/run/btcpayserver/btcpayserver.pid',
       Restart: 'on-failure',
@@ -103,6 +104,8 @@ systemd_unit 'btcpayserver.service' do
   verify false
   triggers_reload true
   action [:create]
+  # reload is not applicable
+  notifies :restart, "service[btcpayserver]", :delayed
 end
 
 service "btcpayserver" do

site-cookbooks/kosmos-bitcoin/recipes/nbxplorer.rb

@@ -58,9 +58,7 @@ directory '/run/nbxplorer' do
 end
 
 env = {
-  NBXPLORER_POSTGRES: "User ID=#{postgres_user};Password=#{credentials['postgresql_password']};Database=#{postgres_database};Host=pg.kosmos.local;Port=5432;Application Name=nbxplorer;MaxPoolSize=20",
+  NBXPLORER_POSTGRES: "User ID=#{postgres_user};Password=#{credentials['postgresql_password']};Database=#{postgres_database};Host=pg.kosmos.local;Port=5432;Application Name=nbxplorer;MaxPoolSize=20"
-  NBXPLORER_AUTOMIGRATE: "1",
-  NBXPLORER_NOMIGRATEEVTS: "1"
 }
 
 systemd_unit 'nbxplorer.service' do

site-cookbooks/kosmos-bitcoin/recipes/price_tracking.rb

@@ -0,0 +1,59 @@
+#
+# Cookbook:: kosmos-bitcoin
+# Recipe:: price_tracking
+#
+# Track BTC rates and publish them via remoteStorage
+#
+
+%w[curl jq].each do |pkg|
+  apt_package pkg
+end
+
+daily_tracker_path = "/usr/local/bin/btc-price-tracker-daily"
+
+credentials = Chef::EncryptedDataBagItem.load('credentials', 'kosmos-rs')
+
+template daily_tracker_path do
+  source "btc-price-tracker-daily.sh.erb"
+  mode '0740'
+  variables rs_base_url: node['price_tracking']['rs_base_url']
+  notifies :restart, "systemd_unit[lnd-channel-backup.service]", :delayed
+end
+
+systemd_unit 'btc-price-tracker-daily.service' do
+  content({
+    Unit: {
+      Description: 'BTC price tracker (daily rates)',
+      After: 'network-online.target',
+      Wants: 'network-online.target'
+    },
+    Service: {
+      Type: 'oneshot',
+      ExecStart: daily_tracker_path,
+      Environment: "RS_AUTH=#{credentials["auth_tokens"]["/btc-price"]}"
+    },
+    Install: {
+      WantedBy: 'multi-user.target'
+    }
+  })
+  sensitive true
+  triggers_reload true
+  action [:create]
+end
+
+systemd_unit 'btc-price-tracker-daily.timer' do
+  content({
+    Unit: {
+      Description: 'Run BTC price tracker daily'
+    },
+    Timer: {
+      OnCalendar: '*-*-* 00:00:00',
+      Persistent: 'true'
+    },
+    Install: {
+      WantedBy: 'timers.target'
+    }
+  })
+  triggers_reload true
+  action [:create, :enable, :start]
+end

site-cookbooks/kosmos-bitcoin/templates/btc-price-tracker-daily.sh.erb

@@ -0,0 +1,49 @@
+#!/bin/bash
+
+# Calculate yesterday's date in YYYY-MM-DD format
+YESTERDAY=$(date -d "yesterday" +%Y-%m-%d)
+echo "Starting price tracking for $YESTERDAY" >&2
+
+# Fetch and process rates for a fiat currency
+get_price_data() {
+    local currency=$1
+    local data avg open24 last
+
+    data=$(curl -s "https://www.bitstamp.net/api/v2/ticker/btc${currency,,}/")
+    if [ $? -eq 0 ] && [ ! -z "$data" ]; then
+        echo "Successfully retrieved ${currency} price data" >&2
+        open24=$(echo "$data" | jq -r '.open_24')
+        last=$(echo "$data" | jq -r '.last')
+        avg=$(( (${open24%.*} + ${last%.*}) / 2 ))
+        echo $avg
+    else
+        echo "ERROR: Failed to retrieve ${currency} price data" >&2
+        exit 1
+    fi
+}
+
+# Get price data for each currency
+usd_avg=$(get_price_data "USD")
+eur_avg=$(get_price_data "EUR")
+gbp_avg=$(get_price_data "GBP")
+
+# Create JSON
+json="{\"EUR\":$eur_avg,\"USD\":$usd_avg,\"GBP\":$gbp_avg}"
+echo "Rates: $json" >&2
+
+# PUT in remote storage
+response=$(curl -X PUT \
+    -H "Authorization: Bearer $RS_AUTH" \
+    -H "Content-Type: application/json" \
+    -d "$json" \
+    -w "%{http_code}" \
+    -s \
+    -o /dev/null \
+    "<%= @rs_base_url %>/$YESTERDAY")
+
+if [ "$response" -eq 200 ] || [ "$response" -eq 201 ]; then
+   echo "Successfully uploaded price data" >&2
+else
+   echo "ERROR: Failed to upload price data. HTTP status: $response" >&2
+   exit 1
+fi

site-cookbooks/kosmos-ejabberd/attributes/default.rb

@@ -1,6 +1,6 @@
-node.default["ejabberd"]["version"] = "23.10"
+node.default["ejabberd"]["version"] = "24.02"
 node.default["ejabberd"]["package_version"] = "1"
-node.default["ejabberd"]["checksum"] = "1b02108c81e22ab28be84630d54061f0584b76d5c2702e598352269736b05e77"
+node.default["ejabberd"]["checksum"] = "476c187b42074b88472fd1c8042418072e47962facd47dab4e5883f6f61b2173"
 node.default["ejabberd"]["turn_domain"] = "turn.kosmos.org"
 node.default["ejabberd"]["stun_auth_realm"] = "kosmos.org"
 node.default["ejabberd"]["stun_turn_port"] = 3478

site-cookbooks/kosmos-ejabberd/recipes/default.rb

@@ -110,6 +110,7 @@ hosts = [
         access_persistent: muc_create
         access_register: muc_create
         max_user_conferences: 1000
+        max_users: 2000
         default_room_options:
           mam: true
         preload_rooms: true

site-cookbooks/kosmos-ejabberd/recipes/letsencrypt.rb

@@ -16,8 +16,8 @@ set -e
 for domain in $RENEWED_DOMAINS; do
   case $domain in
   kosmos.org|kosmos.chat|5apps.com)
-    cp "${RENEWED_LINEAGE}/privkey.pem" /opt/ejabberd/conf/$domain.key
+    cp "/etc/letsencrypt/live/${domain}/privkey.pem" /opt/ejabberd/conf/$domain.key
-    cp "${RENEWED_LINEAGE}/fullchain.pem" /opt/ejabberd/conf/$domain.crt
+    cp "/etc/letsencrypt/live/${domain}/fullchain.pem" /opt/ejabberd/conf/$domain.crt
     chown ejabberd:ejabberd /opt/ejabberd/conf/$domain.*
     chmod 600 /opt/ejabberd/conf/$domain.*
     /opt/ejabberd-#{node["ejabberd"]["version"]}/bin/ejabberdctl reload_config
@@ -38,12 +38,13 @@ gandi_api_credentials = data_bag_item('credentials', 'gandi_api')
 template "/root/gandi_dns_certbot_hook.sh" do
   variables access_token: gandi_api_credentials["access_token"]
   mode 0700
+  sensitive true
 end
 
 # Generate a Let's Encrypt cert (only if no cert has been generated before).
 # The systemd timer will take care of renewing
 execute "letsencrypt cert for kosmos.org domains" do
-  command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup letsencrypt.kosmos.org\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d uploads.xmpp.kosmos.org -n"
+  command "certbot certonly --manual --preferred-challenges dns --agree-tos --manual-auth-hook \"/root/gandi_dns_certbot_hook.sh auth\" --manual-cleanup-hook \"/root/gandi_dns_certbot_hook.sh cleanup\" --deploy-hook \"/etc/letsencrypt/renewal-hooks/post/ejabberd\" --email ops@kosmos.org -d kosmos.org -d xmpp.kosmos.org -d chat.kosmos.org -d upload.kosmos.org -d proxy.kosmos.org -d pubsub.kosmos.org -d uploads.xmpp.kosmos.org -n"
   not_if do
     File.exist?("/etc/letsencrypt/live/kosmos.org/fullchain.pem")
   end

site-cookbooks/kosmos-ejabberd/templates/ejabberd.yml.erb

@@ -1,10 +1,8 @@
-loglevel: 4
-
 log_rotate_size: 10485760
-log_rotate_date: ""
 log_rotate_count: 1
 
-log_rate_limit: 100
+loglevel: info
+hide_sensitive_log_data: true
 
 hosts:
 <% @hosts.each do |host| -%>
@@ -95,6 +93,8 @@ auth_method: sql
 
 default_db: sql
 
+update_sql_schema: true
+
 shaper:
   normal:
     rate: 3000
@@ -185,8 +185,11 @@ api_permissions:
     what:
       - "add_rosteritem"
       - "delete_rosteritem"
-      - "send_message"
+      - "get_vcard2"
+      - "muc_register_nick"
       - "private_set"
+      - "send_message"
+      - "send_stanza"
 
 language: "en"
 
@@ -231,7 +234,6 @@ modules:
   mod_shared_roster: {}
   mod_stun_disco:
     offer_local_services: false
-    credentials_lifetime: 300
     secret: <%= @stun_secret %>
     services:
       -

site-cookbooks/kosmos-mastodon/recipes/default.rb

@@ -265,6 +265,44 @@ service "mastodon-streaming" do
   action [:enable, :start]
 end
 
+#
+# Delete cached remote media older than 30 days
+# Will be re-fetched if necessary
+#
+
+systemd_unit 'mastodon-delete-old-media-cache.service' do
+  content({
+    Unit: {
+      Description: 'Delete old Mastodon media cache'
+    },
+    Service: {
+      Type: "oneshot",
+      WorkingDirectory: mastodon_path,
+      Environment: "RAILS_ENV=#{rails_env}",
+      ExecStart: "#{bundle_path} exec bin/tootctl media remove --days 30",
+    }
+  })
+  triggers_reload true
+  action [:create]
+end
+
+systemd_unit 'mastodon-delete-old-media-cache.timer' do
+  content({
+    Unit: {
+      Description: 'Delete old Mastodon media cache'
+    },
+    Timer: {
+      OnCalendar: '*-*-* 00:00:00',
+      Persistent: 'true'
+    },
+    Install: {
+      WantedBy: 'timer.target'
+    }
+  })
+  triggers_reload true
+  action [:create, :enable, :start]
+end
+
 firewall_rule "mastodon_app" do
   port     node['kosmos-mastodon']['app_port']
   source   "10.1.1.0/24"

site-cookbooks/kosmos-mastodon/recipes/nginx.rb

@@ -12,6 +12,13 @@ search(:node, "role:mastodon").each do |node|
 end
 if upstream_hosts.any?
   web_root_dir = "/var/www/#{server_name}/public"
+  directory web_root_dir do
+    action :create
+    recursive true
+    owner 'www-data'
+    group 'www-data'
+    mode 0755
+  end
 else
   web_root_dir = "#{app_dir}/public"
   upstream_hosts << "localhost"

site-cookbooks/kosmos-nginx/recipes/default.rb

@@ -59,7 +59,7 @@ cookbook_file "#{node["nginx"]["user_home"]}/maintenance.html" do
   source "maintenance.html"
   owner node['nginx']['user']
   group node['nginx']['group']
-  mode "0640"
+  mode "0755"
 end
 
 unless node.chef_environment == "development"

site-cookbooks/kosmos-postfix/recipes/default.rb

@@ -3,20 +3,23 @@
 # Recipe:: default
 #
 
-node.default['postfix']['main']['smtp_tls_CAfile']  = '/etc/ssl/certs/ca-certificates.crt'
+node.default["postfix"]["main"]["smtp_tls_CAfile"]  = "/etc/ssl/certs/ca-certificates.crt"
-node.default['postfix']['main']['smtpd_tls_CAfile'] = '/etc/ssl/certs/ca-certificates.crt'
+node.default["postfix"]["main"]["smtpd_tls_CAfile"] = "/etc/ssl/certs/ca-certificates.crt"
 
 return if node.run_list.roles.include?("email_server")
 
-smtp_credentials = Chef::EncryptedDataBagItem.load('credentials', 'smtp')
+smtp_credentials = Chef::EncryptedDataBagItem.load("credentials", "smtp")
 
-node.default['postfix']['sasl']['smtp_sasl_user_name']        = smtp_credentials['user_name']
+node.default["postfix"]["sasl"] = {
-node.default['postfix']['sasl']['smtp_sasl_passwd']           = smtp_credentials['password']
+  smtp_credentials["relayhost"] => {
-node.default['postfix']['sasl_password_file']                 = "#{node['postfix']['conf_dir']}/sasl_passwd"
+    "username" => smtp_credentials["user_name"],
-# Postfix doesn't support smtps relayhost, use STARTSSL instead
+    "password" => smtp_credentials["password"]
-node.default['postfix']['main']['relayhost']                  = smtp_credentials['relayhost']
+  }
-node.default['postfix']['main']['smtp_sasl_auth_enable']      = 'yes'
+}
-node.default['postfix']['main']['smtp_sasl_password_maps']    = "hash:#{node['postfix']['sasl_password_file']}"
-node.default['postfix']['main']['smtp_sasl_security_options'] = 'noanonymous'
 
-include_recipe 'postfix::default'
+# Postfix doesn"t support smtps relayhost, use STARTSSL instead
+node.default["postfix"]["main"]["relayhost"]                  = smtp_credentials["relayhost"]
+node.default["postfix"]["main"]["smtp_sasl_auth_enable"]      = "yes"
+node.default["postfix"]["main"]["smtp_sasl_security_options"] = "noanonymous"
+
+include_recipe "postfix::default"

site-cookbooks/kosmos_akaunting/.gitignore

@@ -1,25 +0,0 @@
-.vagrant
-*~
-*#
-.#*
-\#*#
-.*.sw[a-z]
-*.un~
-
-# Bundler
-Gemfile.lock
-gems.locked
-bin/*
-.bundle/*
-
-# test kitchen
-.kitchen/
-kitchen.local.yml
-
-# Chef Infra
-Berksfile.lock
-.zero-knife.rb
-Policyfile.lock.json
-
-.idea/
-

site-cookbooks/kosmos_akaunting/Policyfile.rb

@@ -1,16 +0,0 @@
-# Policyfile.rb - Describe how you want Chef Infra Client to build your system.
-#
-# For more information on the Policyfile feature, visit
-# https://docs.chef.io/policyfile/
-
-# A name that describes what the system you're building with Chef does.
-name 'kosmos_akaunting'
-
-# Where to find external cookbooks:
-default_source :supermarket
-
-# run_list: chef-client will run these recipes in the order specified.
-run_list 'kosmos_akaunting::default'
-
-# Specify a custom source for a single cookbook:
-cookbook 'kosmos_akaunting', path: '.'

site-cookbooks/kosmos_akaunting/README.md

@@ -1,4 +0,0 @@
-# kosmos_akaunting
-
-TODO: Enter the cookbook description here.
-

site-cookbooks/kosmos_akaunting/attributes/default.rb

@@ -1,5 +0,0 @@
-node.default["akaunting"]["user"] = "deploy"
-node.default["akaunting"]["group"] = "www-data"
-node.default["akaunting"]["repo"] = "https://github.com/akaunting/akaunting.git"
-node.default["akaunting"]["revision"] = "3.1.12"
-node.default["akaunting"]["port"] = 80

site-cookbooks/kosmos_akaunting/chefignore

@@ -1,115 +0,0 @@
-# Put files/directories that should be ignored in this file when uploading
-# to a Chef Infra Server or Supermarket.
-# Lines that start with '# ' are comments.
-
-# OS generated files #
-######################
-.DS_Store
-ehthumbs.db
-Icon?
-nohup.out
-Thumbs.db
-.envrc
-
-# EDITORS #
-###########
-.#*
-.project
-.settings
-*_flymake
-*_flymake.*
-*.bak
-*.sw[a-z]
-*.tmproj
-*~
-\#*
-REVISION
-TAGS*
-tmtags
-.vscode
-.editorconfig
-
-## COMPILED ##
-##############
-*.class
-*.com
-*.dll
-*.exe
-*.o
-*.pyc
-*.so
-*/rdoc/
-a.out
-mkmf.log
-
-# Testing #
-###########
-.circleci/*
-.codeclimate.yml
-.delivery/*
-.foodcritic
-.kitchen*
-.mdlrc
-.overcommit.yml
-.rspec
-.rubocop.yml
-.travis.yml
-.watchr
-.yamllint
-azure-pipelines.yml
-Dangerfile
-examples/*
-features/*
-Guardfile
-kitchen.yml*
-mlc_config.json
-Procfile
-Rakefile
-spec/*
-test/*
-
-# SCM #
-#######
-.git
-.gitattributes
-.gitconfig
-.github/*
-.gitignore
-.gitkeep
-.gitmodules
-.svn
-*/.bzr/*
-*/.git
-*/.hg/*
-*/.svn/*
-
-# Berkshelf #
-#############
-Berksfile
-Berksfile.lock
-cookbooks/*
-tmp
-
-# Bundler #
-###########
-vendor/*
-Gemfile
-Gemfile.lock
-
-# Policyfile #
-##############
-Policyfile.rb
-Policyfile.lock.json
-
-# Documentation #
-#############
-CODE_OF_CONDUCT*
-CONTRIBUTING*
-documentation/*
-TESTING*
-UPGRADING*
-
-# Vagrant #
-###########
-.vagrant
-Vagrantfile

site-cookbooks/kosmos_akaunting/kitchen.yml

@@ -1,31 +0,0 @@
----
-driver:
-  name: vagrant
-
-## The forwarded_port port feature lets you connect to ports on the VM guest
-## via localhost on the host.
-## see also: https://www.vagrantup.com/docs/networking/forwarded_ports
-
-#  network:
-#    - ["forwarded_port", {guest: 80, host: 8080}]
-
-provisioner:
-  name: chef_zero
-
-  ## product_name and product_version specifies a specific Chef product and version to install.
-  ## see the Chef documentation for more details: https://docs.chef.io/workstation/config_yml_kitchen/
-  #  product_name: chef
-  #  product_version: 17
-
-verifier:
-  name: inspec
-
-platforms:
-  - name: ubuntu-20.04
-  - name: centos-8
-
-suites:
-  - name: default
-    verifier:
-      inspec_tests:
-        - test/integration/default

site-cookbooks/kosmos_akaunting/metadata.rb

@@ -1,9 +0,0 @@
-name 'kosmos_akaunting'
-maintainer 'Kosmos Developers'
-maintainer_email 'mail@kosmos.org'
-license 'MIT'
-description 'Installs/configures akaunting for Kosmos'
-version '0.1.0'
-chef_version '>= 18.0'
-
-depends 'kosmos-nodejs'

site-cookbooks/kosmos_akaunting/recipes/default.rb

@@ -1,148 +0,0 @@
-#
-# Cookbook:: kosmos_akaunting
-# Recipe:: default
-#
-
-app_name     = "akaunting"
-deploy_user  = node["akaunting"]["user"]
-deploy_group = node["akaunting"]["group"]
-deploy_path  = "/opt/#{app_name}"
-credentials  = data_bag_item("credentials", "akaunting")
-pg_host      = search(:node, "role:postgresql_primary").first["knife_zero"]["host"] rescue "localhost"
-
-env = {
-  app_name: "Akaunting",
-  app_env: "production",
-  app_locale: "en-US",
-  app_installed: "true",
-  app_key: credentials["app_key"],
-  app_debug: "true",
-  app_schedule_time: "\"09:00\"",
-  app_url: "http://akaunting.kosmos.org",
-  db_connection: "pgsql",
-  db_host: pg_host,
-  db_port: "5432",
-  db_database: credentials["pg_database"],
-  db_username: credentials["pg_username"],
-  db_password: credentials["pg_password"],
-  log_level: "debug"
-  # mail_mailer: "mail",
-  # mail_host: "localhost",
-  # mail_port: "2525",
-  # mail_username: "null",
-  # mail_password: "null",
-  # mail_encryption: "null",
-  # mail_from_name: "null",
-  # mail_from_address: "null",
-}
-
-%w[
-  unzip nginx php8.1 php8.1-cli php8.1-bcmath php8.1-ctype php8.1-curl
-  php8.1-dom php8.1-fileinfo php8.1-intl php8.1-fpm php8.1-gd php8.1-mbstring
-  php8.1-pdo php8.1-pgsql php8.1-tokenizer php8.1-xml php8.1-zip
-].each do |pkg|
-  package pkg
-end
-
-# TODO install composer
-
-node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_18.x"
-include_recipe "kosmos-nodejs"
-
-group deploy_group
-
-user deploy_user do
-  group       deploy_group
-  manage_home true
-  shell       "/bin/bash"
-end
-
-directory deploy_path do
-  owner deploy_user
-  group deploy_group
-  mode "0775"
-end
-
-git deploy_path do
-  repository node[app_name]["repo"]
-  revision node[app_name]["revision"]
-  user deploy_user
-  group deploy_group
-  action :sync
-  notifies :run, "execute[composer_install]", :immediately
-  notifies :run, "execute[npm_install]", :immediately
-  notifies :restart, "service[php8.1-fpm]", :delayed
-end
-
-execute "composer_install" do
-  user deploy_user
-  cwd deploy_path
-  command "composer install"
-  action :nothing
-end
-
-execute "npm_install" do
-  user deploy_user
-  cwd deploy_path
-  command "npm install"
-  action :nothing
-  notifies :run, "execute[compile_assets]", :immediately
-end
-
-execute "compile_assets" do
-  user deploy_user
-  cwd deploy_path
-  command "npm run prod"
-  action :nothing
-end
-
-execute "set_storage_permissions" do
-  command "chown -R www-data:www-data #{deploy_path}/storage"
-end
-
-template "#{deploy_path}/.env" do
-  source 'env.erb'
-  owner deploy_user
-  group deploy_group
-  mode 0660
-  sensitive true
-  variables config: env
-  notifies :restart, "service[php8.1-fpm]", :delayed
-end
-
-template "/etc/nginx/sites-available/default" do
-  source 'nginx-local.conf.erb'
-  owner deploy_user
-  group deploy_group
-  mode 0660
-  variables deploy_path: deploy_path,
-            port: node["akaunting"]["port"]
-  notifies :restart, "service[nginx]", :delayed
-end
-
-# template "/etc/php/8.1/fpm/pool.d/akaunting.conf" do
-#   source 'php-fpm.pool.erb'
-#   owner deploy_user
-#   group deploy_group
-#   mode 0600
-#   variables user: deploy_user,
-#             group: deploy_group,
-#             chdir: deploy_path,
-#             port: node["akaunting"]["port"]
-#   notifies :restart, "service[php8.1-fpm]", :delayed
-# end
-
-service "php8.1-fpm" do
-  action [:enable, :start]
-end
-
-service "nginx" do
-  action [:enable, :start]
-end
-
-firewall_rule "akaunting_zerotier" do
-  command  :allow
-  port     node["akaunting"]["port"]
-  protocol :tcp
-  source   "10.1.1.0/24"
-end

site-cookbooks/kosmos_akaunting/recipes/pg_db.rb

@@ -1,16 +0,0 @@
-#
-# Cookbook:: kosmos_akaunting
-# Recipe:: pg_db
-#
-
-credentials = data_bag_item("credentials", "akaunting")
-
-postgresql_user credentials["pg_username"] do
-  action :create
-  password credentials["pg_password"]
-end
-
-postgresql_database credentials["pg_database"] do
-  owner credentials["pg_username"]
-  action :create
-end

site-cookbooks/kosmos_akaunting/templates/env.erb

@@ -1,11 +0,0 @@
-<% @config.each do |key, value| %>
-<% if value.is_a?(Hash) %>
-<% value.each do |k, v| %>
-<%= "#{key.upcase}_#{k.upcase}" %>=<%= v.to_s %>
-<% end %>
-<% else %>
-<% if value %>
-<%= key.upcase %>=<%= value.to_s %>
-<% end %>
-<% end %>
-<% end %>

site-cookbooks/kosmos_akaunting/templates/nginx-local.conf.erb

@@ -1,49 +0,0 @@
-server {
-  listen 80 default_server;
-
-  server_name akaunting.kosmos.org;
-
-  root <%= @deploy_path %>;
-
-  add_header X-Frame-Options "SAMEORIGIN";
-  add_header X-XSS-Protection "1; mode=block";
-  add_header X-Content-Type-Options "nosniff";
-
-  index index.html index.htm index.php;
-
-  charset utf-8;
-
-  location / {
-    try_files $uri $uri/ /index.php?$query_string;
-  }
-
-  # Prevent Direct Access To Protected Files
-  location ~ \.(env|log) {
-    deny all;
-  }
-
-  # Prevent Direct Access To Protected Folders
-  location ~ ^/(^app$|bootstrap|config|database|overrides|resources|routes|storage|tests|artisan) {
-    deny all;
-  }
-
-  # Prevent Direct Access To modules/vendor Folders Except Assets
-  location ~ ^/(modules|vendor)\/(.*)\.((?!ico|gif|jpg|jpeg|png|js\b|css|less|sass|font|woff|woff2|eot|ttf|svg|xls|xlsx).)*$ {
-    deny all;
-  }
-
-  error_page 404 /index.php;
-
-  # Pass PHP Scripts To FastCGI Server
-  location ~ \.php$ {
-    fastcgi_split_path_info ^(.+\.php)(/.+)$;
-    fastcgi_pass unix:/var/run/php/php8.1-fpm.sock; # Depends On The PHP Version
-    fastcgi_index index.php;
-    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-    include fastcgi_params;
-  }
-
-  location ~ /\.(?!well-known).* {
-    deny all;
-  }
-}

site-cookbooks/kosmos_akaunting/templates/php-fpm.pool.erb

@@ -1,18 +0,0 @@
-[akaunting]
-user = <%= @user %>
-group = <%= @group %>
-listen = 0.0.0.0:<%= @port %>
-listen.owner = <%= @user %>
-listen.group = <%= @group %>
-listen.mode = 0660
-
-pm = dynamic
-pm.max_children = 10
-pm.start_servers = 4
-pm.min_spare_servers = 2
-pm.max_spare_servers = 6
-pm.max_requests = 500
-
-chdir = <%= @chdir %>
-catch_workers_output = yes
-php_admin_flag[log_errors] = on

site-cookbooks/kosmos_akaunting/test/integration/default/default_test.rb

@@ -1,16 +0,0 @@
-# Chef InSpec test for recipe kosmos_akaunting::default
-
-# The Chef InSpec reference, with examples and extensive documentation, can be
-# found at https://docs.chef.io/inspec/resources/
-
-unless os.windows?
-  # This is an example test, replace with your own test.
-  describe user('root'), :skip do
-    it { should exist }
-  end
-end
-
-# This is an example test, replace it with your own test.
-describe port(80), :skip do
-  it { should_not be_listening }
-end

site-cookbooks/kosmos_drone/recipes/default.rb

@@ -26,7 +26,7 @@ template "#{deploy_path}/docker-compose.yml" do
   mode 0640
   variables domain: node["kosmos_drone"]["domain"],
             upstream_port: node["kosmos_drone"]["upstream_port"],
-            gitea_server: "https://#{node["kosmos_gitea"]["nginx"]["domain"]}",
+            gitea_server: "https://#{node["gitea"]["domain"]}",
             client_id: credentials['client_id'],
             client_secret: credentials['client_secret'],
             rpc_secret: credentials['rpc_secret'],

site-cookbooks/kosmos_gitea/attributes/default.rb

@@ -1,13 +1,21 @@
-node.default["gitea"]["version"] = "1.22.5"
+node.default["gitea"]["version"] = "1.23.8"
-node.default["gitea"]["checksum"] = "ce2c7e4fff3c1e3ed59f5b5e00e3f2d301f012c34e329fccd564bc5129075460"
+node.default["gitea"]["checksum"] = "827037e7ca940866918abc62a7488736923396c467fcb4acd0dd9829bb6a6f4c"
+node.default["gitea"]["repo"] = nil
+node.default["gitea"]["revision"] = nil
 node.default["gitea"]["working_directory"] = "/var/lib/gitea"
 node.default["gitea"]["port"] = 3000
 node.default["gitea"]["postgresql_host"] = "localhost:5432"
 node.default["gitea"]["domain"] = "gitea.kosmos.org"
 
 node.default["gitea"]["config"] = {
+  "log": {
+    "level" => "Info",
+    "logger.router.MODE" => "",
+    "logger.xorm.MODE" => "",
+    "logger.access.MODE" => ""
+  },
   "actions": {
-    "enabled": true
+    "enabled" => true
   },
   "webhook":  {
     "allowed_host_list" => "external,127.0.1.1"

site-cookbooks/kosmos_gitea/metadata.rb

@@ -10,5 +10,8 @@ chef_version '>= 14.0'
 depends "firewall"
 depends "kosmos_openresty"
 depends "kosmos_postgresql"
-depends "backup"
 depends "kosmos-dirsrv"
+depends 'kosmos-nodejs'
+depends 'git'
+depends 'golang'
+depends "backup"

site-cookbooks/kosmos_gitea/recipes/compile_from_source.rb

@@ -0,0 +1,42 @@
+#
+# Cookbook:: kosmos_gitea
+# Recipe:: compile_from_source
+#
+# Compiles/installs Gitea from source
+#
+
+include_recipe "git"
+
+node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_20.x"
+include_recipe 'kosmos-nodejs'
+
+node.override["golang"]["version"] = "1.23.9"
+include_recipe "golang"
+
+link "/usr/local/bin/go" do
+  to "/usr/local/go/bin/go"
+end
+
+source_dir = "/opt/gitea"
+
+git source_dir do
+  repository node["gitea"]["repo"]
+  revision node["gitea"]["revision"]
+  action :sync
+  notifies :run, "execute[npm_install]", :immediately
+end
+
+execute "npm_install" do
+  cwd source_dir
+  command "npm ci"
+  action :nothing
+  notifies :run, "bash[compile_gitea]", :immediately
+end
+
+bash "compile_gitea" do
+  cwd source_dir
+  environment "TAGS" => "bindata"
+  code "make build"
+  action :nothing
+  notifies :restart, "service[gitea]", :delayed
+end

site-cookbooks/kosmos_gitea/recipes/default.rb

@@ -5,11 +5,12 @@
 
 version                   = node["gitea"]["version"]
 download_url              = "https://dl.gitea.io/gitea/#{version}/gitea-#{version}-linux-amd64"
+compile_from_source       = node["gitea"]["repo"] && node["gitea"]["revision"]
 working_directory         = node["gitea"]["working_directory"]
 git_home_directory        = "/home/git"
 repository_root_directory = "#{git_home_directory}/gitea-repositories"
 config_directory          = "/etc/gitea"
-gitea_binary_path         = "/usr/local/bin/gitea"
+gitea_binary_path         = compile_from_source ? "/opt/gitea/gitea" : "/usr/local/bin/gitea"
 gitea_data_bag_item       = data_bag_item("credentials", "gitea")
 smtp_credentials          = data_bag_item("credentials", "smtp")
 smtp_addr                 = smtp_credentials["relayhost"].split(":")[0]
@@ -18,7 +19,6 @@ jwt_secret                = gitea_data_bag_item["jwt_secret"]
 internal_token            = gitea_data_bag_item["internal_token"]
 secret_key                = gitea_data_bag_item["secret_key"]
 
-# Dependency
 package "git"
 
 user "git" do
@@ -108,11 +108,15 @@ template "#{config_directory}/app.ini" do
   notifies :restart, "service[gitea]", :delayed
 end
 
-remote_file gitea_binary_path do
+if compile_from_source
-  source download_url
+  include_recipe "kosmos_gitea::compile_from_source"
-  checksum node['gitea']['checksum']
+else
-  mode "0755"
+  remote_file gitea_binary_path do
-  notifies :restart, "service[gitea]", :delayed
+    source download_url
+    checksum node['gitea']['checksum']
+    mode "0755"
+    notifies :restart, "service[gitea]", :delayed
+  end
 end
 
 execute "systemctl daemon-reload" do

site-cookbooks/kosmos_gitea/templates/default/app.ini.erb

@@ -24,9 +24,11 @@ NAME    = gitea
 USER    = gitea
 PASSWD  = <%= @postgresql_password %>
 SSL_MODE = disable
+MAX_OPEN_CONNS = 20
 
 [repository]
 ROOT = <%= @repository_root_directory %>
+DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true
 
 # [indexer]
 # ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
@@ -72,8 +74,11 @@ ENABLE_OPENID_SIGNIN = false
 ENABLE_OPENID_SIGNUP = false
 
 [log]
-MODE      = console
+MODE = console
-LEVEL     = Debug
+LEVEL = <%= @config["log"]["level"] %>
+logger.router.MODE = <%= @config["log"]["logger.router.MODE"] %>
+logger.xorm.MODE = <%= @config["log"]["logger.xorm.MODE"] %>
+logger.access.MODE = <%= @config["log"]["logger.access.MODE"] %>
 
 [attachment]
 ENABLED = true

site-cookbooks/kosmos_gitea/templates/default/nginx_conf_web.erb

@@ -16,7 +16,7 @@ server {
 
   add_header Strict-Transport-Security "max-age=31536000";
 
-  client_max_body_size 20M;
+  client_max_body_size 121M;
 
   location ~ ^/(avatars|repo-avatars)/.*$ {
     proxy_buffers 1024 8k;

site-cookbooks/kosmos_rsk/attributes/default.rb

@@ -1,4 +1,4 @@
-node.default['rskj']['version'] = '5.3.0~jammy'
+node.default['rskj']['version'] = '7.0.0~jammy'
 node.default['rskj']['network'] = 'testnet'
 
 node.default['rskj']['nginx']['domain'] = nil

site-cookbooks/kosmos_rsk/recipes/rskj.rb

@@ -19,6 +19,8 @@ apt_repository 'rskj' do
   key '5EED9995C84A49BC02D4F507DF10691F518C7BEA'
 end
 
+apt_package 'openjdk-17-jdk'
+
 apt_package 'rskj' do
   response_file 'rskj-preseed.cfg.erb'
   response_file_variables network: node['rskj']['network']

site-cookbooks/kosmos_rsk/test/integration/rskj/rskj_test.rb

@@ -9,7 +9,7 @@ end
 
 describe package('rskj') do
   it { should be_installed }
-  its('version') { should eq '5.3.0~jammy' }
+  its('version') { should eq '7.0.0~jammy' }
 end
 
 describe service('rsk') do

site-cookbooks/kosmos_strfry/attributes/default.rb

@@ -1,2 +1,10 @@
 node.default["strfry"]["ldap_search_dn"] = "ou=kosmos.org,cn=users,dc=kosmos,dc=org"
 node.default["strfry"]["extras_dir"] = "/opt/strfry"
+
+# node.default["substr"]["repo"] = "https://gitea.kosmos.org/kosmos/substr.git"
+# node.default["substr"]["revision"] = "master"
+node.default["substr"]["version"] = "nightly"
+node.default["substr"]["download_url"] = "https://gitea.kosmos.org/api/packages/kosmos/generic/substr/#{node["substr"]["version"]}/substr_x86_64-unknown-linux-gnu"
+node.default["substr"]["workdir"] = "/opt/substr"
+node.default["substr"]["port"] = 30023
+node.default["substr"]["relay_urls"] = ["ws://localhost:7777"]

site-cookbooks/kosmos_strfry/recipes/policies.rb

@@ -24,7 +24,7 @@ env = {
   ldap_bind_dn: ldap_credentials["service_dn"],
   ldap_password: ldap_credentials["service_password"],
   ldap_search_dn: node["strfry"]["ldap_search_dn"],
-  whitelist_pubkeys: node["strfry"]["whitelist_pubkeys"].join(",")
+  whitelist_pubkeys: node["strfry"]["known_pubkeys"].values.join(",")
 }
 
 template "#{extras_dir}/.env" do

site-cookbooks/kosmos_strfry/recipes/substr.rb

@@ -0,0 +1,100 @@
+#
+# Cookbook:: kosmos_strfry
+# Recipe:: substr
+#
+
+unless platform?("ubuntu")
+  raise "This recipe only supports Ubuntu installs at the moment"
+end
+
+apt_package "imagemagick"
+
+directory node["substr"]["workdir"] do
+  owner node["strfry"]["user"]
+  group node["strfry"]["group"]
+  mode "0755"
+end
+
+if node["substr"]["download_url"]
+  remote_file '/usr/local/bin/substr' do
+    source node["substr"]["download_url"]
+    checksum node["substr"]["checksum"]
+    mode '0755'
+    show_progress true
+    notifies :restart, "service[substr]", :delayed
+  end
+
+  exec_start = "/usr/local/bin/substr"
+else
+  # TODO Install Deno 2
+
+  git node["substr"]["workdir"] do
+    user node["strfry"]["user"]
+    group node["strfry"]["group"]
+    repository node['substr']['repo']
+    revision node['substr']['revision']
+    action :sync
+    notifies :restart, "service[substr]", :delayed
+  end
+
+  exec_start = "deno task server"
+end
+
+file "#{node["substr"]["workdir"]}/users.yaml" do
+  mode "0644"
+  owner node["strfry"]["user"]
+  group node["strfry"]["group"]
+  content node["strfry"]["known_pubkeys"].to_yaml
+  notifies :restart, "service[substr]", :delayed
+end
+
+ldap_credentials = Chef::EncryptedDataBagItem.load('credentials', 'dirsrv')
+
+env = {
+  port: node['substr']['port'],
+  base_url: "https://#{node["strfry"]["domain"]}",
+  relay_urls: node['substr']['relay_urls'].join(","),
+  ldap_url: 'ldap://ldap.kosmos.local:389', # requires "ldap_client" role
+  ldap_bind_dn: ldap_credentials["service_dn"],
+  ldap_password: ldap_credentials["service_password"],
+  ldap_search_dn: node["strfry"]["ldap_search_dn"],
+}
+
+template "#{node["substr"]["workdir"]}/.env" do
+  source 'env.erb'
+  owner node["strfry"]["user"]
+  group node["strfry"]["group"]
+  mode 0600
+  sensitive true
+  variables config: env
+  notifies :restart, "service[substr]", :delayed
+end
+
+systemd_unit "substr.service" do
+  content({
+    Unit: {
+      Description: "substr for nostr",
+      Documentation: ["https://gitea.kosmos.org/kosmos/substr"],
+    },
+    Service: {
+      Type: "simple",
+      User: node["strfry"]["user"],
+      WorkingDirectory: node["substr"]["workdir"],
+      ExecStart: exec_start,
+      Restart: "on-failure",
+      RestartSec: "5",
+      ProtectHome: "no",
+      NoNewPrivileges: "yes",
+      ProtectSystem: "full"
+    },
+    Install: {
+      WantedBy: "multi-user.target"
+    }
+  })
+  triggers_reload true
+  action :create
+end
+
+service "substr" do
+  action [:enable, :start]
+end

site-cookbooks/kosmos_strfry/templates/nginx_conf_strfry.erb

@@ -4,6 +4,12 @@ upstream _strfry {
 <% end %>
 }
 
+upstream _substr {
+<% @upstream_hosts.each do |host| %>
+  server <%= host %>:30023;
+<% end %>
+}
+
 server {
   server_name <%= @domain %>;
   listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
@@ -15,6 +21,16 @@ server {
   ssl_certificate     <%= @ssl_cert %>;
   ssl_certificate_key <%= @ssl_key %>;
 
+  location = /favicon.ico {
+    alias /var/www/assets.kosmos.org/site/img/favicon.ico;
+  }
+
+  location ~* ^/[@~n]|^/assets {
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_pass http://_substr;
+  }
+
   location / {
     proxy_set_header Host $host;
     proxy_set_header X-Real-IP $remote_addr;

site-cookbooks/kosmos_website/templates/nginx_conf_website.erb

@@ -29,11 +29,15 @@ server {
   ssl_certificate     <%= @ssl_cert %>;
   ssl_certificate_key <%= @ssl_key %>;
 
+  location /.well-known/host-meta.json {
+    add_header 'Access-Control-Allow-Origin' '*';
+  }
+
 <% if @accounts_url %>
   location ~ ^/.well-known/(keysend|lnurlp|nostr|openpgpkey|webfinger) {
     proxy_ssl_server_name on;
     proxy_set_header X-Forwarded-Host $host;
-    proxy_pass https://accounts.kosmos.org;
+    proxy_pass <%= @accounts_url %>;
   }
 <% end %>
 }