Support letsencrypt proxy validation via CNAMEs

Allows to point other domains' `_acme-challenge.example.com` entries at `example.com.letsencrypt.kosmos.chat` so we can validate from our side without access to the other domain's DNS records. Used for 5apps.com XMPP for now. Can be used for others later.
2024-03-11 16:15:12 +01:00
230 changed files with 989 additions and 3645 deletions
--- a/.gitmodules
+++ b/.gitmodules
@@ -4,12 +4,3 @@
 [submodule "site-cookbooks/openresty"]
 	path = site-cookbooks/openresty
 	url = https://github.com/67P/chef-openresty.git
 [submodule "site-cookbooks/strfry"]
 	path = site-cookbooks/strfry
 	url = git@gitea.kosmos.org:kosmos/strfry-cookbook.git
 [submodule "site-cookbooks/deno"]
 	path = site-cookbooks/deno
 	url = git@gitea.kosmos.org:kosmos/deno-cookbook.git
 [submodule "site-cookbooks/blossom"]
 	path = site-cookbooks/blossom
 	url = git@gitea.kosmos.org:kosmos/blossom-cookbook.git
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -1,41 +0,0 @@
 # AGENTS.md
 Welcome, AI Agent! This file contains essential context and rules for interacting with the Kosmos Chef repository. Read this carefully before planning or executing any changes.
 ## 🏢 Project Overview
 This repository contains the infrastructure automation code used by Kosmos to provision and configure bare metal servers (KVM hosts) and Ubuntu virtual machines (KVM guests). 
 We use **Chef Infra**, managed locally via **Knife Zero** (agentless Chef), and **Berkshelf** for dependency management.
 ## 📂 Directory Structure & Rules
 * **`site-cookbooks/`**: 🟢 **EDITABLE.** This directory contains all custom, internal cookbooks written specifically for Kosmos services (e.g., `kosmos-postgresql`, `kosmos_gitea`, `kosmos-mastodon`). *Active development happens here.*
 * **`cookbooks/`**: 🔴 **DO NOT EDIT.** This directory contains third-party/community cookbooks that are vendored. These are managed by Berkshelf. Modifying them directly will result in lost changes.
 * **`roles/`**: 🟢 **EDITABLE.** Contains Chef roles written in Ruby (e.g., `base.rb`, `kvm_guest.rb`, `postgresql_primary.rb`). These define run-lists and role-specific default attributes for servers.
 * **`environments/`**: Contains Chef environment definitions (like `production.rb`).
 * **`data_bags/`**: Contains data bag configurations, often encrypted. Be cautious and do not expose secrets. (Note: Agents should not manage data bag secrets directly unless provided the `.chef/encrypted_data_bag_secret`).
 * **`nodes/`**: Contains JSON state files for bootstrapped nodes. *Agents typically do not edit these directly unless cleaning up a deleted node.*
 * **`Berksfile`**: Defines community cookbook dependencies.
 * **`Vagrantfile` / `.kitchen/`**: Used for local virtualization and integration testing.
 ## 🛠️ Tooling & Workflows
 1. **Dependency Management (Berkshelf)**
   If a new community cookbook is required:
   - Add it to the `Berksfile` at the root.
   - Instruct the user to run `berks install` and `berks vendor cookbooks/ --delete` (or run it via the `bash` tool if permitted).
 2. **Provisioning (Knife Zero)**
   - Bootstrapping and converging nodes is done using `knife zero`. 
   - *Example:* `knife zero converge name:server-name.kosmos.org`
 3. **Code Style & Conventions**
   - Chef recipes, resources, and roles are written in **Ruby**. 
   - Follow standard Chef and Ruby (RuboCop) idioms. Look at neighboring files in `site-cookbooks/` or `roles/` to match formatting and naming conventions.
 ## 🚨 Core Directives for AI Agents
 1. **Infrastructure as Code**: Manual server configurations are highly discouraged. All changes must be codified in a cookbook or role.
 2. **Test Safety Nets**: Look for `.kitchen.yml` within specific `site-cookbooks/<name>` to understand if local integration tests are available.
 3. **No Assumptions**: Do not assume standard test commands. Check `README.md` and repository config files first.
 4. **Secret Handling**: Avoid hardcoding passwords or API keys in recipes or roles. Assume sensitive information is managed via Chef `data_bags`.
--- a/5
+++ b/5
@@ -13,9 +13,6 @@ cookbook 'ipfs',
 cookbook 'mediawiki',
  git: 'https://github.com/67P/mediawiki-cookbook.git',
  ref: 'nginx'
 cookbook 'postfix',
  git: 'https://gitea.kosmos.org/kosmos/postfix-cookbook.git',
  ref: 'bugfix/sasl_attributes'
 cookbook 'apache2',                '= 3.3.0'
 cookbook 'apt',                    '~> 7.3.0'
@@ -24,7 +21,6 @@ cookbook 'composer',               '~> 2.7.0'
 cookbook 'fail2ban',               '~> 7.0.4'
 cookbook 'git',                    '~> 10.0.0'
 cookbook 'golang',                 '~> 5.3.1'
 cookbook 'homebrew',               '>= 6.0.0'
 cookbook 'hostname',               '= 0.4.2'
 cookbook 'hostsfile',              '~> 3.0.1'
 cookbook 'java',                   '~> 4.3.0'
@@ -36,6 +32,7 @@ cookbook 'ntp',                    '= 3.4.0'
 cookbook 'ohai',                   '~> 5.2.5'
 cookbook 'openssl',                '~> 8.5.5'
 cookbook 'php',                    '~> 8.0.0'
 cookbook 'postfix',                '~> 6.0.26'
 cookbook 'timezone_iii',           '= 1.0.4'
 cookbook 'ulimit',                 '~> 1.0.0'
 cookbook 'users',                  '~> 5.3.1'
--- a/Berksfile.lock
+++ b/Berksfile.lock
@@ -8,7 +8,6 @@ DEPENDENCIES
  firewall (~> 6.2.16)
  git (~> 10.0.0)
  golang (~> 5.3.1)
  homebrew (>= 6.0.0)
  hostname (= 0.4.2)
  hostsfile (~> 3.0.1)
  ipfs
@@ -29,10 +28,7 @@ DEPENDENCIES
  ohai (~> 5.2.5)
  openssl (~> 8.5.5)
  php (~> 8.0.0)
-  postfix
+  postfix (~> 6.0.26)
    git: https://gitea.kosmos.org/kosmos/postfix-cookbook.git
    revision: dd6598572a775ae73f17527260ec8097b52d385b
    ref: bugfix/
  redisio (~> 6.4.1)
  ruby_build (~> 2.5.0)
  timezone_iii (= 1.0.4)
@@ -63,7 +59,7 @@ GRAPH
  git (10.0.0)
  golang (5.3.1)
    ark (>= 6.0)
-  homebrew (6.0.2)
+  homebrew (5.4.1)
  hostname (0.4.2)
    hostsfile (>= 0.0.0)
  hostsfile (3.0.1)
@@ -94,7 +90,7 @@ GRAPH
  openssl (8.5.5)
  php (8.0.1)
    yum-epel (>= 0.0.0)
-  postfix (6.4.1)
+  postfix (6.0.26)
  redisio (6.4.1)
    selinux (>= 0.0.0)
  ruby_build (2.5.0)
--- a/README.md
+++ b/README.md
@@ -38,10 +38,6 @@ Clone this repository, `cd` into it, and run:
    knife zero bootstrap ubuntu@zerotier-ip-address -x ubuntu --sudo --run-list "role[base],role[kvm_guest]" --secret-file .chef/encrypted_data_bag_secret
 ### Bootstrap a new VM with environment and role/app (postgres replica as example)
    knife zero bootstrap ubuntu@10.1.1.134 -x ubuntu --sudo --environment production --run-list "role[base],role[kvm_guest],role[postgresql_replica]" --secret-file .chef/encrypted_data_bag_secret
 ### Run Chef Zero on a host server
    knife zero converge -p2222 name:server-name.kosmos.org
--- a/clients/garage-10.json
+++ b/clients/garage-10.json
@@ -1,4 +0,0 @@
 {
  "name": "garage-10",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw2+3Wo+KkXVJCOX1SxT9\nSdwKXgPbCDM3EI9uwoxhMxQfRyN53dxIsBDsQUVOIe1Z8yqm4FenMQlNmeDR+QLE\nvNFf1fisinW+D9VVRm+CjcJy96i/Dyt786Z6YRrDlB860HxCbfTL2Zv5BRtbyIKg\nhz5gO+9PMEpPVR2ij9iue4K6jbM1AAL2ia/P6zDWLJqeIzUocCeHV5N0Z3jXH6qr\nf444v78x35MMJ+3tg5h95SU1/PDCpdSTct4uHEuKIosiN7p4DlYMoM5iSyvVoujr\nflRQPEpGzS9qEt3rDo/F4ltzYMx6bf1tB/0QaBKD+zwPZWTTwf61tSBo5/NkGvJc\nFQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/garage-11.json
+++ b/clients/garage-11.json
@@ -1,4 +0,0 @@
 {
  "name": "garage-11",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzfZcNEQojtmaogd9vGP/\nMsVPhAOlQ4kxKgrUas+p+XT7lXRan6b3M8UZEleIaL1HWsjSVwtFWRnNl8kg8rF8\nNEkLeOX8kHf7IoXDFOQa2TXanY8tSqrfh9/heFunt4Q3DluVt7S3bBdwukbDXm/n\nXJS2EQP33eJT4reL6FpVR0oVlFCzI3Vmf7ieSHIBXrbXy7AIvGC2+NVXvQle6pqp\nx0rqU6Wc6ef/VtIv+vK3YFnt9ue3tC63mexyeNKgRYf1YjDx61wo2bOY2t8rqN8y\nHeZ3dmAN8/Vwjk5VGnZqK7kRQ92G4IcE+mEp7MuwXcLqQ9WB960o+evay+o1R5JS\nhwIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/garage-12.json
+++ b/clients/garage-12.json
@@ -1,4 +0,0 @@
 {
  "name": "garage-12",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9GtHHi298BjiIqpZ3WkT\nkYAPfWD60hFe/8icYcq/F/6cHLYKZQ4chek9X/hDCMq4tHEN6Oh58T5x/nuNdPrK\nIAMGyVAGk6ekWlmD4jwdEf6TGb/J3ffJTRDvwX/I8xD/DW3wtXsN+X24T59ByGTm\nrnwRmmmwHF3otRx9wnCsIgDQ0AjiUujsfNNv1FcLXD/WJLys9lEeU5aJ4XtHTwDv\ntJM8YyVEFhEnuvgdKmzn5+F5k9VGdUwForlFOBfvzbCnTZMDMmDVeiUtAUv/7xWQ\nQl2mLUGCtgWuYJYXsQacAJ6pa3h+7cQyshC6w3dwUG+1fS9lNO0Yp1GGX1AGYKpp\nPQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/garage-13.json
+++ b/clients/garage-13.json
@@ -1,4 +0,0 @@
 {
  "name": "garage-13",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvbqWc6OwRxgHfsQuTNL4\naxeVvNen5d9srYpZSHjuBB/k9NHB+9P6vU5qF37XHkw1lVUGeYbPHzhYsx3O0/kZ\nH5f4+4SMy/P9jc6SE7AJF4qtYKgJ88koZdqCww07c6K9g+BnEGFFZui/h3hUBxWj\nTfhBHEWPyQ2bl/lr9sIJwsEz+EN0isGn/eIXkmw9J6LdLJ5Q0LLks33K28FNOU7q\nfeAN4MiBVMUtgCGyT2Voe6WrOXwQLSDXQONOp3sfSfFExsIJ1s24xdd7AMD7/9a7\n4sFDZ4swhqAWgWmW2giR7Kb8wTvGQLO/O/uUbmKz3DZXgkOKXHdHCEB/PZx1mRNM\nEwIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/garage-14.json
+++ b/clients/garage-14.json
@@ -1,4 +0,0 @@
 {
  "name": "garage-14",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAypINv1zTZ7+pyT0iRhik\n0W70ASYADo7qK7QyE9/3nu2sUrP1IjoNFsv/ceKwicH7Fw2Ei1o+yKZlKn7zJzY7\n93YRZndF04VH2bmqy0uOWK0Bdat7gCld5bvS6FmRflg7g64LFb33/64QIVsVGHGL\nYF2TO//x79t9JKcQDa4h5MOWzJNTFuEcUGa0gJjMYpWGVHEJSgRuIgyhXmyIJJgY\nguj6ymTm5+3VS7NzoNy2fbTt1LRpHb5UWrCR15oiLZiDSMLMx0CcGOCmrhvODi4k\n0umw+2NPd1G50s9z7KVbTqybuQ65se2amRnkVcNfaBIU5qk9bVqcmhZlEozmBZCd\ndwIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/garage-15.json
+++ b/clients/garage-15.json
@@ -1,4 +0,0 @@
 {
  "name": "garage-15",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAy14sTt5gxVZi9C3KIEBu\nDyUgbb6jc3/GR22fNPTqV6uDHhxzhE2UsYwY/7yuA1RasdwHEOBWZaoC0Om5/Zmi\n8gn6//v1ILyLNaAcw+SQcxZkCN8Sk/0atRS9HYk1agE8Mvh72Fe2z3l+92VMefy7\nJwJUNNBTbnV2WVCchChoWnfhI7bkSLSHp0M2MO2pI+lkpSdmfkJSa5z9zihgxKO8\nXfvhryDCZNvfRVHhwc+ffpap0gLF0H9riGKE4FwLy4YqbuW1Tgm6bObb9bpOIw6Q\nVfH3kC/KMK5FlnxGmYtDkhRJ/wjGInRBk9WK/QOmjyd2FVxipEQmA4RdjlznRC9I\nrwIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/garage-4.json
+++ b/clients/garage-4.json
@@ -0,0 +1,4 @@
 {
  "name": "garage-4",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA8it7QtT6zDiJJqlyHKfQ\nLqwu6bLblD15WWxlUSiOdhz3njWDv1BIDCAdkCR3HAXgxvk8sMj9QkvWS7u1+bc4\nxvHrY4Tgfg+Tk1h3gGa7ukll8s1WLIbGjj89vrK8PFr4iuDqRytYRMmcdMsNzPkS\nKcsOjFYWGV7KM/OwoQGVIOUPB+WtkrFAvNkXtIU6Wd5orzFMjt/9DPF2aO7QegL8\nG1mQmXcPGl9NSDUXptn/kzFKm/p4n7pjy6OypFT192ak7OA/s+CvQlaVE2tb/M3c\ne4J6A+PInV5AGKY6BxI3QRQLZIlqE0FXawFKr1iRU4JP4tVnICXZqy+SDXQU1zar\nTQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/garage-5.json
+++ b/clients/garage-5.json
@@ -0,0 +1,4 @@
 {
  "name": "garage-5",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnJxLFOBbml94W/GAe7nm\ntZs1Ziy8IbqXySsm8bSwWhRMQ8UuseqQLG30R3Q5X5AoJbtNfd26l63qLtP2fFtL\n5km9dV+2FoIJWFetl8Wzr7CaLYAiNzTQSFHlV7+6DKmPMDcJ63GKrFR77vkSGOG6\nOWL1bJy5BOaClp/sKL/0WQ0+mRbTP6RCQ2eI+46clAg702SenBU6Nz9HDm+teKN7\nYlP1CvzXgfgfpDOsat7wGn5+oKcmKavZxcdn8bt5jRpg8v3JezaZIjMXt7XcNS4n\n0F4XO/efnZE5B5SN68j4BpD8N79zJw4HlRIGP+RaYv2qLtBeWgLHCCs9wXQXfj6b\nLwIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/garage-6.json
+++ b/clients/garage-6.json
@@ -0,0 +1,4 @@
 {
  "name": "garage-6",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwasYgWLM8ShvirFiKRE6\nGWqc3pMlvcrk4YnWAUW5Y/H26EnyexxWNfnwlEcq8thJ3M3hs7zkoF3Yk4uqX869\n4/niYqXwYgeE1K3gzLp4K1+w3yVupYAFVFStVEHJyuMlLJ+ulDEGvNdQDuIfw7+E\nr6DcDLa1o92Eo0wL1ihYyMilduH0LdFTixL+tEBXbbPWBa3RDJJCFsRF1+UC6hAH\nzmaWL661Gdzdabxjm/FlGUYkdbDqeInZq/1GMQqv+9/DcNRkWA9H7i4Ykrfpx4/2\nRZ8xtx/DbnJVB1zYoORygFMMAkTu5E+R8ropeI7Wi77Yq0S7laiRlYQYQml3x9ak\nzQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/garage-9.json
+++ b/clients/garage-9.json
@@ -1,4 +0,0 @@
 {
  "name": "garage-9",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnMHzKE8JBrsQkmRDeMjX\n71mBzvRzNM90cwA8xtvIkXesdTyGqohX9k/PJbCY5ySGK9PpMaYDPVAnwnUP8LFQ\n3G98aSbLxUjqU/PBzRsnWpihehr05uz9zYcNFzr4LTNvGQZsq47nN9Tk+LG3zHP7\nAZViv2mJ4ZRnukXf6KHlyoVvhuTu+tiBM8QzjTF97iP/aguNPzYHmrecy9Uf5bSA\nZrbNZT+ayxtgswC2OclhRucx7XLSuHXtpwFqsQzSAhiX1aQ3wwCyH9WJtVwpfUsE\nlxTjcQiSM9aPZ8iSC0shpBaKD1j3iF/2K2Jk+88++zMhJJPLermvaJxzsdePgvyk\nKQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/leo.json
+++ b/clients/leo.json
@@ -1,4 +0,0 @@
 {
  "name": "leo",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnFfQsJnREjbXTtpT6BVt\naBaUzRmCQi8Du0TzeUG0ENrY0p5Exqleye2rC6bJlB3PER1xr5zdtuXLgbcVumIb\nzroU5JPtFbQk7r/pj0atT+UEYzl16iuEpprQ/bug+f0nE514USr6YG4G+tlZ/jBI\nSHsCQF1P8ufXFLW0ewC7rdvBkgA+DwK14naRxS4jO5MSl4wmNTjs/jymTg508mQq\nf5tG52t8qFdgn9pRdBXmyTpPtwK7I4rZ+1Qn+1E5m4oQUZsxh8Ba1bGbKotVO7Ua\nYL1yCGx7zRRUvLLIdSMvlRXTJBUSQtQ8P4QUDWTY1Na2w3t9sulKg2Lwsw8tktvC\nCwIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/postgres-10.json
+++ b/clients/postgres-10.json
@@ -1,4 +0,0 @@
 {
  "name": "postgres-10",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2oBb5omC7ZionWhudgFm\n2NGcRXsI0c7+g1+0duaxj5dziaRTltqzpRJTfiJD6R36FcvEqwGc+qQgYSMzc1Xd\nY4OTvJFIDiFAmROm/DZYgFtTDldVNJZO2bbU3COYf/Z2Poq56gC4zLLd/zf6shgb\n2Mty8PlQ82JJAY9EMI3aAifdnZ1k/g4weFC4LFg9lUcNNXOwlAjp//LJ3ku3aY1r\nwW74msSeWEjE44YZdWyMYgM7Fy1hz5giHFQtRdOLemRCWQ8h26wn/cmWld7lsLg+\nlYqxokxWXGv8r5zR8kDTBkd0dxY7ZMbo7oESY4Uhuf4UReMe2ZGHto1E7w3llSj+\n7wIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/postgres-11.json
+++ b/clients/postgres-11.json
@@ -1,4 +0,0 @@
 {
  "name": "postgres-11",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1foYpuubS2ovlg3uHO12\nQ/ROZ8MpG+LkCAM46uVfPaoWwfY0vdfMsBOanHDgm9DGUCEBJZ6LPrvCvGXbpPy6\n9GSswK75zVWODblNjvvV4ueGFq4bBFwRuZNjyMlqgyzeU+srZL0ivelu5XEuGuoD\nPYCBKWYqGMz85/eMC7/tinTJtKPyOtXe/G8meji+r7gh3j+ypj/EWeKfcRDa4aGe\n/DmMCurIjjPAXFLMAA6fIqPWVfcPw4APNPE60Z92yPGsTbPu7bL54M5f7udmmu7H\nOgk1HjMAmXCuLDzTkfaxqHP+57yELg/YpXR1E93VmBeQuIBsyOFEk6AmUmA1Ib6e\nnQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/postgres-12.json
+++ b/clients/postgres-12.json
@@ -1,4 +0,0 @@
 {
  "name": "postgres-12",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1mYGrYB8keUKmXA8dhWc\ncCLzp50xR0ajSw+bWYydyRqD5wuEVKjiJu4+G9QmTVXkVgJ+AYI0Y9/WZYpDqVH6\nvLUo6BSNQaWx20q93qIdOGLy8YG3Qyznezk4l8T9u9vWZDyDpKw6gCxzikMkrXxb\n0cqOYtyud8+PtSEEMogSjOKhRURVHlVrlVH3SQO7Whke9rkiFcbXzubsK9yjkUtF\nxZafSoGorOlDsPvFTfYnkepVB+GHcgiribRYSrO+73GypC2kqMhCpWrb6a0VWsP/\nh53+q3JL3vBvdvjcv51Wpf4n6JdnXnQGn2/MdXEzw+NXgjU4/IdYtbORSbaI8F5t\nowIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/postgres-5.json
+++ b/clients/postgres-5.json
@@ -0,0 +1,4 @@
 {
  "name": "postgres-5",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvXZv6Gk+dhIVkTXH9hJ1\nt2oqsMSLmTUj71uPN+4j0rxCQriXa095Nle9ifJAxfwzQyKEpWKyZd1Hpyye6bL1\nwgWATZ/u5ZS4B63NhRFyDxgPlHWBBohaZBN42zeq0Y0PNGHPVGDH/zFDrpP22Q9Q\nYScsyXTauE/Yf8a/rKR5jdnoVsVVMxk0LHxka8FcM2cqVsDAcK7GqIG6epqNFY8P\nUb1P+mVxRwnkzvf1VtG212ezV/yw9uiQcUkHS+JwZMAgbC34k9iDyRmk6l4sj/Zk\nNem20ImMqdDzsrX8zEe21K+KNvpejPH9fxaNCwR8W+woBMMzqD3I7P9PbLjc70Rx\nRwIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/postgres-8.json
+++ b/clients/postgres-8.json
@@ -1,4 +0,0 @@
 {
  "name": "postgres-8",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx88DgM/x1UbKRzgPexXE\nSyfrAsqaDVjqZz7yF3tqAc9A52Ol0KOM6NESoPWBVMbS86WtAjBcMHcOoQBJ+ovp\nXcjNlRtO1Il6/d4uCRr4CEDX+yeS0Qrt0SOORnoTbVlkq9VlVljyCmxk8VBCILzk\ndHvFr62mahMy6vOEcpCQgCwYE3ISH2jlTDz2agoK/CjIyyqFTlB1N7mJVGLrJdcA\nA2JOxDRE8HqOdpY7bHcHj4uyMWaKuM3zxXK04lhrvuPRfJUhXgsK9r5jeTEa8407\nqV9K+mB17R1dBeHmWEPDRt02HELe2SUjYmlmyVX73H2mWKDLBFpAFjOfz86CJ6jf\nDQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/postgres-9.json
+++ b/clients/postgres-9.json
@@ -1,4 +0,0 @@
 {
  "name": "postgres-9",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA2dcE9HH0r5TBb/FGj2+e\nOw8ssoxeB61JmR4/psdZ6oPR08gxyqOY0ODziCmyIdXwFhjIcC44HjxCbcB8TU8G\nWGqlmfqWWIJW0x/2xOycHobAWDn5fC5ttTXkR3HC1TutX/2mH26mtfz9UjNdPaTo\nVZFMcxeaBCFSNlYC7hPUQ5f/qBdhhpLxP9uyzU+YFPqtwLP7g8EAUQObM4L+m6Q8\nqE7xgYpnhgaNrPsmvaVuoNylMGwyK0j1whOkcik8UgLprD70ISNSNxxcLehbvA3G\nPQPQRRuFF36fu2gECWGopbrFKwQGNfgJguQoXM1RQZQMQqWHPS933k5i6bi5pnhp\nzwIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/rsk-testnet-6.json
+++ b/clients/rsk-testnet-6.json
@@ -1,4 +0,0 @@
 {
  "name": "rsk-testnet-6",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAl1p4+F536/peA4XWMJtm\njggPl6yJb42V5bg3kDa8SHoIoQgXn59d3BclZ1Oz2+JhFd3Rrn4FN3Z1wzGpP+gA\nnxQOfgRG1ucahh7Nxaw3IdoHm7r/EdEOc9FrxvGJ+09YnmLfzn4iVQpsUiOiNVS7\n0LXtMXYtsjD+o6BTbOhGU8FMmGhMhQfXFVgoDdTiM/Q62zPw8Vtpa3yFpFJAu+dA\n+mm5h5W6FnaWJXM2arn3PxDOt+JQSWp5PYG4goU1FFreU9iFuoeGEfLy8unlbbXt\ne96QhNuCkOA15xqta0Z3oL7IlXWns7dLgZYlpZT9zaExIs3AEDaQcleacQPzXKSG\nswIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/clients/strfry-1.json
+++ b/clients/strfry-1.json
@@ -1,4 +0,0 @@
 {
  "name": "strfry-1",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzDV/RMGMXVDbvoA6PNh8\nQzhtHwYDCFcUSkbrwP6tzh6GpVunGEOdOdhj2V63T2tF1H+lujxQXh5pK7C0D6VZ\niO04ftJlo7/svyxUcwWr+znyN5sFdQRh3cBZiGSBYolizwoqgtPFlbNhmWAzV0Du\n9t8mhz70IK3B+UdwWyHtoK0NNsJGnQ9YzAvcjyDmEO/3sCjAhNnxVpmXftpcSmd9\nMonzFtIDBbRRll4AHZYRbmXCzx63+VmelvdnufnbY82liol0zzBwJaBD1wyNlG0y\ni96p3Kx03bLNlIaYVGbjZeJi+6oo2VDWJ4OloLLAYoHDSipeHT9qWfUdnE6ge4Lm\nywIDAQAB\n-----END PUBLIC KEY-----\n"
 }
--- a/cookbooks/homebrew/.markdownlint-cli2.yaml
+++ b/cookbooks/homebrew/.markdownlint-cli2.yaml
@@ -3,5 +3,3 @@ config:
  line-length: false # MD013
  no-duplicate-heading: false # MD024
  reference-links-images: false # MD052
 ignores:
  - .github/copilot-instructions.md
--- a/cookbooks/homebrew/CHANGELOG.md
+++ b/cookbooks/homebrew/CHANGELOG.md
@@ -2,48 +2,6 @@
 This file is used to list changes made in each version of the homebrew cookbook.
 ## 6.0.2 - *2025-09-04*
 Standardise files with files in sous-chefs/repo-management
 Standardise files with files in sous-chefs/repo-management
 ## 6.0.1 - *2025-03-24*
 ## 6.0.0 - *2025-03-17*
 - Updated library call for new homebrew class name found in chef-client 18.6.2+ releases
 ## 5.4.9 - *2024-11-18*
 Standardise files with files in sous-chefs/repo-management
 Standardise files with files in sous-chefs/repo-management
 Standardise files with files in sous-chefs/repo-management
 Standardise files with files in sous-chefs/repo-management
 Standardise files with files in sous-chefs/repo-management
 ## 5.4.8 - *2024-05-07*
 ## 5.4.7 - *2024-05-06*
 - Explicitly include `Which` module from `Chef` which fixes runs on 18.x clients.
 ## 5.4.6 - *2024-05-06*
 ## 5.4.5 - *2023-11-01*
 Standardise files with files in sous-chefs/repo-management
 ## 5.4.4 - *2023-09-28*
 ## 5.4.3 - *2023-09-04*
 ## 5.4.2 - *2023-07-10*
 ## 5.4.1 - *2023-06-01*
 ## 5.4.0 - *2023-04-24*
--- a/cookbooks/homebrew/libraries/helpers.rb
+++ b/cookbooks/homebrew/libraries/helpers.rb
@@ -20,9 +20,8 @@
 #
 class HomebrewUserWrapper
-  require 'chef/mixin/homebrew'
+  require 'chef/mixin/homebrew_user'
-  include Chef::Mixin::Homebrew
+  include Chef::Mixin::HomebrewUser
  include Chef::Mixin::Which
 end
 module Homebrew
@@ -60,17 +59,41 @@ module Homebrew
  def owner
    @owner ||= begin
-                 HomebrewUserWrapper.new.find_homebrew_username
+      # once we only support 14.0 we can switch this to find_homebrew_username
-               rescue
+      require 'etc'
-                 Chef::Exceptions::CannotDetermineHomebrewPath
+      ::Etc.getpwuid(HomebrewUserWrapper.new.find_homebrew_uid).name
-               end.tap do |owner|
+               rescue Chef::Exceptions::CannotDetermineHomebrewOwner
-                 Chef::Log.debug("Homebrew owner is #{owner}")
+                 calculate_owner
-               end
+    end.tap do |owner|
      Chef::Log.debug("Homebrew owner is #{owner}")
    end
  end
  private
  def calculate_owner
    owner = homebrew_owner_attr || sudo_user || current_user
    if owner == 'root'
      raise Chef::Exceptions::User,
           "Homebrew owner is 'root' which is not supported. " \
           "To set an explicit owner, please set node['homebrew']['owner']."
    end
    owner
  end
  def homebrew_owner_attr
    Chef.node['homebrew']['owner']
  end
  def sudo_user
    ENV['SUDO_USER']
  end
  def current_user
    ENV['USER']
  end
 end unless defined?(Homebrew)
 class HomebrewWrapper
  include Homebrew
 end
 Chef::Mixin::Homebrew.include(Homebrew)
--- a/cookbooks/homebrew/metadata.json
+++ b/cookbooks/homebrew/metadata.json
@@ -17,13 +17,13 @@
  "recipes": {
  },
-  "version": "6.0.2",
+  "version": "5.4.1",
  "source_url": "https://github.com/sous-chefs/homebrew",
  "issues_url": "https://github.com/sous-chefs/homebrew/issues",
  "privacy": false,
  "chef_versions": [
    [
-      ">= 18.6.2"
+      ">= 15.3"
    ]
  ],
  "ohai_versions": [
--- a/cookbooks/homebrew/metadata.rb
+++ b/cookbooks/homebrew/metadata.rb
@@ -3,9 +3,9 @@ maintainer       'Sous Chefs'
 maintainer_email 'help@sous-chefs.org'
 license          'Apache-2.0'
 description      'Install Homebrew and includes resources for working with taps and casks'
-version          '6.0.2'
+version          '5.4.1'
 supports         'mac_os_x'
 source_url 'https://github.com/sous-chefs/homebrew'
 issues_url 'https://github.com/sous-chefs/homebrew/issues'
-chef_version '>= 18.6.2'
+chef_version '>= 15.3'
--- a/cookbooks/homebrew/renovate.json
+++ b/cookbooks/homebrew/renovate.json
@@ -1,10 +1,9 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:base"],
-  "packageRules": [
+  "packageRules": [{
    {
      "groupName": "Actions",
-      "matchUpdateTypes": ["minor", "patch", "pin"],
+      "matchUpdateTypes": ["patch", "pin", "digest"],
      "automerge": true,
      "addLabels": ["Release: Patch", "Skip: Announcements"]
    },
--- a/cookbooks/homebrew/resources/cask.rb
+++ b/cookbooks/homebrew/resources/cask.rb
@@ -19,7 +19,6 @@
 # limitations under the License.
 #
 unified_mode true
 chef_version_for_provides '< 14.0' if respond_to?(:chef_version_for_provides)
 property :cask_name, String, regex: %r{^[\w/-]+$}, name_property: true
--- a/cookbooks/homebrew/resources/tap.rb
+++ b/cookbooks/homebrew/resources/tap.rb
@@ -19,7 +19,6 @@
 # limitations under the License.
 #
 unified_mode true
 chef_version_for_provides '< 14.0' if respond_to?(:chef_version_for_provides)
 property :tap_name, String, name_property: true, regex: %r{^[\w-]+(?:\/[\w-]+)+$}
--- a/cookbooks/postfix/.markdownlint-cli2.yaml
+++ b/cookbooks/postfix/.markdownlint-cli2.yaml
@@ -3,5 +3,3 @@ config:
  line-length: false # MD013
  no-duplicate-heading: false # MD024
  reference-links-images: false # MD052
 ignores:
  - .github/copilot-instructions.md
--- a/cookbooks/postfix/.vscode/extensions.json
+++ b/cookbooks/postfix/.vscode/extensions.json
@@ -1,8 +0,0 @@
 {
  "recommendations": [
    "chef-software.chef",
    "Shopify.ruby-lsp",
    "editorconfig.editorconfig",
    "DavidAnson.vscode-markdownlint"
  ]
 }
--- a/cookbooks/postfix/CHANGELOG.md
+++ b/cookbooks/postfix/CHANGELOG.md
@@ -2,48 +2,9 @@
 This file is used to list changes made in each version of the postfix cookbook.
 ## Unreleased
 ## 6.4.1 - *2025-09-04*
 ## 6.4.0 - *2025-07-30* ## 6.4.0 - *2025-07-30*
 Standardise files with files in sous-chefs/repo-management
 ## 6.4.0 - *2025-07-30*
 ## 6.3.0 - *2025-07-30*
 - Use LMDB instead of hash on el10
 ## 6.3.0 - *2025-07-30*
 ## 6.2.2 - *2025-01-30*
 ## 6.2.1 - *2025-01-30*
 ## 6.2.0 - *2025-01-30*
 ## 6.2.0
 - Correctly fix aliases quoting logic
 - Convert all serverspec tests to inspec
 - Add Github actions
 - Update platforms to test
 ## 6.0.29 - *2024-11-18*
 - Standardise files with files in sous-chefs/repo-management
 ## 6.0.28 - *2024-07-15*
 - Standardise files with files in sous-chefs/repo-management
 ## 6.0.27 - *2024-05-06*
 ## 6.0.26 - *2023-10-03*
- Add installation of postfix addon packages for RHEL 8
+- add installation of postfix addon packages for RHEL 8
 ## 6.0.25 - *2023-10-03*
--- a/cookbooks/postfix/attributes/default.rb
+++ b/cookbooks/postfix/attributes/default.rb
@@ -13,10 +13,9 @@
 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 # See the License for the specific language governing permissions and
 # limitations under the License.
-default['postfix']['packages'] = value_for_platform(
+
-  amazon: { '>= 2023' => %w(postfix postfix-lmdb) },
+default['postfix']['packages'] = %w(postfix)
-  default: %w(postfix)
+
 )
 # Generic cookbook attributes
 default['postfix']['mail_type'] = 'client'
 default['postfix']['relayhost_role'] = 'relayhost'
@@ -38,19 +37,11 @@ default['postfix']['master_template_source'] = 'postfix'
 default['postfix']['sender_canonical_map_entries'] = {}
 default['postfix']['smtp_generic_map_entries'] = {}
 default['postfix']['recipient_canonical_map_entries'] = {}
-
+default['postfix']['access_db_type'] = 'hash'
-default['postfix']['db_type'] = value_for_platform(
+default['postfix']['aliases_db_type'] = 'hash'
-  %w(centos redhat almalinux rocky oracle) => { '>= 10' => 'lmdb' },
+default['postfix']['transport_db_type'] = 'hash'
-  amazon: { '>= 2023' => 'lmdb' },
+default['postfix']['virtual_alias_db_type'] = 'hash'
-  %w(opensuseleap suse) => { '>= 15' => 'lmdb' },
+default['postfix']['virtual_alias_domains_db_type'] = 'hash'
  default: 'hash'
 )
 default['postfix']['access_db_type'] = lazy { node['postfix']['db_type'] }
 default['postfix']['aliases_db_type'] = lazy { node['postfix']['db_type'] }
 default['postfix']['transport_db_type'] = lazy { node['postfix']['db_type'] }
 default['postfix']['virtual_alias_db_type'] = lazy { node['postfix']['db_type'] }
 default['postfix']['virtual_alias_domains_db_type'] = lazy { node['postfix']['db_type'] }
 case node['platform']
 when 'smartos'
@@ -105,9 +96,6 @@ default['postfix']['main']['smtp_sasl_auth_enable'] = 'no'
 default['postfix']['main']['mailbox_size_limit'] = 0
 default['postfix']['main']['mynetworks'] = nil
 default['postfix']['main']['inet_interfaces'] = 'loopback-only'
 default['postfix']['main']['default_database_type'] = lazy { node['postfix']['db_type'] }
 default['postfix']['main']['alias_database'] = lazy { "#{node['postfix']['db_type']}:#{node['postfix']['aliases_db']}" }
 default['postfix']['main']['alias_maps'] = lazy { "#{node['postfix']['db_type']}:#{node['postfix']['aliases_db']}" }
 # Conditional attributes, also reference _attributes recipe
 case node['platform_family']
@@ -419,4 +407,4 @@ default['postfix']['aliases'] = if platform?('freebsd')
                                  {}
                                end
-default['postfix']['main']['smtpd_relay_restrictions'] = lazy { "#{node['postfix']['db_type']}:#{node['postfix']['relay_restrictions_db']}, reject" if node['postfix']['use_relay_restrictions_maps'] }
+default['postfix']['main']['smtpd_relay_restrictions'] = "hash:#{node['postfix']['relay_restrictions_db']}, reject" if node['postfix']['use_relay_restrictions_maps']
--- a/cookbooks/postfix/metadata.json
+++ b/cookbooks/postfix/metadata.json
@@ -26,7 +26,7 @@
  "recipes": {
  },
-  "version": "6.4.1",
+  "version": "6.0.26",
  "source_url": "https://github.com/sous-chefs/postfix",
  "issues_url": "https://github.com/sous-chefs/postfix/issues",
  "privacy": false,
--- a/cookbooks/postfix/metadata.rb
+++ b/cookbooks/postfix/metadata.rb
@@ -3,7 +3,7 @@ maintainer        'Sous Chefs'
 maintainer_email  'help@sous-chefs.org'
 license           'Apache-2.0'
 description       'Installs and configures postfix for client or outbound relayhost, or to do SASL auth'
-version           '6.4.1'
+version           '6.0.26'
 source_url        'https://github.com/sous-chefs/postfix'
 issues_url        'https://github.com/sous-chefs/postfix/issues'
 chef_version      '>= 12.15'
--- a/cookbooks/postfix/recipes/_attributes.rb
+++ b/cookbooks/postfix/recipes/_attributes.rb
@@ -29,22 +29,24 @@ end
 if node['postfix']['main']['smtp_sasl_auth_enable'] == 'yes'
  node.default_unless['postfix']['sasl_password_file'] = "#{node['postfix']['conf_dir']}/sasl_passwd"
-  node.default_unless['postfix']['main']['smtp_sasl_password_maps'] = "#{node['postfix']['db_type']}:#{node['postfix']['sasl_password_file']}"
+  node.default_unless['postfix']['main']['smtp_sasl_password_maps'] = "hash:#{node['postfix']['sasl_password_file']}"
  node.default_unless['postfix']['main']['smtp_sasl_security_options'] = 'noanonymous'
  node.default_unless['postfix']['sasl']['smtp_sasl_user_name'] = ''
  node.default_unless['postfix']['sasl']['smtp_sasl_passwd']    = ''
  node.default_unless['postfix']['main']['relayhost'] = ''
 end
-node.default_unless['postfix']['main']['alias_maps'] = ["#{node['postfix']['db_type']}:#{node['postfix']['aliases_db']}"] if node['postfix']['use_alias_maps']
+node.default_unless['postfix']['main']['alias_maps'] = ["hash:#{node['postfix']['aliases_db']}"] if node['postfix']['use_alias_maps']
-node.default_unless['postfix']['main']['transport_maps'] = ["#{node['postfix']['db_type']}:#{node['postfix']['transport_db']}"] if node['postfix']['use_transport_maps']
+node.default_unless['postfix']['main']['transport_maps'] = ["hash:#{node['postfix']['transport_db']}"] if node['postfix']['use_transport_maps']
-node.default_unless['postfix']['main']['access_maps'] = ["#{node['postfix']['db_type']}:#{node['postfix']['access_db']}"] if node['postfix']['use_access_maps']
+node.default_unless['postfix']['main']['access_maps'] = ["hash:#{node['postfix']['access_db']}"] if node['postfix']['use_access_maps']
 node.default_unless['postfix']['main']['virtual_alias_maps'] = ["#{node['postfix']['virtual_alias_db_type']}:#{node['postfix']['virtual_alias_db']}"] if node['postfix']['use_virtual_aliases']
 node.default_unless['postfix']['main']['virtual_alias_domains'] = ["#{node['postfix']['virtual_alias_domains_db_type']}:#{node['postfix']['virtual_alias_domains_db']}"] if node['postfix']['use_virtual_aliases_domains']
-node.default_unless['postfix']['main']['smtpd_relay_restrictions'] = "#{node['postfix']['db_type']}:#{node['postfix']['relay_restrictions_db']}, reject" if node['postfix']['use_relay_restrictions_maps']
+node.default_unless['postfix']['main']['smtpd_relay_restrictions'] = "hash:#{node['postfix']['relay_restrictions_db']}, reject" if node['postfix']['use_relay_restrictions_maps']
 node.default_unless['postfix']['main']['maildrop_destination_recipient_limit'] = 1 if node['postfix']['master']['maildrop']['active']
--- a/cookbooks/postfix/recipes/_common.rb
+++ b/cookbooks/postfix/recipes/_common.rb
@@ -155,7 +155,7 @@ unless node['postfix']['sender_canonical_map_entries'].empty?
    notifies :reload, 'service[postfix]'
  end
-  node.default['postfix']['main']['sender_canonical_maps'] = "#{node['postfix']['db_type']}:#{node['postfix']['conf_dir']}/sender_canonical" unless node['postfix']['main'].key?('sender_canonical_maps')
+  node.default['postfix']['main']['sender_canonical_maps'] = "hash:#{node['postfix']['conf_dir']}/sender_canonical" unless node['postfix']['main'].key?('sender_canonical_maps')
 end
 execute 'update-postfix-smtp_generic' do
@@ -172,7 +172,7 @@ unless node['postfix']['smtp_generic_map_entries'].empty?
    notifies :reload, 'service[postfix]'
  end
-  node.default['postfix']['main']['smtp_generic_maps'] = "#{node['postfix']['db_type']}:#{node['postfix']['conf_dir']}/smtp_generic" unless node['postfix']['main'].key?('smtp_generic_maps')
+  node.default['postfix']['main']['smtp_generic_maps'] = "hash:#{node['postfix']['conf_dir']}/smtp_generic" unless node['postfix']['main'].key?('smtp_generic_maps')
 end
 execute 'update-postfix-recipient_canonical' do
@@ -189,7 +189,7 @@ unless node['postfix']['recipient_canonical_map_entries'].empty?
    notifies :reload, 'service[postfix]'
  end
-  node.default['postfix']['main']['recipient_canonical_maps'] = "#{node['postfix']['db_type']}:#{node['postfix']['conf_dir']}/recipient_canonical" unless node['postfix']['main'].key?('recipient_canonical_maps')
+  node.default['postfix']['main']['recipient_canonical_maps'] = "hash:#{node['postfix']['conf_dir']}/recipient_canonical" unless node['postfix']['main'].key?('recipient_canonical_maps')
 end
 service 'postfix' do
--- a/cookbooks/postfix/recipes/maps.rb
+++ b/cookbooks/postfix/recipes/maps.rb
@@ -18,8 +18,8 @@ node['postfix']['maps'].each do |type, maps|
    package "postfix-#{type}" if %w(pgsql mysql ldap cdb).include?(type)
  end
-  if platform_family?('rhel') && node['platform_version'].to_i >= 8
+  if platform?('redhat') && node['platform_version'].to_i == 8
-    package "postfix-#{type}" if %w(pgsql mysql ldap cdb lmdb).include?(type)
+    package "postfix-#{type}" if %w(pgsql mysql ldap cdb).include?(type)
  end
  separator = if %w(pgsql mysql ldap memcache sqlite).include?(type)
@@ -32,7 +32,7 @@ node['postfix']['maps'].each do |type, maps|
      command "postmap #{file}"
      environment PATH: "#{ENV['PATH']}:/opt/omni/bin:/opt/omni/sbin" if platform_family?('omnios')
      action :nothing
-    end if %w(btree cdb dbm hash lmdb sdbm).include?(type)
+    end if %w(btree cdb dbm hash sdbm).include?(type)
    template "#{file}-#{type}" do
      path file
      source 'maps.erb'
@@ -41,7 +41,7 @@ node['postfix']['maps'].each do |type, maps|
        map: content,
        separator: separator
      )
-      notifies :run, "execute[update-postmap-#{file}]" if %w(btree cdb dbm hash lmdb sdbm).include?(type)
+      notifies :run, "execute[update-postmap-#{file}]" if %w(btree cdb dbm hash sdbm).include?(type)
      notifies :restart, 'service[postfix]'
    end
  end
--- a/cookbooks/postfix/renovate.json
+++ b/cookbooks/postfix/renovate.json
@@ -1,10 +1,9 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:base"],
-  "packageRules": [
+  "packageRules": [{
    {
      "groupName": "Actions",
-      "matchUpdateTypes": ["minor", "patch", "pin"],
+      "matchUpdateTypes": ["patch", "pin", "digest"],
      "automerge": true,
      "addLabels": ["Release: Patch", "Skip: Announcements"]
    },
--- a/cookbooks/postfix/templates/aliases.erb
+++ b/cookbooks/postfix/templates/aliases.erb
@@ -6,5 +6,5 @@
 postmaster:    root
 <% node['postfix']['aliases'].each do |name, value| %>
-<%= name.match?(/[\s#:@]/) ? "\"#{name}\"" : name %>: <%= [value].flatten.map{|x| x.include?("|") ? "\"#{x}\"" : x}.join(',') %>
+<%= name %>: <%= [value].flatten.map{|x| if (x.include?("@")) then x else %Q("#{x}") end}.join(', ') %>
 <% end unless node['postfix']['aliases'].nil? %>
--- a/data_bags/credentials/akkounts.json
+++ b/data_bags/credentials/akkounts.json
@@ -1,93 +1,65 @@
 {
  "id": "akkounts",
-  "rails_master_key": {
+  "postgresql_username": {
-    "encrypted_data": "q/0BtGuFZJQhw+iG4ZmFG12DPaWQDGTb/nCmRoxOnsACkANqMv/zZ39CoNFe\nLPtZiItY\n",
+    "encrypted_data": "l00Lmdbl5xNq07XU4XmcnRxXsIJaYyMQQ6xI\n",
-    "iv": "JV8R0iu6TrqcZRxL\n",
+    "iv": "yxvL6hKwlVWmdMzl\n",
-    "auth_tag": "YxZIhEUnrd3XrwR6f9wO4A==\n",
+    "auth_tag": "mMCV9ewJW/0TfVE76WBSZw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
-  "rails_secret_key_base": {
+  "postgresql_password": {
-    "encrypted_data": "JmDQew3+OR6+yJ1xErwXeTn6jw8N2HwTc9yvAVJ3G+7w1s3N7rKDM6+M50ez\n2zP4Lm/eXzH4WTsTZlQcodlyNpi66pvUCGAkNM36rwTN5yvnhqPUmuSQi7AG\nDTBronBwr9ENvwA/gRuugyyhrRB1iuStpzpYKCMhZ2ae9Mrxdux0+ezfSLn4\nuP22uUrEqdQ/BWsW\n",
+    "encrypted_data": "Q6xWsH6bmI1GfMzme3mBRYrt3XmDwFJ7E4FjYg2Rrw==\n",
-    "iv": "U/+YncCk13U6bYMz\n",
+    "iv": "jcQmuT7Jz3g3XE8d\n",
-    "auth_tag": "2wPYJ/uVPv4jLKpAW/x6sw==\n",
+    "auth_tag": "nNMvf9UmP6ikf1BW93QZIw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "rails_encryption_primary_key": {
    "encrypted_data": "u/7z91Og/2eM7PWi2JWYAQMhYX4S5+bMMeVpkFPu778Gqj6Td9pagsWIak/d\nb7AU1zjF\n",
    "iv": "wYhrJWcuWbY8yo8S\n",
    "auth_tag": "WEoEdNy6VBvB2d5gb8DTXw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "rails_encryption_key_derivation_salt": {
    "encrypted_data": "noOwTZuxfhsH94bjOT9rWCKS9rb3wAoXELGrc4nJZeNrb/B9XnOLTuK/wen8\nfmtoym0P\n",
    "iv": "jiFWs3VXhJdQBNqk\n",
    "auth_tag": "XDpJFgadYp7LyRqU7SO+Fg==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "postgresql": {
    "encrypted_data": "Xorg8R8COxE/Swivu8MqZiwstD6rD+8FmgDx70pFscZ/CTb6WQRpyqGSrGZt\nZ7oL9WrqZs+mQgBb30odU+Sgdr6x\n",
    "iv": "6QWZc3+MY0hBCc/s\n",
    "auth_tag": "ZM+7OYyx5E9PciNG2OILhg==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "ldap": {
    "encrypted_data": "mr2Z7hXF1GOn8RmqeZMMdaUcmiVP4ZeKtTX6RYW1cR+FQiUwoITwTPBE9XUx\n2cqZ9Mcd8uJicmf9vd+PfwPtRtoZFwqHQ4LDRFLW64hBZyiEkZWxWW+HzgPr\n",
    "iv": "k1AkyEplnJ4IZO1Z\n",
    "auth_tag": "zAOcrPex3VLDfRFq38n7fA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "sentry_dsn": {
-    "encrypted_data": "51cAERaRBCRg/sMb5c13EcnJzsz6VEf7jx6X3ooUSzm9wHoEfC5Hs/qakr/D\nqm9x3s3aGURRzyLUIEoe9jCohGguh6ehrXYVrun0B6pghVU=\n",
+    "encrypted_data": "V7cqlH2baN1Ix/ggQFeo9PY6dNKKpnDECaB1cO3XuCfy74oN2ot44nbpCQTA\nUl0+1LQv/qNn/L4gmJkqZfdIXZQqhR+iTc06UJxe3aTKJDw=\n",
-    "iv": "hJsiiW6dFQMEQ+2p\n",
+    "iv": "HJtdKYcApwaxhTXI\n",
-    "auth_tag": "TOIahNrUhhsdQGlzp6UV5g==\n",
+    "auth_tag": "qyIYK9h6nciJTFXBWOjVOA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "rails_master_key": {
    "encrypted_data": "KAl2Kgq1TXjOm4TNxGwZkPwJeOSNLbLLKiRdb4fTyBFfUhIGGeCS9VvV9kIb\n9sQZ6HLU\n",
    "iv": "BBPvDNs6nBXDti5I\n",
    "auth_tag": "yjM/0nyUwt+5SSGuLC5qWA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "discourse_connect_secret": {
-    "encrypted_data": "pvKcwuZgUJsAvClQ4V0BwhwEg09EUEWVxoSx+mFlfG1KpvZE4Cu3u3PalPSD\nldyKsw==\n",
+    "encrypted_data": "YHkZGzXeK3nDHaXt3JKmGtCcvMfgvv3yHbvS2C+CLKagOIOe+0+2/CiNuh4U\nxO1Pug==\n",
-    "iv": "ED85d6PKyaKB3Wlv\n",
+    "iv": "SnUxDpIMQum8ySfN\n",
-    "auth_tag": "XVCU/WigC97tNe0bUK6okQ==\n",
+    "auth_tag": "Ny6I+3EoCA1s74JLjjbbyQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "lndhub_admin_token": {
-    "encrypted_data": "LvCgahQblsKOxK9iNbwDd31atBfemVppHqV7s3K/sR4j\n",
+    "encrypted_data": "dJHxB80Enwkm+2aNuIrp7lILAy2J5tQaChPJCl/BHwMo\n",
-    "iv": "zObzh2jEsqXk2vD2\n",
+    "iv": "zHLtD1jTIwvjMt1l\n",
-    "auth_tag": "n9m/sBYBfzggwQLWrGpR2Q==\n",
+    "auth_tag": "IC0adEzsS5YF5YHqabWw2A==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "btcpay_auth_token": {
-    "encrypted_data": "M4kGd6+jresm90nWrJG25mX6rfhaU+VlJlIVd/IjOAUsDABryyulJul3GZFh\nFPSI4uEhgIWtn56I0bA=\n",
+    "encrypted_data": "YbM0HvgIijluKQBcgfKn6hmWvdbhr0ijR1xKc+BRZCZJsRaJBHTjCbwhH8T9\nVnBESruyjhxphtBetcc=\n",
-    "iv": "hvqHm7A/YfUOJwRJ\n",
+    "iv": "3107v/c2Tonx6/cP\n",
-    "auth_tag": "DhtT6IeixD1MSRX+D7JxZA==\n",
+    "auth_tag": "jnO9fvoXJW5gbDMRjkdMPA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_access_key": {
-    "encrypted_data": "FPRpLZoIbLcVWPJhOlX7ZeXGv6TZIWYAD+BKTsJOyOHxDG3eRULqQc89cGWi\n",
+    "encrypted_data": "PFjQKe1us12SNHlReQ4f0qctulPp4d2F3t5t+AGocp87PS/kZx77rtHQtruK\n",
-    "iv": "f9WiiGLmDxtygp60\n",
+    "iv": "BGD8+XchqwPmhhwi\n",
-    "auth_tag": "lGnq4itmByuF/Yp20/6coQ==\n",
+    "auth_tag": "XefaZKCVs8hotszALN+kxQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_secret_key": {
-    "encrypted_data": "JnnwISbHJ+d7JZB/C0NH0fb8p+bDSwoq5t5knSi+bSTltSxKcq6PRX9K6bov\nEbo0GTdWePbuc5NCsyYxfrkzCtpLXTIxeCROtinRmFIgMFNwaOA=\n",
+    "encrypted_data": "ziO35x8P1YMaSeenMNQoTWug62b5ZVLFlkMlJEFGnYjHK5qTAn6ir06WnMJC\n0zErzTZsPpcr7KpE/ipWgWHRy7qVbGnd6iVO4t9tf5NjiU2OXfA=\n",
-    "iv": "pKPCaANDqGtbFV3V\n",
+    "iv": "S3syCCxh2m+mylLu\n",
-    "auth_tag": "S//hn2HOhuZH8+UfCNBWDg==\n",
+    "auth_tag": "ZMkyBqXMXr3K3LGqxWvbtA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "nostr_private_key": {
    "encrypted_data": "AKfFiLow+veDyEWBwmCDuLerT3l+o2aJUCeHg2mZZIyoH4oeo/9crZwIdjBn\n70reouqnHNG9mBHuO/+IPGfj53mHLo+oGHh+6LkL3ImI4MFBofY=\n",
    "iv": "bPlOKk2qkJAzdKf+\n",
    "auth_tag": "VIp1IOjBGatn2MN5LHVymg==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
--- a/data_bags/credentials/backup.json
+++ b/data_bags/credentials/backup.json
@@ -1,38 +1,27 @@
 {
  "id": "backup",
  "s3_access_key_id": {
-    "encrypted_data": "245TrPvuoBRRTimhbt6qqsFb+JnnD377sPt1pguJy7Q2BXOy/jrX0wyMt+cP\nuA==\n",
+    "encrypted_data": "emGNH4v7TTEh05Go/DsI3k7CFnaK4p/4JxodC4BYpyWw47/Z3dsuRMu4vXM3\n3YLH\n",
-    "iv": "ylmRxSRO3AA4MSJN\n",
+    "iv": "Dau+ekb3UTYdl8w3fQKVcA==\n",
-    "auth_tag": "45tBcYZowPLrbv4Zu2P0Fw==\n",
+    "version": 1,
-    "version": 3,
+    "cipher": "aes-256-cbc"
    "cipher": "aes-256-gcm"
  },
  "s3_secret_access_key": {
-    "encrypted_data": "jDIOjlBzTkBUzpj243T6KnBuH0qwyW7BUFMcqllljFSzxs7K8wYJOUreNbOP\ny8OpDWAuO0H4O4LuFMJXeM8=\n",
+    "encrypted_data": "Mxyly86JxrWUbubbSiqPdRosChzfI1Q8eBEG4n+2B9JJG4yExltO5Wc5kgSs\nX01MPXAc+PGLm+J9MngUtypo/g==\n",
-    "iv": "PzvZr37EkJqz6JtM\n",
+    "iv": "WRhBJGiuScYYsUsoT5j/UA==\n",
-    "auth_tag": "e3XW8oHVgmYibv/IBzj0yA==\n",
+    "version": 1,
-    "version": 3,
+    "cipher": "aes-256-cbc"
    "cipher": "aes-256-gcm"
  },
  "s3_endpoint": {
    "encrypted_data": "ErJIEChxrreW7WKEwRtuP2MyYlsZRtqLdGa/x5QY58qgO036FgR3Hs2Z3yce\n",
    "iv": "HOSAOgUjO7XGwk50\n",
    "auth_tag": "XE1bwMIXHHE72V9K2KOLnw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_region": {
-    "encrypted_data": "8cNSaYu7HH95ftG66lFdUIPZD7soz907CPA=\n",
+    "encrypted_data": "2ZGxu0tVzKNfx3K1Wleg0SAwGaPkHCi/XfKpJ+J7q40=\n",
-    "iv": "pU21ulF75y/SIs3x\n",
+    "iv": "CNTZW2SEIgfw+IyzGI3TzQ==\n",
-    "auth_tag": "7WQQCbSbB2GybjY+C+5IvQ==\n",
+    "version": 1,
-    "version": 3,
+    "cipher": "aes-256-cbc"
    "cipher": "aes-256-gcm"
  },
  "encryption_password": {
-    "encrypted_data": "l23CiIO2s1fIRn0NdoWZ+wK+Zhx3hCYDHf4ypjqMRekZ7xqafvXHHuogD5aj\npxYUKloH\n",
+    "encrypted_data": "tsBWKBwhQFfEAM0EWMPtljSbqU1c5mOJXPjYJjNT5RUFhPlqa7gsE8aJbs+D\nSPKjAQ62j+iHeqCk9mE9CCkgBA==\n",
-    "iv": "Dzx83eP9L7Jqqidh\n",
+    "iv": "uq5YAXuq2ynRLv9EIWoCFA==\n",
-    "auth_tag": "UVn5XA5Tgsikc1GdOt1MUQ==\n",
+    "version": 1,
-    "version": 3,
+    "cipher": "aes-256-cbc"
    "cipher": "aes-256-gcm"
  }
 }
--- a/data_bags/credentials/blossom.json
+++ b/data_bags/credentials/blossom.json
@@ -1,24 +0,0 @@
 {
  "id": "blossom",
  "admin_password": {
    "encrypted_data": "Gd6AzFmySL0p+xo1PnRn9p4Fwge1m3CQj+NRLIUD8P9u1C8=\n",
    "iv": "l6KVzF9xEEBRRAmh\n",
    "auth_tag": "P791KMh9TxuHiWJpDKxWQA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_access_key": {
    "encrypted_data": "S8jB2LDQOxI/p5ugggW1Sk50TS9TJe9sLv04O/VD9/v22SSM7J6ETomTA+Hd\n",
    "iv": "dUIIZbdAT9q72ioX\n",
    "auth_tag": "+5fCNOuTE/+FqdV6rDNbkw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_secret_key": {
    "encrypted_data": "soT63l2frBJDNmHetXmEPvNYBsTpvTyR95FA2rxuZXvVE7hMj21La8/0Amk7\nv+mHOBUMaGG9BTLN0tVFkL0+lGPXdZJTbtDHgluk5l6lLPyc8KY=\n",
    "iv": "RuXs2pL9C/wpwJ/w\n",
    "auth_tag": "nu7dE2udTkxaUZCR42h09w==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
 }
--- a/data_bags/credentials/dirsrv.json
+++ b/data_bags/credentials/dirsrv.json
@@ -1,30 +1,9 @@
 {
  "id": "dirsrv",
  "admin_dn": {
    "encrypted_data": "zRtz6Scb9WtUXGyjc0xyvsre0YvqupuaFz+RPApj7DEQTmYyZPVb\n",
    "iv": "xfIXMhEBHBWqa4Dz\n",
    "auth_tag": "BcA32u1njcnCZ+yrBGSceQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "admin_password": {
-    "encrypted_data": "7JpXl3JZDqKWDfYt/wuNbkbob+oRuONhkuAlpqUCCEIn+tY=\n",
+    "encrypted_data": "i71l5E129mXCcDAyME8sNMUkYUlQMgt7Eh6noyFcLNgbaMo=\n",
-    "iv": "Lcwc4NDzrfcBaIKQ\n",
+    "iv": "KNW2B8tpX7ywZwbg\n",
-    "auth_tag": "rrePS3Bhdnwbr2d/o8vMhg==\n",
+    "auth_tag": "GawQ+FSlA5v5YVyryeUxng==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "service_dn": {
    "encrypted_data": "sqRFiZreLeTPQljSfhAuV3DmsPxSC8tzWjCdu+WSSbO67sBQA+xhmGtzBhBD\nDZPGJw+jtAxzuVvPdAjxgAVgxXO6C6WEo87L1tdJewE=\n",
    "iv": "GUEGtyRJXrPhWcUs\n",
    "auth_tag": "2USsrx//3V7RCyumGCbMkg==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "service_password": {
    "encrypted_data": "f2wi8B8SEt6p5G0TF3dZ72j0vMFlvwcP1suxYnshBA==\n",
    "iv": "rOnUoxbnkaJtodM+\n",
    "auth_tag": "dVLCtBVMjxLfW2D8XjJBdQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
--- a/data_bags/credentials/gandi_api.json
+++ b/data_bags/credentials/gandi_api.json
@@ -1,17 +0,0 @@
 {
  "id": "gandi_api",
  "access_token": {
    "encrypted_data": "+skwxHnpAj/3d3e2u7s7B9EydbETj8b0flWahvb5gt/o4JYFWHrhIyX/0IVa\n4wgmu08eDgU51i0knGA=\n",
    "iv": "ONKrFCt8Oj3GKIQ5\n",
    "auth_tag": "j9Hrk8ZZFMQub4NUO+2e4g==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "domains": {
    "encrypted_data": "lGfoPHdXEYYdJmoIA9M119wjVl1v4UzIv5gHADwx0A==\n",
    "iv": "q6XKbxhW7X9ONxNt\n",
    "auth_tag": "ns9WJH8Oe75siWu+sOZkRg==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
 }
--- a/data_bags/credentials/gandi_api_5apps.json
+++ b/data_bags/credentials/gandi_api_5apps.json
@@ -0,0 +1,17 @@
 {
  "id": "gandi_api_5apps",
  "key": {
    "encrypted_data": "AGYIkLdbnU3+O6OxGsFyLpZtTw531s2dbRC4Lik+8NYp3l4P0UMM2Pqf0g==\n",
    "iv": "kPRHGpLwNIC3MpES\n",
    "auth_tag": "wKth2tA+JxILFIKppHLDJg==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "access_token": {
    "encrypted_data": "+tKKFcWV0CZ5wEB/No5hou5+p1llsUkq7AXBvfnA7xsgbpa2q8AX/2UFf9Cf\nGtd9om1CeJJtz+o4ceA=\n",
    "iv": "hLJSV77DQtqXZDbV\n",
    "auth_tag": "8xgyudyDk4hq16LRkykGhQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
 }
--- a/data_bags/credentials/kosmos-rs.json
+++ b/data_bags/credentials/kosmos-rs.json
@@ -1,10 +0,0 @@
 {
  "id": "kosmos-rs",
  "auth_tokens": {
    "encrypted_data": "fiznpRw7VKlm232+U6XV1rqkAf2Z8CpoD8KyvuvOH2JniaymlcTHgazGWQ8s\nGeqK4RU9l4d29e9i+Mh0k4vnhO4q\n",
    "iv": "SvurcL2oNSNWjlxp\n",
    "auth_tag": "JLQ7vGXAuYYJpLEpL6C+Rw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
 }
--- a/data_bags/credentials/lndhub-go.json
+++ b/data_bags/credentials/lndhub-go.json
@@ -1,30 +1,30 @@
 {
  "id": "lndhub-go",
  "jwt_secret": {
-    "encrypted_data": "lJsKBTCRzI83xmRHXzpnuRH/4cuMOR+Rd+SBU50G9HdibadIEDhS\n",
+    "encrypted_data": "3T4JYnoISKXCnatCBeLCXyE8wVjzphw5/JU5A0vHfQ2xSDZreIRQ\n",
-    "iv": "f/SvsWtZIYOVc54X\n",
+    "iv": "bGQZjCk6FtD/hqVj\n",
-    "auth_tag": "YlJ78EuJbcPfjCPc2eH+ug==\n",
+    "auth_tag": "CS87+UK1ZIFMiNcNaoyO6w==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "postgresql_password": {
-    "encrypted_data": "aT0yNlWjvk/0S4z2kZB4Ye1u/ngk5J6fGPbwZSfdq6cy\n",
+    "encrypted_data": "u8kf/6WdSTzyIz2kF+24JgOPLndWH2WmTFZ3CToJsnay\n",
-    "iv": "OgUttF4LlSrL/7gH\n",
+    "iv": "KqLtV2UuaAzJx7C8\n",
-    "auth_tag": "pcbbGqbQ2RjU+i9dt8c3OQ==\n",
+    "auth_tag": "3aqx45+epb2NFkNfOfG89A==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "admin_token": {
-    "encrypted_data": "I9EsqCCxMIw+fX6sfu6KX8B5fJj9DX5Y4tbX30jdnmxr\n",
+    "encrypted_data": "Z737fXqRE9JHfunRhc2GG281dFFN1bvBvTzTDzl/Vb8O\n",
-    "iv": "vnERvIWYInO6+Y8q\n",
+    "iv": "oKLQJbD67tiz2235\n",
-    "auth_tag": "gO+MprZUQgPEWJQUmSF1sA==\n",
+    "auth_tag": "SlVIqC9d9SRoO78M7cBjTw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "sentry_dsn": {
-    "encrypted_data": "+sUXWgl6dXpA1/0FqjKC3Jnl54aor6gtM+19EM/NsHwg4qu672YnSgxV+c9x\nHM3JZBYxBYvJ+HYGAvMmhlGvaOOEIvLmFUpCCJeVUXR32S8=\n",
+    "encrypted_data": "gmDHGDWkTIvaXjcWMs1dnKnbqtsADPJ2mLmWw8Idj6RVevU5CabjvviAxEo1\n3hs2LWuObumRSCQt2QKap191uMq3CL2+da53hbsv+JUkxl4=\n",
-    "iv": "82+DzAnHiptaX7sO\n",
+    "iv": "Yt0fSsxL4SNicwUY\n",
-    "auth_tag": "CDx44iRBVhSIF8DOxb2c+w==\n",
+    "auth_tag": "j7BWbcNnymHHMNTADWmCNw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
--- a/data_bags/credentials/mastodon.json
+++ b/data_bags/credentials/mastodon.json
@@ -1,114 +1,79 @@
 {
  "id": "mastodon",
  "active_record_encryption_deterministic_key": {
    "encrypted_data": "2ik8hqK7wrtxyC73DLI8FNezZiWp2rdjwaWZkTUFRj+iwvpSrGVEwMx6uxDI\nWa7zF3p/\n",
    "iv": "XMp6wqwzStXZx+F3\n",
    "auth_tag": "vloJOLqEcghfQXOYohVVlg==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "active_record_encryption_key_derivation_salt": {
    "encrypted_data": "Nq/rHayMYmT/82k3tJUKU8YTvDKUKLoK204aT0CMGZertZaAD3dtA9AkprrA\nPK0D9CdL\n",
    "iv": "tn9C+igusYMH6GyM\n",
    "auth_tag": "+ReZRNrfpl6ZDwYQpwm6dw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "active_record_encryption_primary_key": {
    "encrypted_data": "UEDMuKHgZDBhpB9BwbPmtdmIDWHyS9/bSzaEbtTRvLcV8dGOE5q9lDVIIsQp\n2HE0c92p\n",
    "iv": "tnB0pQ3OGDne3mN/\n",
    "auth_tag": "kt234ms+bmcxJj/+FH/72Q==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "paperclip_secret": {
-    "encrypted_data": "AlsnNTRF6GEyHjMHnC4VdzF4swMlppz/Gcp1xr0OuMEgQiOcW1oSZjDRZCRV\nmuGqZXZx64wqZyzTsJZ6ayCLsmWlPq6L21odHWyO+P/C5ubenSXnuCjpUn3/\nHs8WLX3kwVmqCRnVgDl2vEZ5H4XedSLr7R7YM7gQkM0UX4muMDWWnOTR8/x/\ni1ecwBY5RjdewwyR\n",
+    "encrypted_data": "orOIbqFANPCkd4sUTCyyoh4z1o6SBudgH4wKJudTo9dANaHGhWcBUFKrhZi1\nMJTBQx/d0hiDI1P2XN3h+hROCg3JJ8OClUSJH9CfN5GlbWvXh0Nhq7hqy8L3\nLAPL+uigiXI6ObrnKQoD8LeJIB46233uwaCA/7zB6gah0ExJ2DXGH6qq9JSS\nqmTFiy+hT+VHGrUo\n",
-    "iv": "RWiLePhFyPekYSl9\n",
+    "iv": "U4E4NLYLkP0/tTTs\n",
-    "auth_tag": "sUq4ZX9CFKPbwDyuKQfNLQ==\n",
+    "auth_tag": "WKQ+pDPZp7B791lhC5j3iQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "secret_key_base": {
-    "encrypted_data": "K5CmIXFa9mS4/dODBQAN9Bw0SFpbLiZAB8ewiYpkB8NDXP6X/BX8aDjW2Y4F\ncMvpFyiFldRBhrh1MSKTVYQEoJ3JhlNL9HCdPsAYbBEW70AuEBpHvOtD5OxH\nqgbH4Reuk6JX5AI8SwDD3zGrdT12mTFVNgSujzuZMvpi1Sro2HtRGAkjmnaa\nMGKrBV21O1CREJJg\n",
+    "encrypted_data": "vweClhdY8SqQkK+p0OYUL2B6Fsz5eQDpEYWCtd/eRJfwwYAObbLcMWRC6MwE\neQVMw59bOqYc3RBuv/+WPLtENazA1bYCXBXQr1J6xqjJAz0Mo6KbRyxy5n78\nv8q6RSiao1VVIUXohtFlQgWeV6x5sz34bJxjlHinKvKsgiGXiuVBxYUUfzWQ\nuzrGug09cpZBqfpc\n",
-    "iv": "/yMMmz1YtKIs5HSd\n",
+    "iv": "Z0/csEBH5/X1+MR+\n",
-    "auth_tag": "WXgIVWjIdbMFlJhTD5J0JQ==\n",
+    "auth_tag": "fTvBN6eovi3JVEK0ZX97Nw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "otp_secret": {
-    "encrypted_data": "OPLnYRySSIDOcVHy2A5V+pCrz9zVIPjdpAGmCdgQkXtJfsS9NzNtxOPwrXo6\nuQlV9iPjr1Y9ljGKYytbF0fPgAa5q6Z1oHMY9vOGs/LGKj8wHDmIvxQ+Gil1\nC+dZEePmqGaySlNSB/gNzcFIvjBH3mDxHJJe9hDxSv5miNS9l9f3UvQeLP2M\nU7/aHKagL9ZHOp/d\n",
+    "encrypted_data": "o1ts1bUgPIzFQXjJ2MpBMLntWkyPxDaJAaU1K3WzmNMXnw5MVlkKKCEFVccd\nPss/MwDuBkbNPhri3ZkH48m9SiayWETVYvw5GZzcVsw4TeMu915O44lfl9tX\nW3XHU+DBps1BVH9535R4X9M1aFW4W4XfwHtS5wcrZqtVhNhS3NSgE4JpN/Dz\nFdcFAOhflnt8fIAN\n",
-    "iv": "wqJBLdZhJ7M/KRG9\n",
+    "iv": "QLsxmIlX1NpxMyHz\n",
-    "auth_tag": "dv5YyZszZCrRnTleaiGd4A==\n",
+    "auth_tag": "j1h/PvIoqshTBN5c5IaAsA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "aws_access_key_id": {
-    "encrypted_data": "A1/gfcyrwT6i9W6aGTJ8pH4Dm4o8ACDxvooDroA/2N0szOiNyiYX\n",
+    "encrypted_data": "YQHUx0GugKu0AtlbGLRGocFEhTGAghWA0DUs1Nxs4Hd3bTIp4lyM\n",
-    "iv": "JNvf21KhdM3yoLGt\n",
+    "iv": "54zt2tkQhHtpY7sO\n",
-    "auth_tag": "2xaZql1ymPYuXuvXzT3ymA==\n",
+    "auth_tag": "ofBJx3QDsjHe66ga3nji8g==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "aws_secret_access_key": {
-    "encrypted_data": "T1tc01nACxhDgygKaiAq3LChGYSgmW8LAwr1aSxXmJ5D2NtypJDikiHrJbFZ\nfWFgm1qe4L8iD/k5+ro=\n",
+    "encrypted_data": "FAz6xZ+wsCz/KFA+DK6f4V04rxJt+9U/yXUGF9tvce0VqB3scH+T0KDDn1/n\nZ/0G0Tbxt2urRPbPUdI=\n",
-    "iv": "FDTPQQDLUMKW7TXx\n",
+    "iv": "iapSpeM6lfDMIfNk\n",
-    "auth_tag": "msY6PFFYhlwQ0X7gekSDiw==\n",
+    "auth_tag": "HlkwUnNeJlOUrZ3ieN5xAQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "ldap_bind_dn": {
    "encrypted_data": "C/YNROVyOxmR4O2Cy52TX41EKli2bCOMzwYD+6Hz/SiKkgidnKUHlvHlbTDq\nkWwlRDM2o8esOCKaEAGPNWcNc9IHlaSsfwhr4YWnwe0=\n",
    "iv": "QCQF0+vH+//+nDxr\n",
    "auth_tag": "a0PbyO/7wjufqH2acDCqmQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "ldap_password": {
    "encrypted_data": "SqwKeiyzfvvZGqH5gi35BdW3W+Fo/AQQjso1Yfp2XA==\n",
    "iv": "md2/etFJ1r/BKaYg\n",
    "auth_tag": "OlCCOoYSD7ukdH2yWCd6KA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "smtp_user_name": {
-    "encrypted_data": "0kzppmSSUg7lEyYnI5a0nf+xO0vSVx88rbxI+niIdzFOOBKSIL6uVHJ340dw\nMQ==\n",
+    "encrypted_data": "ivB09/mCRrUaz9X4NFRBiqytjgy/vxN5Nha7gopFq5eSu9v4K9MkaLRqHh1I\nYw==\n",
-    "iv": "lQR77ETTtIIyaG1r\n",
+    "iv": "a8WKhRKsUjqBtfmn\n",
-    "auth_tag": "smF2HRg8WdmD+MWwkT3TqA==\n",
+    "auth_tag": "ib5WJNNaO7bRIspdACmOLw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "smtp_password": {
-    "encrypted_data": "1i0m9qiZA/8k8fMKo+04uyndl1UhagtHweBFICIorWALkB68edjb8OhUDxv9\nTubiXYRC\n",
+    "encrypted_data": "FxPz2e7fUNqcAu+DDJKlqn8rcSBLmnzigTFf5moZlQ1zz4YVl6pqHisa22Qz\nbfUx9rjU\n",
-    "iv": "IU2x4ips9HWmKoxi\n",
+    "iv": "GvRlNDV/b1WawtOP\n",
-    "auth_tag": "BZJTDfPBvt8cf6/MbKzUJQ==\n",
+    "auth_tag": "kyRCGfSJQelIwThDT4iQQQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "vapid_private_key": {
-    "encrypted_data": "+LmySMvzrV3z2z7BmJG9hpvkL06mGc87RG20XQhhdAJ2Z/5uMMjev2pUf7du\ntv2qvDJAimhkZajuDGL9R3eq\n",
+    "encrypted_data": "DlbEAhd+SkSJoOSuwGhd5bdFlJADnT0w4u0+6m8AJoWJjoSCGAnzzmdHWT/k\nVUDkwiBCkqmEPK0oTvxnl/a8\n",
-    "iv": "Mg7NhPl31O6Z4P+v\n",
+    "iv": "6e0Gay7GVrQad1rI\n",
-    "auth_tag": "qYWPInhgoWAjg0zQ+XXt5w==\n",
+    "auth_tag": "jjVundJ/ITxP/oYgEgzElg==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "vapid_public_key": {
-    "encrypted_data": "NOyc+Cech9qG2HhnhajDaJMWd1OU5Rp6hws6i4xF5mLPePMJ9mJTqzklkuMK\npYSEdtcxA3KmDt1HrFxfezYUc9xO9pvlm0BPA7XAFmF/PU7/AJbFqgPU6pX/\ntSDLSdFuMB3ky+cl4DJi+O4=\n",
+    "encrypted_data": "+m37w/eWYqdEjsEYQw27FvQC+37ucruOFjZAjo0OgCwA0SoVz4VHX2eSA2AK\njX4CnM91cY4e/WG/ZHKlOMN1PftyQn2bdGaw35nXDanep8z0ROa01JEEi5DE\nUFRKvBmPInTeR6xvemuj7GM=\n",
-    "iv": "rgUglYiHB/mhqGha\n",
+    "iv": "loYbGrAsWGLUZ+BK\n",
-    "auth_tag": "DEX7hdNsNLi/LIrMkdUe/Q==\n",
+    "auth_tag": "lAfpEEVQq+n7MLLm/kpmIA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_key_id": {
-    "encrypted_data": "rPVzrYYIbcM+ssVpdL6wpCTdzLIEKXke1+eMlPLMG2gPuoh+W3eO3nFGb/s2\n",
+    "encrypted_data": "4B8OQ0iVCCna4FvC+EuS5prEUWaHRm1+tzXGmFoCQ4WZfhUA1HwT3x651e/R\n",
-    "iv": "/qI8F9cvnfKG7ZXE\n",
+    "iv": "1/zGwcQPQQQCiXIs\n",
-    "auth_tag": "z1+MPdkO/+SCaag2ULelPg==\n",
+    "auth_tag": "siK9ph1q3/VVEycy91wkqQ==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_secret_key": {
-    "encrypted_data": "RMnB9kZ+slbQXfpo0udYld6S1QqBxqM1YbszdLfSAdKK9I0J3Kmvh/CQ5Fbx\nyov6LClmsl1rjtH16r7cY32M4Woq+6miERdtecyDrrYkNHz0xkA=\n",
+    "encrypted_data": "BSAc8dE/rQUiVvTGV6Ee/ZUDpq4HZlpoaCZ+lbQAbcnxui4ib0OTLPFwhVJ9\n4OQWahtSzkqxMc6MKWpadLT1a3oTnvnae9b3u40X5b2P3VyZYCM=\n",
-    "iv": "pO7bm3aOtjuwYjG/\n",
+    "iv": "bqw8GTqLMTs5vD5n\n",
-    "auth_tag": "SRvn4z1+Vd5VAGgjG64s+Q==\n",
+    "auth_tag": "+e48L1lYVNda7VE3uLOAHA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
--- a/doc/mastodon.md
+++ b/doc/mastodon.md
@@ -1,15 +0,0 @@
 # Mastodon
 Running on kosmos.social
 ## Ops
 ### Enable maintance mode
 Return a 503 and maintance page for all requests:
    knife ssh -p2222 -a knife_zero.host "role:openresty_proxy" "sudo cp -p /var/www/maintenance.html /var/www/kosmos.social/public/ && sudo systemctl reload openresty"
 ### Stop maintenance mode
    knife ssh -p2222 -a knife_zero.host "role:openresty_proxy" "sudo rm /var/www/kosmos.social/public/maintenance.html && sudo systemctl reload openresty"
--- a/doc/postgres/migration.md
+++ b/doc/postgres/migration.md
@@ -1,287 +0,0 @@
 # Migrating PostgreSQL cluster to a new major version
 ## Summary
 1. Dump from a replica
 2. Restore to fresh VM running new major version
 3. Add logical replication for delta sync from current/old primary
 4. Switch primary to new server
 5. Remove logical replication on new server
 ## Runbook
 * Primary host: `PRIMARY_HOST`
 * Replica host: `REPLICA_HOST`
 * New PG14 host: `NEW_HOST`
 * PostgreSQL superuser: `postgres`
 * Running locally on each machine via `sudo -u postgres`
 Adjust hostnames/IPs/etc. where needed.
 ---
 ### 🟢 0. PRIMARY — Pre-checks
 ```bash
 sudo -u postgres psql -c "SHOW wal_level;"
 sudo -u postgres psql -c "SHOW max_replication_slots;"
 ```
 If needed, edit config:
 ```bash
 sudo -u postgres vi $PGDATA/postgresql.conf
 ```
 Ensure:
 ```conf
 wal_level = logical
 max_replication_slots = 10
 ```
 Restart if changed:
 ```bash
 sudo systemctl restart postgresql
 ```
 ---
 ### 🔵🟡 3. Create keypair for syncing dump later
 🔵 On NEW_HOST:
 ```bash
 sudo mkdir -p /home/postgres/.ssh && \
 sudo chown -R postgres:postgres /home/postgres && \
 sudo chmod 700 /home/postgres/.ssh && \
 sudo -u postgres bash -c 'ssh-keygen -t ecdsa -b 256 -f /home/postgres/.ssh/id_ecdsa -N "" -C "postgres@$(hostname)"' && \
 sudo cat /home/postgres/.ssh/id_ecdsa.pub
 ```
 Copy the public key from the above output
 🟡 On replica:
 ```bash
 sudo mkdir -p /home/postgres/.ssh && \
 sudo chown -R postgres:postgres /home/postgres && \
 sudo chmod 700 /home/postgres/.ssh && \
 echo [public_key] | sudo tee /home/postgres/.ssh/authorized_keys > /dev/null && \
 sudo chmod 700 /home/postgres/.ssh
 ```
 ---
 ### 🟢 1. PRIMARY — Create publication and replication slots
 ```bash
 sudo -u postgres pg_create_replication_publications
 ```
 or
 ```bash
 sudo -u postgres pg_create_replication_publication [db_name]
 ```
 Listing publications and slots:
 ```bash
 sudo -u postgres pg_list_replication_publications
 sudo -u postgres pg_list_replication_slots
 ```
 ---
 ### 🟡 3. REPLICA — Pause replication
 ```bash
 sudo -u postgres psql -c "SELECT pg_wal_replay_pause();"
 ```
 Verify:
 ```bash
 sudo -u postgres psql -c "SELECT pg_is_wal_replay_paused();"
 ```
 ---
 ### 🟡 4. REPLICA — Run dump
 ```bash
 sudo -u postgres pg_dump_all_databases
 ```
 or
 ```bash
 sudo -u postgres bash -c "pg_dumpall --globals-only > /tmp/globals.sql"
 sudo -u postgres pg_dump_database [db_name]
 ```
 ---
 ### 🟡 5. REPLICA — Resume replication
 ```bash
 sudo -u postgres psql -c "SELECT pg_wal_replay_resume();"
 ```
 ---
 ### 🔵 6. COPY dumps to NEW HOST
 From NEW_HOST:
 ```bash
 export REPLICA_HOST=[private_ip] && \
 cd /tmp && \
 sudo -u postgres scp "postgres@$REPLICA_HOST:/tmp/globals.sql" . && \
 sudo -u postgres scp "postgres@$REPLICA_HOST:/tmp/dump_*.tar.zst" .
 ```
 ---
 ### 🔵 7. NEW HOST (PostgreSQL 14) — Restore
 #### 7.1 Restore globals
 ```bash
 sudo -u postgres psql -f /tmp/globals.sql
 ```
 ---
 #### 7.2 Create databases
 ```bash
 sudo -u postgres psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN ('template1')" | \
 xargs -I{} sudo -u postgres createdb {}
 ```
 or
 ```bash
 sudo -u postgres createdb [db_name]
 ```
 ---
 #### 7.3 Restore each database
 ```bash
 sudo -u postgres pg_restore_all_databases
 ```
 or
 ```bash
 sudo -u postgres pg_restore_database [db_name]
 ```
 ---
 ### 🔵 8. NEW HOST — Create subscriptions
 ```bash
 sudo -u postgres pg_create_replication_subscriptions
 ```
 or
 ```bash
 sudo -u postgres pg_create_replication_subscription [db_name]
 ```
 ---
 ### 🔵 9. NEW HOST — Monitor replication
 ```bash
 sudo -u postgres pg_list_replication_subscriptions
 ```
 ---
 ### 🔴 11. CUTOVER
 #### 11.1 Stop writes on old primary
 Put app(s) in maintenance mode, stop the app/daemons.
 ---
 #### 11.2 Wait for replication to catch up
 TODO: not the best way to check, since WAL LSNs keep increasing
 ```bash
 sudo -u postgres psql -d [db_name] -c "SELECT * FROM pg_stat_subscription;"
 ```
 ---
 #### 11.3 Fix sequences
 Run per DB:
 ```bash
 sudo -u postgres pg_fix_sequences_in_all_databases
 ```
 or
 ```bash
 sudo -u postgres pg_fix_sequences [db_name]
 ```
 ---
 #### 11.4 Point app to NEW_HOST
 1. Update `pg.kosmos.local` in `/etc/hosts` on app server(s). For example:
   ```bash
   export NEW_PG_PRIMARY=[private_ip]
   knife ssh roles:ejabberd -a knife_zero.host "sudo sed -r \"s/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\s(pg.kosmos.local)/$NEW_PG_PRIMARY\t\1/\" -i /etc/hosts"
   ```
   Or override node attribute(s) if necessary and/or approporiate.
 2. Start the app/daemons, and deactivate maintenance mode.
 ---
 ### 🧹 12. CLEANUP NEW_HOST
 ```bash
 sudo -u postgres pg_drop_replication_subscriptions
 ```
 ---
 ### 🧹 13. CLEANUP PRIMARY
 TODO: Looks like slots are dropped automatically, when subscriptions are dropped
 ```bash
 sudo -u postgres pg_drop_replication_publications
 ```
 ---
 ### 🧹 13. CLEANUP Chef
 Once all apps/databases are migrated, update the role in the node
 config of the new primary to 'postgres_primary' and converge it.
 Also delete the old primary node config from the Chef repo.
 ---
 ### ✅ DONE
 ---
--- a/environments/production.json
+++ b/environments/production.json
@@ -3,7 +3,6 @@
  "override_attributes": {
    "akkounts": {
      "btcpay": {
        "public_url": "https://btcpay.kosmos.org",
        "store_id": "FNJVVsrVkKaduPDAkRVchdegjwzsNhpceAdonCaXAwBX"
      },
      "ejabberd": {
@@ -12,20 +11,6 @@
      "lndhub": {
        "public_url": "https://lndhub.kosmos.org",
        "public_key": "024cd3be18617f39cf645851e3ba63f51fc13f0bb09e3bb25e6fd4de556486d946"
      },
      "nostr": {
        "public_key": "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a",
        "relay_url": "wss://nostr.kosmos.org"
      }
    },
    "blossom": {
      "domain": "blossom.kosmos.org",
      "storage": {
        "s3": {
          "endpoint": "s3.kosmos.org",
          "region": "garage",
          "bucket": "blossom"
        }
      }
    },
    "discourse": {
@@ -48,7 +33,8 @@
        "hostmaster@kosmos.org":  "mail@kosmos.org",
        "postmaster@kosmos.org":  "mail@kosmos.org",
        "abuse@kosmos.org":       "mail@kosmos.org",
-        "mail@kosmos.org":        "foundation@kosmos.org"
+        "mail@kosmos.org":        "foundation@kosmos.org",
        "hackerhouse@kosmos.org": "mail@lagrange6.com"
      }
    },
    "garage": {
@@ -87,7 +73,6 @@
    },
    "kosmos-mastodon": {
      "domain": "kosmos.social",
      "user_address_domain": "kosmos.social",
      "s3_endpoint": "http://localhost:3900",
      "s3_region": "garage",
      "s3_bucket": "kosmos-social",
@@ -112,42 +97,6 @@
    },
    "sentry": {
      "allowed_ips": "10.1.1.0/24"
    },
    "strfry": {
      "domain": "nostr.kosmos.org",
      "config": {
        "events": {
          "max_event_size": "524288"
        },
        "relay": {
          "bind": "0.0.0.0",
          "real_ip_header": "x-real-ip",
          "info": {
            "name": "Kosmos Relay",
            "description": "Members-only nostr relay for kosmos.org users",
            "pubkey": "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf",
            "contact": "ops@kosmos.org",
            "icon": "https://assets.kosmos.org/img/app-icon-256px.png"
          },
          "write_policy": {
            "plugin": "/opt/strfry/strfry-policy.ts"
          },
          "logging": {
            "dump_in_all": true
          }
        }
      },
      "known_pubkeys": {
        "_": "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf",
        "accounts": "b3e1b7c1660b7db0ecb93ec55c09e67961171a5c4e9e2602f1b47477ea61c50a",
        "bitcoincore": "47750177bb6bb113784e4973f6b2e3dd27ef1eff227d6e38d0046d618969e41a",
        "fiatjaf": "3bf0c63fcb93463407af97a5e5ee64fa883d107ef9e558472c4eb9aaaefa459d"
      }
    },
    "substr": {
      "relay_urls": [
        "ws://localhost:7777"
      ]
    }
  }
 }
--- a/nodes/akkounts-1.json
+++ b/nodes/akkounts-1.json
@@ -9,7 +9,7 @@
  "automatic": {
    "fqdn": "akkounts-1",
    "os": "linux",
-    "os_version": "5.4.0-223-generic",
+    "os_version": "5.4.0-148-generic",
    "hostname": "akkounts-1",
    "ipaddress": "192.168.122.160",
    "roles": [
@@ -38,7 +38,6 @@
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -67,13 +66,13 @@
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.10.17",
+        "version": "18.2.7",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.2.7/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.13",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
      }
    }
  },
--- a/nodes/bitcoin-2.json
+++ b/nodes/bitcoin-2.json
@@ -8,7 +8,7 @@
  "automatic": {
    "fqdn": "bitcoin-2",
    "os": "linux",
-    "os_version": "5.4.0-216-generic",
+    "os_version": "5.4.0-163-generic",
    "hostname": "bitcoin-2",
    "ipaddress": "192.168.122.148",
    "roles": [
@@ -16,6 +16,7 @@
      "kvm_guest",
      "sentry_client",
      "bitcoind",
      "cln",
      "lnd",
      "lndhub",
      "postgresql_client",
@@ -29,8 +30,10 @@
      "tor-full",
      "tor-full::default",
      "kosmos-bitcoin::bitcoind",
      "kosmos-bitcoin::c-lightning",
      "kosmos-bitcoin::lnd",
      "kosmos-bitcoin::lnd-scb-s3",
      "kosmos-bitcoin::boltz",
      "kosmos-bitcoin::rtl",
      "kosmos-bitcoin::peerswap-lnd",
      "kosmos_postgresql::hostsfile",
@@ -38,13 +41,11 @@
      "kosmos-bitcoin::dotnet",
      "kosmos-bitcoin::nbxplorer",
      "kosmos-bitcoin::btcpay",
      "kosmos-bitcoin::price_tracking",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -102,9 +103,9 @@
    "role[sentry_client]",
    "recipe[tor-full]",
    "role[bitcoind]",
    "role[cln]",
    "role[lnd]",
    "role[lndhub]",
-    "role[btcpay]",
+    "role[btcpay]"
    "recipe[kosmos-bitcoin::price_tracking]"
  ]
 }
--- a/nodes/draco.kosmos.org.json
+++ b/nodes/draco.kosmos.org.json
@@ -12,7 +12,6 @@
    },
    "openresty": {
      "listen_ip": "148.251.237.111",
      "listen_ipv6": "2a01:4f8:202:804a::2",
      "log_formats": {
        "json": "{\"ip\":\"$remote_addr\",\"time\":\"$time_local\",\"host\":\"$host\",\"method\":\"$request_method\",\"uri\":\"$uri\",\"status\":$status,\"size\":$body_bytes_sent,\"referer\":\"$http_referer\",\"upstream_addr\":\"$upstream_addr\",\"upstream_response_time\":\"$upstream_response_time\",\"ua\":\"$http_user_agent\"}"
      }
@@ -21,7 +20,7 @@
  "automatic": {
    "fqdn": "draco.kosmos.org",
    "os": "linux",
-    "os_version": "5.4.0-187-generic",
+    "os_version": "5.4.0-54-generic",
    "hostname": "draco",
    "ipaddress": "148.251.237.73",
    "roles": [
@@ -46,7 +45,6 @@
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
      "kosmos_assets::nginx_site",
      "kosmos_blossom::nginx",
      "kosmos_discourse::nginx",
      "kosmos_drone::nginx",
      "kosmos_garage::nginx_web",
@@ -56,10 +54,8 @@
      "kosmos_liquor-cabinet::nginx",
      "kosmos_rsk::nginx_testnet",
      "kosmos_rsk::nginx_mainnet",
      "kosmos_strfry::nginx",
      "kosmos_website",
      "kosmos_website::default",
      "kosmos_website::redirects",
      "kosmos-akkounts::nginx",
      "kosmos-akkounts::nginx_api",
      "kosmos-bitcoin::nginx_lndhub",
@@ -83,7 +79,6 @@
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -113,13 +108,13 @@
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.10.17",
+        "version": "18.2.7",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.2.7/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.13",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
      }
    }
  },
--- a/nodes/drone-1.json
+++ b/nodes/drone-1.json
@@ -8,27 +8,26 @@
  "automatic": {
    "fqdn": "drone-1",
    "os": "linux",
-    "os_version": "5.4.0-1133-kvm",
+    "os_version": "5.4.0-1058-kvm",
    "hostname": "drone-1",
    "ipaddress": "192.168.122.200",
    "roles": [
      "kvm_guest",
      "drone",
-      "postgresql_client"
+      "postgresql_client",
      "kvm_guest"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_postgresql::hostsfile",
      "kosmos_drone",
      "kosmos_drone::default",
      "kosmos_kvm::guest",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -44,13 +43,13 @@
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.7.10",
+        "version": "17.9.52",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.7.10/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.0.0/gems/chef-17.9.52/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.5",
+        "version": "17.9.0",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.5/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.0.0/gems/ohai-17.9.0/lib/ohai"
      }
    }
  },
--- a/nodes/ejabberd-4.json
+++ b/nodes/ejabberd-4.json
@@ -37,7 +37,6 @@
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
--- a/nodes/ejabberd-8.json
+++ b/nodes/ejabberd-8.json
@@ -37,7 +37,6 @@
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
--- a/nodes/fornax.kosmos.org.json
+++ b/nodes/fornax.kosmos.org.json
@@ -39,7 +39,6 @@
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
      "kosmos_assets::nginx_site",
      "kosmos_blossom::nginx",
      "kosmos_discourse::nginx",
      "kosmos_drone::nginx",
      "kosmos_garage::nginx_web",
@@ -49,10 +48,8 @@
      "kosmos_liquor-cabinet::nginx",
      "kosmos_rsk::nginx_testnet",
      "kosmos_rsk::nginx_mainnet",
      "kosmos_strfry::nginx",
      "kosmos_website",
      "kosmos_website::default",
      "kosmos_website::redirects",
      "kosmos-akkounts::nginx",
      "kosmos-akkounts::nginx_api",
      "kosmos-bitcoin::nginx_lndhub",
@@ -76,7 +73,6 @@
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -106,13 +102,13 @@
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.10.17",
+        "version": "18.2.7",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.2.7/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.13",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
      }
    }
  },
--- a/nodes/garage-12.json
+++ b/nodes/garage-12.json
@@ -1,65 +0,0 @@
 {
  "name": "garage-12",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.224"
    }
  },
  "automatic": {
    "fqdn": "garage-12",
    "os": "linux",
    "os_version": "5.15.0-1059-kvm",
    "hostname": "garage-12",
    "ipaddress": "192.168.122.173",
    "roles": [
      "base",
      "kvm_guest",
      "garage_node"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
      "kosmos_garage::firewall_apis",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
      "firewall::default"
    ],
    "platform": "ubuntu",
    "platform_version": "22.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.7.10",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.7.10/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.2.5",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.5/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[garage_node]"
  ]
 }
--- a/nodes/garage-13.json
+++ b/nodes/garage-13.json
@@ -1,65 +0,0 @@
 {
  "name": "garage-13",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.179"
    }
  },
  "automatic": {
    "fqdn": "garage-13",
    "os": "linux",
    "os_version": "5.15.0-1059-kvm",
    "hostname": "garage-13",
    "ipaddress": "192.168.122.27",
    "roles": [
      "base",
      "kvm_guest",
      "garage_node"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
      "kosmos_garage::firewall_apis",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
      "firewall::default"
    ],
    "platform": "ubuntu",
    "platform_version": "22.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.7.10",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.7.10/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.2.5",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.5/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[garage_node]"
  ]
 }
--- a/nodes/garage-14.json
+++ b/nodes/garage-14.json
@@ -1,65 +0,0 @@
 {
  "name": "garage-14",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.151"
    }
  },
  "automatic": {
    "fqdn": "garage-14",
    "os": "linux",
    "os_version": "5.15.0-1095-kvm",
    "hostname": "garage-14",
    "ipaddress": "192.168.122.36",
    "roles": [
      "base",
      "kvm_guest",
      "garage_node"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
      "kosmos_garage::firewall_apis",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
      "firewall::default"
    ],
    "platform": "ubuntu",
    "platform_version": "22.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.10.17",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.2.13",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[garage_node]"
  ]
 }
--- a/nodes/garage-15.json
+++ b/nodes/garage-15.json
@@ -1,65 +0,0 @@
 {
  "name": "garage-15",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.82"
    }
  },
  "automatic": {
    "fqdn": "garage-15",
    "os": "linux",
    "os_version": "5.15.0-1095-kvm",
    "hostname": "garage-15",
    "ipaddress": "192.168.122.57",
    "roles": [
      "base",
      "kvm_guest",
      "garage_node"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
      "kosmos_garage::firewall_apis",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
      "firewall::default"
    ],
    "platform": "ubuntu",
    "platform_version": "22.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.10.17",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.2.13",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[garage_node]"
  ]
 }
--- a/nodes/garage-10.json
+++ b/nodes/garage-10.json
@@ -1,17 +1,17 @@
 {
-  "name": "garage-10",
+  "name": "garage-4",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
-      "host": "10.1.1.27"
+      "host": "10.1.1.104"
    }
  },
  "automatic": {
-    "fqdn": "garage-10",
+    "fqdn": "garage-4",
    "os": "linux",
-    "os_version": "5.4.0-1090-kvm",
+    "os_version": "5.4.0-132-generic",
-    "hostname": "garage-10",
+    "hostname": "garage-4",
-    "ipaddress": "192.168.122.70",
+    "ipaddress": "192.168.122.123",
    "roles": [
      "base",
      "kvm_guest",
@@ -23,8 +23,7 @@
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
-      "kosmos_garage::firewall_rpc",
+      "kosmos_garage::firewall",
      "kosmos_garage::firewall_apis",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
@@ -39,20 +38,21 @@
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
-      "firewall::default"
+      "firewall::default",
      "chef-sugar::default"
    ],
    "platform": "ubuntu",
    "platform_version": "20.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.5.0",
+        "version": "17.10.3",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.0.0/gems/chef-17.10.3/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.1.11",
+        "version": "17.9.0",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.0.0/gems/ohai-17.9.0/lib/ohai"
      }
    }
  },
--- a/nodes/garage-11.json
+++ b/nodes/garage-11.json
@@ -1,17 +1,17 @@
 {
-  "name": "garage-11",
+  "name": "garage-5",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
-      "host": "10.1.1.165"
+      "host": "10.1.1.33"
    }
  },
  "automatic": {
-    "fqdn": "garage-11",
+    "fqdn": "garage-5",
    "os": "linux",
-    "os_version": "5.15.0-1059-kvm",
+    "os_version": "5.15.0-84-generic",
-    "hostname": "garage-11",
+    "hostname": "garage-5",
-    "ipaddress": "192.168.122.9",
+    "ipaddress": "192.168.122.55",
    "roles": [
      "base",
      "kvm_guest",
@@ -46,13 +46,13 @@
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.5.0",
+        "version": "18.3.0",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.3.0/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.1.11",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
      }
    }
  },
--- a/nodes/garage-6.json
+++ b/nodes/garage-6.json
@@ -1,17 +1,17 @@
 {
-  "name": "garage-9",
+  "name": "garage-6",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
-      "host": "10.1.1.223"
+      "host": "10.1.1.161"
    }
  },
  "automatic": {
-    "fqdn": "garage-9",
+    "fqdn": "garage-6",
    "os": "linux",
    "os_version": "5.4.0-1090-kvm",
-    "hostname": "garage-9",
+    "hostname": "garage-6",
-    "ipaddress": "192.168.122.21",
+    "ipaddress": "192.168.122.213",
    "roles": [
      "base",
      "kvm_guest",
@@ -46,13 +46,13 @@
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.5.0",
+        "version": "18.3.0",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.3.0/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.1.11",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
      }
    }
  },
--- a/nodes/gitea-2.json
+++ b/nodes/gitea-2.json
@@ -9,7 +9,7 @@
  "automatic": {
    "fqdn": "gitea-2",
    "os": "linux",
-    "os_version": "5.4.0-1123-kvm",
+    "os_version": "5.4.0-1096-kvm",
    "hostname": "gitea-2",
    "ipaddress": "192.168.122.189",
    "roles": [
@@ -32,14 +32,12 @@
      "kosmos_postgresql::hostsfile",
      "kosmos_gitea",
      "kosmos_gitea::default",
      "kosmos_gitea::backup",
      "kosmos_gitea::act_runner",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -49,9 +47,7 @@
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
-      "firewall::default",
+      "firewall::default"
      "backup::default",
      "logrotate::default"
    ],
    "platform": "ubuntu",
    "platform_version": "20.04",
--- a/nodes/mail.kosmos.org.json
+++ b/nodes/mail.kosmos.org.json
@@ -10,7 +10,7 @@
    "fqdn": "mail.kosmos.org",
    "os": "linux",
    "os_version": "5.15.0-1048-kvm",
-    "hostname": "mail.kosmos.org",
+    "hostname": "mail",
    "ipaddress": "192.168.122.131",
    "roles": [
      "base",
--- a/nodes/mastodon-3.json
+++ b/nodes/mastodon-3.json
@@ -14,7 +14,6 @@
    "ipaddress": "192.168.122.161",
    "roles": [
      "kvm_guest",
      "ldap_client",
      "garage_gateway",
      "mastodon",
      "postgresql_client"
@@ -23,7 +22,6 @@
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos-dirsrv::hostsfile",
      "kosmos_garage",
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
@@ -37,7 +35,6 @@
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -64,6 +61,8 @@
      "redisio::disable_os_default",
      "redisio::configure",
      "redisio::enable",
      "nodejs::npm",
      "nodejs::install",
      "backup::default",
      "logrotate::default"
    ],
@@ -85,7 +84,6 @@
  "run_list": [
    "recipe[kosmos-base]",
    "role[kvm_guest]",
    "role[ldap_client]",
    "role[garage_gateway]",
    "role[mastodon]"
  ]
--- a/nodes/postgres-12.json
+++ b/nodes/postgres-12.json
@@ -1,64 +0,0 @@
 {
  "name": "postgres-12",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.134"
    }
  },
  "automatic": {
    "fqdn": "postgres-12",
    "os": "linux",
    "os_version": "5.15.0-1096-kvm",
    "hostname": "postgres-12",
    "ipaddress": "192.168.122.139",
    "roles": [
      "base",
      "kvm_guest",
      "postgresql_replica"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_postgresql::hostsfile",
      "kosmos_postgresql::replica",
      "kosmos_postgresql::firewall",
      "kosmos_postgresql::management_scripts",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default"
    ],
    "platform": "ubuntu",
    "platform_version": "22.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.10.17",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.2.13",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[postgresql_replica]"
  ]
 }
--- a/nodes/postgres-11.json
+++ b/nodes/postgres-11.json
@@ -1,17 +1,16 @@
 {
-  "name": "postgres-11",
+  "name": "postgres-5",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
-      "host": "10.1.1.91"
+      "host": "10.1.1.54"
    }
  },
  "automatic": {
-    "fqdn": "postgres-11",
+    "fqdn": "postgres-5",
    "os": "linux",
-    "os_version": "5.15.0-1095-kvm",
+    "os_version": "5.4.0-153-generic",
-    "hostname": "postgres-11",
+    "hostname": "postgres-5",
-    "ipaddress": "192.168.122.142",
+    "ipaddress": "192.168.122.211",
    "roles": [
      "base",
      "kvm_guest",
@@ -22,20 +21,17 @@
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_postgresql::primary",
-      "kosmos-akkounts::pg_db",
+      "kosmos_postgresql::firewall",
      "kosmos-bitcoin::lndhub-go_pg_db",
      "kosmos-bitcoin::nbxplorer_pg_db",
      "kosmos_drone::pg_db",
      "kosmos_gitea::pg_db",
      "kosmos-mastodon::pg_db",
      "kosmos_postgresql::firewall",
      "kosmos_postgresql::management_scripts",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -47,17 +43,17 @@
      "hostname::default"
    ],
    "platform": "ubuntu",
-    "platform_version": "22.04",
+    "platform_version": "20.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.10.17",
+        "version": "18.2.7",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.2.7/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.13",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
      }
    }
  },
--- a/nodes/postgres-6.json
+++ b/nodes/postgres-6.json
@@ -1,29 +1,29 @@
 {
-  "name": "leo",
+  "name": "postgres-6",
  "normal": {
    "knife_zero": {
-      "host": "leo.kosmos.org"
+      "host": "10.1.1.196"
    }
  },
  "automatic": {
-    "fqdn": "leo",
+    "fqdn": "postgres-6",
    "os": "linux",
-    "os_version": "5.15.0-173-generic",
+    "os_version": "5.4.0-173-generic",
-    "hostname": "leo",
+    "hostname": "postgres-6",
-    "ipaddress": "5.9.81.116",
+    "ipaddress": "192.168.122.60",
    "roles": [
-      "base"
+      "base",
      "kvm_guest"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
-      "kosmos_kvm::host",
+      "kosmos_kvm::guest",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -35,22 +35,23 @@
      "hostname::default"
    ],
    "platform": "ubuntu",
-    "platform_version": "22.04",
+    "platform_version": "20.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.10.17",
+        "version": "18.4.2",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.4.2/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.13",
+        "version": "18.1.11",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
-    "recipe[kosmos_kvm::host]"
+    "role[kvm_guest]",
    "role[postgresql_replica]"
  ]
 }
--- a/nodes/rsk-testnet-6.json
+++ b/nodes/rsk-testnet-6.json
@@ -1,60 +0,0 @@
 {
  "name": "rsk-testnet-6",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.20"
    }
  },
  "automatic": {
    "fqdn": "rsk-testnet-6",
    "os": "linux",
    "os_version": "6.8.0-107-generic",
    "hostname": "rsk-testnet-6",
    "ipaddress": "192.168.122.231",
    "roles": [
      "base",
      "kvm_guest",
      "rskj_testnet"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_rsk::rskj",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
      "kosmos_rsk::firewall",
      "firewall::default"
    ],
    "platform": "ubuntu",
    "platform_version": "24.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.10.17",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.2.13",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[rskj_testnet]"
  ]
 }
--- a/nodes/strfry-1.json
+++ b/nodes/strfry-1.json
@@ -1,73 +0,0 @@
 {
  "name": "strfry-1",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.164"
    }
  },
  "automatic": {
    "fqdn": "strfry-1",
    "os": "linux",
    "os_version": "5.15.0-1060-kvm",
    "hostname": "strfry-1",
    "ipaddress": "192.168.122.54",
    "roles": [
      "base",
      "kvm_guest",
      "strfry",
      "ldap_client",
      "blossom"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos-dirsrv::hostsfile",
      "strfry",
      "strfry::default",
      "kosmos_strfry::policies",
      "kosmos_strfry::firewall",
      "kosmos_strfry::substr",
      "kosmos_blossom",
      "kosmos_blossom::default",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
      "deno::default",
      "blossom::default"
    ],
    "platform": "ubuntu",
    "platform_version": "22.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.4.12",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.4.12/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.1.11",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[strfry]",
    "role[blossom]"
  ]
 }
--- a/nodes/wiki-1.json
+++ b/nodes/wiki-1.json
@@ -8,19 +8,16 @@
  "automatic": {
    "fqdn": "wiki-1",
    "os": "linux",
-    "os_version": "5.4.0-167-generic",
+    "os_version": "5.4.0-91-generic",
    "hostname": "wiki-1",
    "ipaddress": "192.168.122.26",
    "roles": [
-      "base",
+      "kvm_guest"
      "kvm_guest",
      "ldap_client"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos-dirsrv::hostsfile",
      "kosmos-mediawiki",
      "kosmos-mediawiki::default",
      "apt::default",
@@ -28,7 +25,6 @@
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -45,6 +41,7 @@
      "php::package",
      "php::ini",
      "composer::global_configs",
      "kosmos-dirsrv::hostsfile",
      "mediawiki::default",
      "mediawiki::database",
      "kosmos-nginx::default",
@@ -67,13 +64,12 @@
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.7.10",
+        "version": "15.13.8",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.7.10/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/2.6.0/gems/chef-15.13.8/lib"
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.5",
+        "version": "15.12.0",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.5/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/2.6.0/gems/ohai-15.12.0/lib/ohai"
      }
    }
  },
--- a/roles/blossom.rb
+++ b/roles/blossom.rb
@@ -1,15 +0,0 @@
 name "blossom"
 override_attributes(
  "blossom" => {
    "allowed_pubkeys" => [
      "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf",
      "1f79058c77a224e5be226c8f024cacdad4d741855d75ed9f11473ba8eb86e1cb",
      "07e188a1ff87ce171d517b8ed2bb7a31b1d3453a0db3b15379ec07b724d232f3"
    ]
  },
 )
 run_list %w(
  kosmos_blossom::default
 )
--- a/roles/gitea.rb
+++ b/roles/gitea.rb
@@ -3,13 +3,4 @@ name "gitea"
 run_list %w(
  role[postgresql_client]
  kosmos_gitea::default
  kosmos_gitea::backup
 )
 override_attributes(
  "gitea" => {
    # "repo" => "https://github.com/67P/gitea.git",
    # "revision" => "ldap_sync",
    "log" => { "level" => "Info" }
  },
 )
--- a/roles/lnd.rb
+++ b/roles/lnd.rb
@@ -3,6 +3,7 @@ name "lnd"
 run_list %w(
  kosmos-bitcoin::lnd
  kosmos-bitcoin::lnd-scb-s3
  kosmos-bitcoin::boltz
  kosmos-bitcoin::rtl
  kosmos-bitcoin::peerswap-lnd
 )
--- a/roles/openresty_proxy.rb
+++ b/roles/openresty_proxy.rb
@@ -19,7 +19,6 @@ production_run_list = %w(
  role[openresty]
  role[garage_gateway]
  kosmos_assets::nginx_site
  kosmos_blossom::nginx
  kosmos_discourse::nginx
  kosmos_drone::nginx
  kosmos_garage::nginx_web
@@ -29,9 +28,7 @@ production_run_list = %w(
  kosmos_liquor-cabinet::nginx
  kosmos_rsk::nginx_testnet
  kosmos_rsk::nginx_mainnet
  kosmos_strfry::nginx
  kosmos_website::default
  kosmos_website::redirects
  kosmos-akkounts::nginx
  kosmos-akkounts::nginx_api
  kosmos-bitcoin::nginx_lndhub
--- a/roles/postgresql_primary.rb
+++ b/roles/postgresql_primary.rb
@@ -1,13 +1,11 @@
 name "postgresql_primary"
-run_list [
+run_list %w(
-  "kosmos_postgresql::primary",
+  kosmos_postgresql::primary
-  "kosmos-akkounts::pg_db",
+  kosmos_postgresql::firewall
-  "kosmos-bitcoin::lndhub-go_pg_db",
+  kosmos-bitcoin::lndhub-go_pg_db
-  "kosmos-bitcoin::nbxplorer_pg_db",
+  kosmos-bitcoin::nbxplorer_pg_db
-  "kosmos_drone::pg_db",
+  kosmos_drone::pg_db
-  "kosmos_gitea::pg_db",
+  kosmos_gitea::pg_db
-  "kosmos-mastodon::pg_db",
+  kosmos-mastodon::pg_db
-  "kosmos_postgresql::firewall",
+)
  "kosmos_postgresql::management_scripts"
 ]
--- a/roles/postgresql_replica.rb
+++ b/roles/postgresql_replica.rb
@@ -1,8 +1,7 @@
 name "postgresql_replica"
-run_list [
+run_list %w(
-  "kosmos_postgresql::hostsfile",
+  kosmos_postgresql::hostsfile
-  "kosmos_postgresql::replica",
+  kosmos_postgresql::replica
-  "kosmos_postgresql::firewall",
+  kosmos_postgresql::firewall
-  "kosmos_postgresql::management_scripts"
+)
 ]
--- a/roles/postgresql_replica_logical.rb
+++ b/roles/postgresql_replica_logical.rb
@@ -1,8 +0,0 @@
 name "postgresql_replica_logical"
 run_list [
  "kosmos_postgresql::hostsfile",
  "kosmos_postgresql::replica_logical",
  "kosmos_postgresql::firewall",
  "kosmos_postgresql::management_scripts"
 ]
--- a/roles/strfry.rb
+++ b/roles/strfry.rb
@@ -1,9 +0,0 @@
 name "strfry"
 run_list %w(
  role[ldap_client]
  strfry::default
  kosmos_strfry::policies
  kosmos_strfry::firewall
  kosmos_strfry::substr
 )
--- a/site-cookbooks/backup/attributes/default.rb
+++ b/site-cookbooks/backup/attributes/default.rb
@@ -42,5 +42,5 @@ default['backup']['orbit']['keep'] = 10
 default['backup']['cron']['hour'] = "05"
 default['backup']['cron']['minute'] = "7"
-default['backup']['s3']['keep'] = 10
+default['backup']['s3']['keep'] = 15
-default['backup']['s3']['bucket'] = "kosmos-backups"
+default['backup']['s3']['bucket'] = "kosmos-dev-backups"
--- a/site-cookbooks/backup/recipes/default.rb
+++ b/site-cookbooks/backup/recipes/default.rb
@@ -28,7 +28,6 @@ template "#{backup_dir}/config.rb" do
  sensitive true
  variables s3_access_key_id: backup_data["s3_access_key_id"],
            s3_secret_access_key: backup_data["s3_secret_access_key"],
            s3_endpoint: backup_data["s3_endpoint"],
            s3_region: backup_data["s3_region"],
            encryption_password: backup_data["encryption_password"],
            mail_from: "backups@kosmos.org",
--- a/site-cookbooks/backup/templates/default/config.rb.erb
+++ b/site-cookbooks/backup/templates/default/config.rb.erb
@@ -23,10 +23,6 @@ Storage::S3.defaults do |s3|
  s3.secret_access_key = "<%= @s3_secret_access_key %>"
  s3.region            = "<%= @s3_region %>"
  s3.bucket            = "<%= node['backup']['s3']['bucket'] %>"
  s3.fog_options       = {
    endpoint: "<%= @s3_endpoint %>",
    aws_signature_version: 2
  }
 end
 Encryptor::OpenSSL.defaults do |encryption|
@@ -92,6 +88,7 @@ end
 preconfigure 'KosmosBackup' do
  split_into_chunks_of 250 # megabytes
  store_with S3
  compress_with Bzip2
  encrypt_with OpenSSL
  notify_by Mail do |mail|
--- a/site-cookbooks/blossom
+++ b/site-cookbooks/blossom
--- a/site-cookbooks/deno
+++ b/site-cookbooks/deno
--- a/site-cookbooks/discourse/templates/nginx_conf.erb
+++ b/site-cookbooks/discourse/templates/nginx_conf.erb
@@ -8,8 +8,8 @@ upstream _<%= @upstream_name %> {
 <% if File.exist?(@ssl_cert) && File.exist?(@ssl_key) -%>
 server {
  server_name <%= @server_name %>;
-  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
+  listen 443 ssl http2;
-  listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
+  listen [::]:443 ssl http2;
  ssl_certificate     <%= @ssl_cert %>;
  ssl_certificate_key <%= @ssl_key %>;
--- a/site-cookbooks/kosmos-akkounts/attributes/default.rb
+++ b/site-cookbooks/kosmos-akkounts/attributes/default.rb
@@ -1,5 +1,5 @@
 node.default['akkounts']['repo'] = 'https://gitea.kosmos.org/kosmos/akkounts.git'
-node.default['akkounts']['revision'] = 'live'
+node.default['akkounts']['revision'] = 'master'
 node.default['akkounts']['port'] = 3000
 node.default['akkounts']['domain'] = 'accounts.kosmos.org'
 node.default['akkounts']['primary_domain'] = 'kosmos.org'
@@ -11,7 +11,6 @@ node.default['akkounts']['smtp']['domain']          = 'kosmos.org'
 node.default['akkounts']['smtp']['auth_method']     = 'plain'
 node.default['akkounts']['smtp']['enable_starttls'] = 'auto'
 node.default['akkounts']['btcpay']['public_url'] = nil
 node.default['akkounts']['btcpay']['store_id'] = nil
 node.default['akkounts']['ejabberd']['admin_url'] = nil
@@ -21,9 +20,6 @@ node.default['akkounts']['lndhub']['public_url'] = nil
 node.default['akkounts']['lndhub']['public_key'] = nil
 node.default['akkounts']['lndhub']['postgres_db'] = 'lndhub'
 node.default['akkounts']['nostr']['public_key'] = nil
 node.default['akkounts']['nostr']['relay_url'] = nil
 node.default['akkounts']['s3_enabled'] = true
 node.default['akkounts']['s3_endpoint'] = "https://s3.kosmos.org"
 node.default['akkounts']['s3_region'] = "garage"
--- a/site-cookbooks/kosmos-akkounts/recipes/default.rb
+++ b/site-cookbooks/kosmos-akkounts/recipes/default.rb
@@ -24,12 +24,13 @@ package "libvips"
 include_recipe 'redisio::default'
 include_recipe 'redisio::enable'
 node.override["nodejs"]["repo"] = "https://deb.nodesource.com/node_20.x"
 include_recipe 'kosmos-nodejs'
 npm_package "bun"
-ruby_version = "3.3.8"
+npm_package "yarn" do
  version "1.22.4"
 end
 ruby_version = "3.3.0"
 ruby_path = "/opt/ruby_build/builds/#{ruby_version}"
 bundle_path = "#{ruby_path}/bin/bundle"
 rails_env = node.chef_environment == "development" ? "development" : "production"
@@ -47,28 +48,7 @@ webhooks_allowed_ips = [lndhub_host].compact.uniq.join(',')
 env = {
  primary_domain: node['akkounts']['primary_domain'],
  akkounts_domain: node['akkounts']['domain'],
-  rails_serve_static_files: true,
+  rails_serve_static_files: true
  secret_key_base: credentials["rails_secret_key_base"],
  encryption_primary_key: credentials["rails_encryption_primary_key"],
  encryption_key_derivation_salt: credentials["rails_encryption_key_derivation_salt"],
  db_adapter: "postgresql",
  pg_host: "pg.kosmos.local",
  pg_port: 5432,
  pg_database: "akkounts",
  pg_database_queue: "akkounts_queue",
  pg_username: credentials["postgresql"]["username"],
  pg_password: credentials["postgresql"]["password"]
 }
 env[:ldap] = {
  host: "ldap.kosmos.local",
  port: 389,
  use_tls: false,
  uid_attr: "cn",
  base: "ou=kosmos.org,cn=users,dc=kosmos,dc=org",
  admin_user: credentials["ldap"]["admin_user"],
  admin_password: credentials["ldap"]["admin_password"],
  suffix: "dc=kosmos,dc=org"
 }
 smtp_server, smtp_port = smtp_credentials[:relayhost].split(":")
@@ -95,7 +75,6 @@ end
 if btcpay_host
  env[:btcpay_api_url] = "http://#{btcpay_host}:23001/api/v1"
  env[:btcpay_public_url] = node['akkounts']['btcpay']['public_url']
  env[:btcpay_store_id] = node['akkounts']['btcpay']['store_id']
  env[:btcpay_auth_token] = credentials["btcpay_auth_token"]
 end
@@ -158,9 +137,9 @@ if lndhub_host
  if postgres_readonly_host
    env[:lndhub_admin_ui] = true
    env[:lndhub_pg_host] = postgres_readonly_host
-    env[:lndhub_pg_database] = node["akkounts"]["lndhub"]["postgres_db"]
+    env[:lndhub_pg_database] = node['akkounts']['lndhub']['postgres_db']
-    env[:lndhub_pg_username] = credentials["postgresql"]["username"]
+    env[:lndhub_pg_username] = credentials['postgresql_username']
-    env[:lndhub_pg_password] = credentials["postgresql"]["password"]
+    env[:lndhub_pg_password] = credentials['postgresql_password']
  end
 end
@@ -169,7 +148,6 @@ end
 #
 env[:mastodon_public_url] = "https://#{node['kosmos-mastodon']['domain']}"
 env[:mastodon_address_domain] = node['kosmos-mastodon']['user_address_domain']
 #
 # MediaWiki
@@ -177,14 +155,6 @@ env[:mastodon_address_domain] = node['kosmos-mastodon']['user_address_domain']
 env[:mediawiki_public_url] = node['mediawiki']['url']
 #
 # Nostr
 #
 env[:nostr_private_key] = credentials['nostr_private_key']
 env[:nostr_public_key] = node['akkounts']['nostr']['public_key']
 env[:nostr_relay_url] = node['akkounts']['nostr']['relay_url']
 #
 # remoteStorage / Liquor Cabinet
 #
@@ -228,8 +198,9 @@ systemd_unit "akkounts.service" do
      Type: "simple",
      User: deploy_user,
      WorkingDirectory: deploy_path,
-      Environment: "RAILS_ENV=#{rails_env} SOLID_QUEUE_IN_PUMA=true",
+      Environment: "RAILS_ENV=#{rails_env}",
      ExecStart: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid",
      ExecStop: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid stop",
      ExecReload: "#{bundle_path} exec pumactl -F config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid phased-restart",
      PIDFile: "#{deploy_path}/tmp/puma.pid",
      TimeoutSec: "10",
@@ -244,6 +215,36 @@ systemd_unit "akkounts.service" do
  action [:create, :enable]
 end
 systemd_unit "akkounts-sidekiq.service" do
  content({
    Unit: {
      Description: "Kosmos Accounts async/background jobs",
      Documentation: ["https://gitea.kosmos.org/kosmos/akkounts"],
      Requires: "redis@6379.service",
      After: "syslog.target network.target redis@6379.service"
    },
    Service: {
      Type: "notify",
      User: deploy_user,
      WorkingDirectory: deploy_path,
      Environment: "MALLOC_ARENA_MAX=2",
      ExecStart: "#{bundle_path} exec sidekiq -C #{deploy_path}/config/sidekiq.yml -e #{rails_env}",
      WatchdogSec: "10",
      Restart: "on-failure",
      RestartSec: "1",
      StandardOutput: "syslog",
      StandardError: "syslog",
      SyslogIdentifier: "sidekiq"
    },
    Install: {
      WantedBy: "multi-user.target"
    }
  })
  verify false
  triggers_reload true
  action [:create, :enable]
 end
 deploy_env = {
  "HOME" => deploy_path,
  "PATH" => "#{ruby_path}/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin",
@@ -256,7 +257,15 @@ git deploy_path do
  revision node[app_name]["revision"]
  user  deploy_user
  group deploy_group
  # Restart services on deployments
  notifies :run, "execute[restart #{app_name} services]", :delayed
 end
 execute "restart #{app_name} services" do
  command "true"
  action :nothing
  notifies :restart, "service[#{app_name}]", :delayed
  notifies :restart, "service[#{app_name}-sidekiq]", :delayed
 end
 file "#{deploy_path}/config/master.key" do
@@ -264,7 +273,7 @@ file "#{deploy_path}/config/master.key" do
  mode '0400'
  owner deploy_user
  group deploy_group
-  notifies :restart, "service[#{app_name}]", :delayed
+  notifies :run, "execute[restart #{app_name} services]", :delayed
 end
 template "#{deploy_path}/.env.#{rails_env}" do
@@ -274,7 +283,7 @@ template "#{deploy_path}/.env.#{rails_env}" do
  mode 0600
  sensitive true
  variables config: env
-  notifies :restart, "service[#{app_name}]", :delayed
+  notifies :run, "execute[restart #{app_name} services]", :delayed
 end
 execute "bundle install" do
@@ -284,6 +293,13 @@ execute "bundle install" do
  command "bundle install --without development,test --deployment"
 end
 execute "yarn install" do
  environment deploy_env
  user deploy_user
  cwd deploy_path
  command "yarn install --pure-lockfile"
 end
 execute 'rake db:migrate' do
  environment deploy_env
  user deploy_user
@@ -304,6 +320,10 @@ service "akkounts" do
  action [:enable, :start]
 end
 service "akkounts-sidekiq" do
  action [:enable, :start]
 end
 firewall_rule "akkounts_zerotier" do
  command  :allow
  port     node["akkounts"]["port"]
--- a/site-cookbooks/kosmos-akkounts/recipes/pg_db.rb
+++ b/site-cookbooks/kosmos-akkounts/recipes/pg_db.rb
@@ -1,22 +0,0 @@
 #
 # Cookbook:: kosmos-akkounts
 # Recipe:: pg_db
 #
 credentials = data_bag_item("credentials", "akkounts")
 pg_username = credentials["postgresql"]["username"]
 pg_password = credentials["postgresql"]["password"]
 postgresql_user pg_username do
  action :create
  password pg_password
 end
 databases = ["akkounts", "akkounts_queue"]
 databases.each do |database|
  postgresql_database database do
    owner pg_username
    action :create
  end
 end
--- a/site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts.erb
+++ b/site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts.erb
@@ -11,13 +11,9 @@ proxy_cache_path <%= node[:openresty][:cache_dir] %>/akkounts levels=1:2
 server {
  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
-  listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
+  listen [::]:443 ssl http2;
  server_name <%= @domain %>;
  if ($host != $server_name) {
    return 301 $scheme://$server_name$request_uri;
  }
  ssl_certificate     <%= @ssl_cert %>;
  ssl_certificate_key <%= @ssl_key %>;
@@ -43,9 +39,6 @@ server {
  location @proxy {
    proxy_set_header Host $http_host;
    set $x_forwarded_host $http_x_forwarded_host;
    if ($x_forwarded_host = "") { set $x_forwarded_host $host; }
    proxy_set_header X-Forwarded-Host $x_forwarded_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
--- a/site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts_api.erb
+++ b/site-cookbooks/kosmos-akkounts/templates/nginx_conf_akkounts_api.erb
@@ -7,7 +7,7 @@ upstream _akkounts_api {
 server {
  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
-  listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
+  listen [::]:443 ssl http2;
  server_name <%= @domain %>;
  ssl_certificate     <%= @ssl_cert %>;
--- a/site-cookbooks/kosmos-base/attributes/default.rb
+++ b/site-cookbooks/kosmos-base/attributes/default.rb
@@ -1,2 +0,0 @@
 node.default["kosmos-base"]["journald"]["system_max_use"] = "256M"
 node.default["kosmos-base"]["journald"]["max_retention_sec"] = "7d"
--- a/site-cookbooks/kosmos-base/recipes/andromeda_firewall.rb
+++ b/site-cookbooks/kosmos-base/recipes/andromeda_firewall.rb
@@ -0,0 +1,52 @@
 #
 # Cookbook Name:: kosmos-base
 # Recipe:: andromeda_firewall
 #
 # The MIT License (MIT)
 #
 # Copyright:: 2019, Kosmos Developers
 #
 # Permission is hereby granted, free of charge, to any person obtaining a copy
 # of this software and associated documentation files (the "Software"), to deal
 # in the Software without restriction, including without limitation the rights
 # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 # copies of the Software, and to permit persons to whom the Software is
 # furnished to do so, subject to the following conditions:
 #
 # The above copyright notice and this permission notice shall be included in
 # all copies or substantial portions of the Software.
 #
 # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 # THE SOFTWARE.
 # Temporary extra rules for Andromeda
 firewall_rule 'bitcoind' do
  port     [8333, 8334, 8335]
  protocol :tcp
  command  :allow
 end
 firewall_rule 'lnd' do
  port     [9736]
  # port     [9736, 8002]
  protocol :tcp
  command  :allow
 end
 firewall_rule 'lightningd' do
  port     [9735]
  protocol :tcp
  command  :allow
 end
 firewall_rule 'spark_wallet' do
  port     8008
  protocol :tcp
  command  :allow
 end
--- a/site-cookbooks/kosmos-base/recipes/default.rb
+++ b/site-cookbooks/kosmos-base/recipes/default.rb
@@ -24,82 +24,68 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 # THE SOFTWARE.
-include_recipe "apt"
+include_recipe 'apt'
 include_recipe 'timezone_iii'
 include_recipe 'ntp'
 include_recipe 'kosmos-base::systemd_emails'
 directory "/etc/apt/keyrings" do
  mode "0755"
  action :create
 end
 include_recipe "timezone_iii"
 include_recipe "ntp" if node["platform"] == "ubuntu" && node["platform_version"].to_f < 24.04
 include_recipe "kosmos-base::journald_conf"
 include_recipe "kosmos-base::systemd_emails"
 node.override["apt"]["unattended_upgrades"]["enable"] = true
 node.override["apt"]["unattended_upgrades"]["mail_only_on_error"] = false
 node.override["apt"]["unattended_upgrades"]["sender"] = "ops@kosmos.org"
 node.override["apt"]["unattended_upgrades"]["allowed_origins"] = [
  "${distro_id}:${distro_codename}-security",
-  "${distro_id}:${distro_codename}-updates",
+  "${distro_id}:${distro_codename}-updates"
  "${distro_id}ESMApps:${distro_codename}-apps-security",
  "${distro_id}ESMApps:${distro_codename}-apps-updates",
  "${distro_id}ESM:${distro_codename}-infra-security",
  "${distro_id}ESM:${distro_codename}-infra-updates"
 ]
 node.override["apt"]["unattended_upgrades"]["mail"] = "ops@kosmos.org"
 node.override["apt"]["unattended_upgrades"]["syslog_enable"] = true
-include_recipe "apt::unattended-upgrades"
+include_recipe 'apt::unattended-upgrades'
-package "mailutils"
+package 'mailutils'
-package "mosh"
+package 'mosh'
-package "vim"
+package 'vim'
 # Don't create users and rewrite the sudo config in development environment.
 # It breaks the vagrant user
 unless node.chef_environment == "development"
  # Searches data bag "users" for groups attribute "sysadmin".
  # Places returned users in Unix group "sysadmin" with GID 2300.
-  users_manage "sysadmin" do
+  users_manage 'sysadmin' do
    group_id 2300
-    action %i[remove create]
+    action [:remove, :create]
  end
  sudo "sysadmin" do
    groups "sysadmin"
    nopasswd true
    defaults [
-      # not default on Ubuntu, explicitely enable. Uses a minimal white list of
+    # not default on Ubuntu, explicitely enable. Uses a minimal white list of
-      # environment variables
+    # environment variables
-      "env_reset",
+    'env_reset',
-      # Send emails on unauthorized attempts
+    # Send emails on unauthorized attempts
-      "mail_badpass",
+    'mail_badpass',
-      'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"'
+    'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"',
    ]
  end
  include_recipe "kosmos-base::firewall"
-  include_recipe "kosmos-postfix"
+  include_recipe 'kosmos-postfix'
-  node.override["set_fqdn"] = "*"
+  node.override['set_fqdn'] = '*'
-  include_recipe "hostname"
+  include_recipe 'hostname'
-  package "ca-certificates"
+  package 'ca-certificates'
-  directory "/usr/local/share/ca-certificates/cacert" do
+  directory '/usr/local/share/ca-certificates/cacert' do
    action :create
  end
-  ["http://www.cacert.org/certs/root.crt", "http://www.cacert.org/certs/class3.crt"].each do |cert|
+  ['http://www.cacert.org/certs/root.crt', 'http://www.cacert.org/certs/class3.crt'].each do |cert|
    remote_file "/usr/local/share/ca-certificates/cacert/#{File.basename(cert)}" do
      source cert
      action :create_if_missing
-      notifies :run, "execute[update-ca-certificates]", :immediately
+      notifies :run, 'execute[update-ca-certificates]', :immediately
    end
  end
-  execute "update-ca-certificates" do
+  execute 'update-ca-certificates' do
    action :nothing
  end
 end
--- a/Show More
+++ b/Show More
		`@@ -1,2 +0,0 @@`
			`node.default["kosmos-base"]["journald"]["system_max_use"] = "256M"`
			`node.default["kosmos-base"]["journald"]["max_retention_sec"] = "7d"`