Merge pull request 'Slow down Gitea 404s to mess with scrapers/bots' (#626) from chore/gitea_scraping into master

Reviewed-on: #626
Reviewed-by: Greg <greg@kosmos.org>

AGENTS.md

@@ -0,0 +1,41 @@
+# AGENTS.md
+
+Welcome, AI Agent! This file contains essential context and rules for interacting with the Kosmos Chef repository. Read this carefully before planning or executing any changes.
+
+## 🏢 Project Overview
+This repository contains the infrastructure automation code used by Kosmos to provision and configure bare metal servers (KVM hosts) and Ubuntu virtual machines (KVM guests). 
+
+We use **Chef Infra**, managed locally via **Knife Zero** (agentless Chef), and **Berkshelf** for dependency management.
+
+## 📂 Directory Structure & Rules
+
+* **`site-cookbooks/`**: 🟢 **EDITABLE.** This directory contains all custom, internal cookbooks written specifically for Kosmos services (e.g., `kosmos-postgresql`, `kosmos_gitea`, `kosmos-mastodon`). *Active development happens here.*
+* **`cookbooks/`**: 🔴 **DO NOT EDIT.** This directory contains third-party/community cookbooks that are vendored. These are managed by Berkshelf. Modifying them directly will result in lost changes.
+* **`roles/`**: 🟢 **EDITABLE.** Contains Chef roles written in Ruby (e.g., `base.rb`, `kvm_guest.rb`, `postgresql_primary.rb`). These define run-lists and role-specific default attributes for servers.
+* **`environments/`**: Contains Chef environment definitions (like `production.rb`).
+* **`data_bags/`**: Contains data bag configurations, often encrypted. Be cautious and do not expose secrets. (Note: Agents should not manage data bag secrets directly unless provided the `.chef/encrypted_data_bag_secret`).
+* **`nodes/`**: Contains JSON state files for bootstrapped nodes. *Agents typically do not edit these directly unless cleaning up a deleted node.*
+* **`Berksfile`**: Defines community cookbook dependencies.
+* **`Vagrantfile` / `.kitchen/`**: Used for local virtualization and integration testing.
+
+## 🛠️ Tooling & Workflows
+
+1. **Dependency Management (Berkshelf)**
+   If a new community cookbook is required:
+   - Add it to the `Berksfile` at the root.
+   - Instruct the user to run `berks install` and `berks vendor cookbooks/ --delete` (or run it via the `bash` tool if permitted).
+
+2. **Provisioning (Knife Zero)**
+   - Bootstrapping and converging nodes is done using `knife zero`. 
+   - *Example:* `knife zero converge name:server-name.kosmos.org`
+
+3. **Code Style & Conventions**
+   - Chef recipes, resources, and roles are written in **Ruby**. 
+   - Follow standard Chef and Ruby (RuboCop) idioms. Look at neighboring files in `site-cookbooks/` or `roles/` to match formatting and naming conventions.
+
+## 🚨 Core Directives for AI Agents
+
+1. **Infrastructure as Code**: Manual server configurations are highly discouraged. All changes must be codified in a cookbook or role.
+2. **Test Safety Nets**: Look for `.kitchen.yml` within specific `site-cookbooks/<name>` to understand if local integration tests are available.
+3. **No Assumptions**: Do not assume standard test commands. Check `README.md` and repository config files first.
+4. **Secret Handling**: Avoid hardcoding passwords or API keys in recipes or roles. Assume sensitive information is managed via Chef `data_bags`.

Berksfile

@@ -24,7 +24,6 @@ cookbook 'composer',               '~> 2.7.0'
 cookbook 'fail2ban',               '~> 7.0.4'
 cookbook 'git',                    '~> 10.0.0'
 cookbook 'golang',                 '~> 5.3.1'
-cookbook 'homebrew',               '>= 6.0.0'
 cookbook 'hostname',               '= 0.4.2'
 cookbook 'hostsfile',              '~> 3.0.1'
 cookbook 'java',                   '~> 4.3.0'

Berksfile.lock

@@ -8,7 +8,6 @@ DEPENDENCIES
   firewall (~> 6.2.16)
   git (~> 10.0.0)
   golang (~> 5.3.1)
-  homebrew (>= 6.0.0)
   hostname (= 0.4.2)
   hostsfile (~> 3.0.1)
   ipfs
@@ -63,7 +62,7 @@ GRAPH
   git (10.0.0)
   golang (5.3.1)
     ark (>= 6.0)
-  homebrew (6.0.2)
+  homebrew (5.4.1)
   hostname (0.4.2)
     hostsfile (>= 0.0.0)
   hostsfile (3.0.1)

clients/postgres-11.json

@@ -1,4 +0,0 @@
-{
-  "name": "postgres-11",
-  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1foYpuubS2ovlg3uHO12\nQ/ROZ8MpG+LkCAM46uVfPaoWwfY0vdfMsBOanHDgm9DGUCEBJZ6LPrvCvGXbpPy6\n9GSswK75zVWODblNjvvV4ueGFq4bBFwRuZNjyMlqgyzeU+srZL0ivelu5XEuGuoD\nPYCBKWYqGMz85/eMC7/tinTJtKPyOtXe/G8meji+r7gh3j+ypj/EWeKfcRDa4aGe\n/DmMCurIjjPAXFLMAA6fIqPWVfcPw4APNPE60Z92yPGsTbPu7bL54M5f7udmmu7H\nOgk1HjMAmXCuLDzTkfaxqHP+57yELg/YpXR1E93VmBeQuIBsyOFEk6AmUmA1Ib6e\nnQIDAQAB\n-----END PUBLIC KEY-----\n"
-}

clients/postgres-12.json

@@ -1,4 +0,0 @@
-{
-  "name": "postgres-12",
-  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1mYGrYB8keUKmXA8dhWc\ncCLzp50xR0ajSw+bWYydyRqD5wuEVKjiJu4+G9QmTVXkVgJ+AYI0Y9/WZYpDqVH6\nvLUo6BSNQaWx20q93qIdOGLy8YG3Qyznezk4l8T9u9vWZDyDpKw6gCxzikMkrXxb\n0cqOYtyud8+PtSEEMogSjOKhRURVHlVrlVH3SQO7Whke9rkiFcbXzubsK9yjkUtF\nxZafSoGorOlDsPvFTfYnkepVB+GHcgiribRYSrO+73GypC2kqMhCpWrb6a0VWsP/\nh53+q3JL3vBvdvjcv51Wpf4n6JdnXnQGn2/MdXEzw+NXgjU4/IdYtbORSbaI8F5t\nowIDAQAB\n-----END PUBLIC KEY-----\n"
-}

cookbooks/homebrew/.markdownlint-cli2.yaml

@@ -3,5 +3,3 @@ config:
   line-length: false # MD013
   no-duplicate-heading: false # MD024
   reference-links-images: false # MD052
-ignores:
-  - .github/copilot-instructions.md

cookbooks/homebrew/CHANGELOG.md

@@ -2,48 +2,6 @@
 
 This file is used to list changes made in each version of the homebrew cookbook.
 
-## 6.0.2 - *2025-09-04*
-
-Standardise files with files in sous-chefs/repo-management
-
-Standardise files with files in sous-chefs/repo-management
-
-## 6.0.1 - *2025-03-24*
-
-## 6.0.0 - *2025-03-17*
-
-- Updated library call for new homebrew class name found in chef-client 18.6.2+ releases
-
-## 5.4.9 - *2024-11-18*
-
-Standardise files with files in sous-chefs/repo-management
-
-Standardise files with files in sous-chefs/repo-management
-
-Standardise files with files in sous-chefs/repo-management
-
-Standardise files with files in sous-chefs/repo-management
-
-Standardise files with files in sous-chefs/repo-management
-
-## 5.4.8 - *2024-05-07*
-
-## 5.4.7 - *2024-05-06*
-
-- Explicitly include `Which` module from `Chef` which fixes runs on 18.x clients.
-
-## 5.4.6 - *2024-05-06*
-
-## 5.4.5 - *2023-11-01*
-
-Standardise files with files in sous-chefs/repo-management
-
-## 5.4.4 - *2023-09-28*
-
-## 5.4.3 - *2023-09-04*
-
-## 5.4.2 - *2023-07-10*
-
 ## 5.4.1 - *2023-06-01*
 
 ## 5.4.0 - *2023-04-24*

cookbooks/homebrew/libraries/helpers.rb

@@ -20,9 +20,8 @@
 #
 
 class HomebrewUserWrapper
-  require 'chef/mixin/homebrew'
-  include Chef::Mixin::Homebrew
-  include Chef::Mixin::Which
+  require 'chef/mixin/homebrew_user'
+  include Chef::Mixin::HomebrewUser
 end
 
 module Homebrew
@@ -60,17 +59,41 @@ module Homebrew
 
   def owner
     @owner ||= begin
-                 HomebrewUserWrapper.new.find_homebrew_username
-               rescue
-                 Chef::Exceptions::CannotDetermineHomebrewPath
+      # once we only support 14.0 we can switch this to find_homebrew_username
+      require 'etc'
+      ::Etc.getpwuid(HomebrewUserWrapper.new.find_homebrew_uid).name
+               rescue Chef::Exceptions::CannotDetermineHomebrewOwner
+                 calculate_owner
     end.tap do |owner|
       Chef::Log.debug("Homebrew owner is #{owner}")
     end
   end
+
+  private
+
+  def calculate_owner
+    owner = homebrew_owner_attr || sudo_user || current_user
+    if owner == 'root'
+      raise Chef::Exceptions::User,
+           "Homebrew owner is 'root' which is not supported. " \
+           "To set an explicit owner, please set node['homebrew']['owner']."
+    end
+    owner
+  end
+
+  def homebrew_owner_attr
+    Chef.node['homebrew']['owner']
+  end
+
+  def sudo_user
+    ENV['SUDO_USER']
+  end
+
+  def current_user
+    ENV['USER']
+  end
 end unless defined?(Homebrew)
 
 class HomebrewWrapper
   include Homebrew
 end
-
-Chef::Mixin::Homebrew.include(Homebrew)

cookbooks/homebrew/metadata.json

@@ -17,13 +17,13 @@
   "recipes": {
 
   },
-  "version": "6.0.2",
+  "version": "5.4.1",
   "source_url": "https://github.com/sous-chefs/homebrew",
   "issues_url": "https://github.com/sous-chefs/homebrew/issues",
   "privacy": false,
   "chef_versions": [
     [
-      ">= 18.6.2"
+      ">= 15.3"
     ]
   ],
   "ohai_versions": [

cookbooks/homebrew/metadata.rb

@@ -3,9 +3,9 @@ maintainer       'Sous Chefs'
 maintainer_email 'help@sous-chefs.org'
 license          'Apache-2.0'
 description      'Install Homebrew and includes resources for working with taps and casks'
-version          '6.0.2'
+version          '5.4.1'
 supports         'mac_os_x'
 
 source_url 'https://github.com/sous-chefs/homebrew'
 issues_url 'https://github.com/sous-chefs/homebrew/issues'
-chef_version '>= 18.6.2'
+chef_version '>= 15.3'

cookbooks/homebrew/renovate.json

@@ -1,10 +1,9 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:base"],
-  "packageRules": [
-    {
+  "packageRules": [{
       "groupName": "Actions",
-      "matchUpdateTypes": ["minor", "patch", "pin"],
+      "matchUpdateTypes": ["patch", "pin", "digest"],
       "automerge": true,
       "addLabels": ["Release: Patch", "Skip: Announcements"]
     },

cookbooks/homebrew/resources/cask.rb

@@ -19,7 +19,6 @@
 # limitations under the License.
 #
 
-unified_mode true
 chef_version_for_provides '< 14.0' if respond_to?(:chef_version_for_provides)
 
 property :cask_name, String, regex: %r{^[\w/-]+$}, name_property: true

cookbooks/homebrew/resources/tap.rb

@@ -19,7 +19,6 @@
 # limitations under the License.
 #
 
-unified_mode true
 chef_version_for_provides '< 14.0' if respond_to?(:chef_version_for_provides)
 
 property :tap_name, String, name_property: true, regex: %r{^[\w-]+(?:\/[\w-]+)+$}

doc/postgres/migration.md

@@ -1,287 +0,0 @@
-# Migrating PostgreSQL cluster to a new major version
-
-## Summary
-
-1. Dump from a replica
-2. Restore to fresh VM running new major version
-3. Add logical replication for delta sync from current/old primary
-4. Switch primary to new server
-5. Remove logical replication on new server
-
-## Runbook
-
-* Primary host: `PRIMARY_HOST`
-* Replica host: `REPLICA_HOST`
-* New PG14 host: `NEW_HOST`
-* PostgreSQL superuser: `postgres`
-* Running locally on each machine via `sudo -u postgres`
-
-Adjust hostnames/IPs/etc. where needed.
-
----
-
-### 🟢 0. PRIMARY — Pre-checks
-
-```bash
-sudo -u postgres psql -c "SHOW wal_level;"
-sudo -u postgres psql -c "SHOW max_replication_slots;"
-```
-
-If needed, edit config:
-
-```bash
-sudo -u postgres vi $PGDATA/postgresql.conf
-```
-
-Ensure:
-
-```conf
-wal_level = logical
-max_replication_slots = 10
-```
-
-Restart if changed:
-
-```bash
-sudo systemctl restart postgresql
-```
-
----
-
-### 🔵🟡 3. Create keypair for syncing dump later
-
-🔵 On NEW_HOST:
-
-```bash
-sudo mkdir -p /home/postgres/.ssh && \
-sudo chown -R postgres:postgres /home/postgres && \
-sudo chmod 700 /home/postgres/.ssh && \
-sudo -u postgres bash -c 'ssh-keygen -t ecdsa -b 256 -f /home/postgres/.ssh/id_ecdsa -N "" -C "postgres@$(hostname)"' && \
-sudo cat /home/postgres/.ssh/id_ecdsa.pub
-```
-
-Copy the public key from the above output
-
-🟡 On replica:
-
-```bash
-sudo mkdir -p /home/postgres/.ssh && \
-sudo chown -R postgres:postgres /home/postgres && \
-sudo chmod 700 /home/postgres/.ssh && \
-echo [public_key] | sudo tee /home/postgres/.ssh/authorized_keys > /dev/null && \
-sudo chmod 700 /home/postgres/.ssh
-```
-
----
-
-### 🟢 1. PRIMARY — Create publication and replication slots
-
-```bash
-sudo -u postgres pg_create_replication_publications
-```
-
-or
-
-```bash
-sudo -u postgres pg_create_replication_publication [db_name]
-```
-
-Listing publications and slots:
-
-```bash
-sudo -u postgres pg_list_replication_publications
-sudo -u postgres pg_list_replication_slots
-```
-
----
-
-### 🟡 3. REPLICA — Pause replication
-
-```bash
-sudo -u postgres psql -c "SELECT pg_wal_replay_pause();"
-```
-
-Verify:
-
-```bash
-sudo -u postgres psql -c "SELECT pg_is_wal_replay_paused();"
-```
-
----
-
-### 🟡 4. REPLICA — Run dump
-
-```bash
-sudo -u postgres pg_dump_all_databases
-```
-
-or
-
-```bash
-sudo -u postgres bash -c "pg_dumpall --globals-only > /tmp/globals.sql"
-sudo -u postgres pg_dump_database [db_name]
-```
-
----
-
-### 🟡 5. REPLICA — Resume replication
-
-```bash
-sudo -u postgres psql -c "SELECT pg_wal_replay_resume();"
-```
-
----
-
-### 🔵 6. COPY dumps to NEW HOST
-
-From NEW_HOST:
-
-```bash
-export REPLICA_HOST=[private_ip] && \
-cd /tmp && \
-sudo -u postgres scp "postgres@$REPLICA_HOST:/tmp/globals.sql" . && \
-sudo -u postgres scp "postgres@$REPLICA_HOST:/tmp/dump_*.tar.zst" .
-```
-
----
-
-### 🔵 7. NEW HOST (PostgreSQL 14) — Restore
-
-#### 7.1 Restore globals
-
-```bash
-sudo -u postgres psql -f /tmp/globals.sql
-```
-
----
-
-#### 7.2 Create databases
-
-```bash
-sudo -u postgres psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN ('template1')" | \
-xargs -I{} sudo -u postgres createdb {}
-```
-
-or
-
-```bash
-sudo -u postgres createdb [db_name]
-```
-
----
-
-#### 7.3 Restore each database
-
-```bash
-sudo -u postgres pg_restore_all_databases
-```
-
-or
-
-```bash
-sudo -u postgres pg_restore_database [db_name]
-```
-
----
-
-### 🔵 8. NEW HOST — Create subscriptions
-
-```bash
-sudo -u postgres pg_create_replication_subscriptions
-```
-
-or
-
-```bash
-sudo -u postgres pg_create_replication_subscription [db_name]
-```
-
----
-
-### 🔵 9. NEW HOST — Monitor replication
-
-```bash
-sudo -u postgres pg_list_replication_subscriptions
-```
-
----
-
-### 🔴 11. CUTOVER
-
-#### 11.1 Stop writes on old primary
-
-Put app(s) in maintenance mode, stop the app/daemons.
-
----
-
-#### 11.2 Wait for replication to catch up
-
-TODO: not the best way to check, since WAL LSNs keep increasing
-
-```bash
-sudo -u postgres psql -d [db_name] -c "SELECT * FROM pg_stat_subscription;"
-```
-
----
-
-#### 11.3 Fix sequences
-
-Run per DB:
-
-```bash
-sudo -u postgres pg_fix_sequences_in_all_databases
-```
-
-or
-
-```bash
-sudo -u postgres pg_fix_sequences [db_name]
-```
-
----
-
-#### 11.4 Point app to NEW_HOST
-
-1. Update `pg.kosmos.local` in `/etc/hosts` on app server(s). For example:
-
-   ```bash
-   export NEW_PG_PRIMARY=[private_ip]
-   knife ssh roles:ejabberd -a knife_zero.host "sudo sed -r \"s/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\s(pg.kosmos.local)/$NEW_PG_PRIMARY\t\1/\" -i /etc/hosts"
-   ```
-
-   Or override node attribute(s) if necessary and/or approporiate.
-
-2. Start the app/daemons, and deactivate maintenance mode.
-
----
-
-### 🧹 12. CLEANUP NEW_HOST
-
-```bash
-sudo -u postgres pg_drop_replication_subscriptions
-```
-
----
-
-### 🧹 13. CLEANUP PRIMARY
-
-TODO: Looks like slots are dropped automatically, when subscriptions are dropped
-
-```bash
-sudo -u postgres pg_drop_replication_publications
-```
-
----
-
-### 🧹 13. CLEANUP Chef
-
-Once all apps/databases are migrated, update the role in the node
-config of the new primary to 'postgres_primary' and converge it.
-
-Also delete the old primary node config from the Chef repo.
-
----
-
-### ✅ DONE
-
----

nodes/postgres-10.json

@@ -1,17 +1,17 @@
 {
-  "name": "postgres-12",
+  "name": "postgres-10",
   "chef_environment": "production",
   "normal": {
     "knife_zero": {
-      "host": "10.1.1.134"
+      "host": "10.1.1.176"
     }
   },
   "automatic": {
-    "fqdn": "postgres-12",
+    "fqdn": "postgres-10",
     "os": "linux",
-    "os_version": "5.15.0-1096-kvm",
-    "hostname": "postgres-12",
-    "ipaddress": "192.168.122.139",
+    "os_version": "5.15.0-1095-kvm",
+    "hostname": "postgres-10",
+    "ipaddress": "192.168.122.41",
     "roles": [
       "base",
       "kvm_guest",
@@ -24,7 +24,6 @@
       "kosmos_postgresql::hostsfile",
       "kosmos_postgresql::replica",
       "kosmos_postgresql::firewall",
-      "kosmos_postgresql::management_scripts",
       "apt::default",
       "timezone_iii::default",
       "timezone_iii::debian",

nodes/postgres-6.json

@@ -1,17 +1,16 @@
 {
-  "name": "postgres-11",
-  "chef_environment": "production",
+  "name": "postgres-6",
   "normal": {
     "knife_zero": {
-      "host": "10.1.1.91"
+      "host": "10.1.1.196"
     }
   },
   "automatic": {
-    "fqdn": "postgres-11",
+    "fqdn": "postgres-6",
     "os": "linux",
-    "os_version": "5.15.0-1095-kvm",
-    "hostname": "postgres-11",
-    "ipaddress": "192.168.122.142",
+    "os_version": "5.4.0-173-generic",
+    "hostname": "postgres-6",
+    "ipaddress": "192.168.122.60",
     "roles": [
       "base",
       "kvm_guest",
@@ -22,20 +21,18 @@
       "kosmos-base::default",
       "kosmos_kvm::guest",
       "kosmos_postgresql::primary",
+      "kosmos_postgresql::firewall",
       "kosmos-akkounts::pg_db",
       "kosmos-bitcoin::lndhub-go_pg_db",
       "kosmos-bitcoin::nbxplorer_pg_db",
       "kosmos_drone::pg_db",
       "kosmos_gitea::pg_db",
       "kosmos-mastodon::pg_db",
-      "kosmos_postgresql::firewall",
-      "kosmos_postgresql::management_scripts",
       "apt::default",
       "timezone_iii::default",
       "timezone_iii::debian",
       "ntp::default",
       "ntp::apparmor",
-      "kosmos-base::journald_conf",
       "kosmos-base::systemd_emails",
       "apt::unattended-upgrades",
       "kosmos-base::firewall",
@@ -47,17 +44,17 @@
       "hostname::default"
     ],
     "platform": "ubuntu",
-    "platform_version": "22.04",
+    "platform_version": "20.04",
     "cloud": null,
     "chef_packages": {
       "chef": {
-        "version": "18.10.17",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "version": "18.4.2",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.4.2/lib",
         "chef_effortless": null
       },
       "ohai": {
-        "version": "18.2.13",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "version": "18.1.11",
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
       }
     }
   },

nodes/postgres-8.json

@@ -0,0 +1,62 @@
+{
+  "name": "postgres-8",
+  "chef_environment": "production",
+  "normal": {
+    "knife_zero": {
+      "host": "10.1.1.99"
+    }
+  },
+  "automatic": {
+    "fqdn": "postgres-8",
+    "os": "linux",
+    "os_version": "5.15.0-1059-kvm",
+    "hostname": "postgres-8",
+    "ipaddress": "192.168.122.100",
+    "roles": [
+      "base",
+      "kvm_guest",
+      "postgresql_replica"
+    ],
+    "recipes": [
+      "kosmos-base",
+      "kosmos-base::default",
+      "kosmos_kvm::guest",
+      "kosmos_postgresql::hostsfile",
+      "kosmos_postgresql::replica",
+      "kosmos_postgresql::firewall",
+      "apt::default",
+      "timezone_iii::default",
+      "timezone_iii::debian",
+      "ntp::default",
+      "ntp::apparmor",
+      "kosmos-base::systemd_emails",
+      "apt::unattended-upgrades",
+      "kosmos-base::firewall",
+      "kosmos-postfix::default",
+      "postfix::default",
+      "postfix::_common",
+      "postfix::_attributes",
+      "postfix::sasl_auth",
+      "hostname::default"
+    ],
+    "platform": "ubuntu",
+    "platform_version": "22.04",
+    "cloud": null,
+    "chef_packages": {
+      "chef": {
+        "version": "18.5.0",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
+        "chef_effortless": null
+      },
+      "ohai": {
+        "version": "18.1.11",
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
+      }
+    }
+  },
+  "run_list": [
+    "role[base]",
+    "role[kvm_guest]",
+    "role[postgresql_replica]"
+  ]
+}

nodes/postgres-9.json

@@ -0,0 +1,63 @@
+{
+  "name": "postgres-9",
+  "chef_environment": "production",
+  "normal": {
+    "knife_zero": {
+      "host": "10.1.1.3"
+    }
+  },
+  "automatic": {
+    "fqdn": "postgres-9",
+    "os": "linux",
+    "os_version": "5.15.0-1059-kvm",
+    "hostname": "postgres-9",
+    "ipaddress": "192.168.122.64",
+    "roles": [
+      "base",
+      "kvm_guest",
+      "postgresql_replica"
+    ],
+    "recipes": [
+      "kosmos-base",
+      "kosmos-base::default",
+      "kosmos_kvm::guest",
+      "kosmos_postgresql::hostsfile",
+      "kosmos_postgresql::replica",
+      "kosmos_postgresql::firewall",
+      "apt::default",
+      "timezone_iii::default",
+      "timezone_iii::debian",
+      "ntp::default",
+      "ntp::apparmor",
+      "kosmos-base::journald_conf",
+      "kosmos-base::systemd_emails",
+      "apt::unattended-upgrades",
+      "kosmos-base::firewall",
+      "kosmos-postfix::default",
+      "postfix::default",
+      "postfix::_common",
+      "postfix::_attributes",
+      "postfix::sasl_auth",
+      "hostname::default"
+    ],
+    "platform": "ubuntu",
+    "platform_version": "22.04",
+    "cloud": null,
+    "chef_packages": {
+      "chef": {
+        "version": "18.8.54",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.8.54/lib",
+        "chef_effortless": null
+      },
+      "ohai": {
+        "version": "18.2.8",
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.8/lib/ohai"
+      }
+    }
+  },
+  "run_list": [
+    "role[base]",
+    "role[kvm_guest]",
+    "role[postgresql_replica]"
+  ]
+}

roles/postgresql_primary.rb

@@ -1,13 +1,12 @@
 name "postgresql_primary"
 
-run_list [
-  "kosmos_postgresql::primary",
-  "kosmos-akkounts::pg_db",
-  "kosmos-bitcoin::lndhub-go_pg_db",
-  "kosmos-bitcoin::nbxplorer_pg_db",
-  "kosmos_drone::pg_db",
-  "kosmos_gitea::pg_db",
-  "kosmos-mastodon::pg_db",
-  "kosmos_postgresql::firewall",
-  "kosmos_postgresql::management_scripts"
-]
+run_list %w(
+  kosmos_postgresql::primary
+  kosmos_postgresql::firewall
+  kosmos-akkounts::pg_db
+  kosmos-bitcoin::lndhub-go_pg_db
+  kosmos-bitcoin::nbxplorer_pg_db
+  kosmos_drone::pg_db
+  kosmos_gitea::pg_db
+  kosmos-mastodon::pg_db
+)

roles/postgresql_replica.rb

@@ -1,8 +1,7 @@
 name "postgresql_replica"
 
-run_list [
-  "kosmos_postgresql::hostsfile",
-  "kosmos_postgresql::replica",
-  "kosmos_postgresql::firewall",
-  "kosmos_postgresql::management_scripts"
-]
+run_list %w(
+  kosmos_postgresql::hostsfile
+  kosmos_postgresql::replica
+  kosmos_postgresql::firewall
+)

roles/postgresql_replica_logical.rb

@@ -1,8 +0,0 @@
-name "postgresql_replica_logical"
-
-run_list [
-  "kosmos_postgresql::hostsfile",
-  "kosmos_postgresql::replica_logical",
-  "kosmos_postgresql::firewall",
-  "kosmos_postgresql::management_scripts"
-]

site-cookbooks/kosmos-akkounts/recipes/default.rb

@@ -230,6 +230,7 @@ systemd_unit "akkounts.service" do
       WorkingDirectory: deploy_path,
       Environment: "RAILS_ENV=#{rails_env} SOLID_QUEUE_IN_PUMA=true",
       ExecStart: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid",
+      ExecStop: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid stop",
       ExecReload: "#{bundle_path} exec pumactl -F config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid phased-restart",
       PIDFile: "#{deploy_path}/tmp/puma.pid",
       TimeoutSec: "10",

site-cookbooks/kosmos_drone/attributes/default.rb

@@ -1,6 +1,2 @@
 node.default["kosmos_drone"]["domain"] = "drone.kosmos.org"
 node.default["kosmos_drone"]["upstream_port"] = 80
-node.default["kosmos_drone"]["pg_host"] = "pg.kosmos.local"
-node.default["kosmos_drone"]["pg_port"] = 5432
-node.default["kosmos_drone"]["pg_db"] = "drone"
-node.default["kosmos_drone"]["pg_user"] = "drone"

site-cookbooks/kosmos_drone/recipes/default.rb

@@ -9,11 +9,11 @@ credentials = data_bag_item("credentials", "drone")
 drone_credentials = data_bag_item('credentials', 'drone')
 
 postgres_config = {
-  host: node["kosmos_drone"]["pg_host"],
-  port: node["kosmos_drone"]["pg_port"],
-  database: node["kosmos_drone"]["pg_db"],
-  username: node["kosmos_drone"]["pg_user"],
-  password: drone_credentials["postgresql_password"]
+  username: "drone",
+  password: drone_credentials["postgresql_password"],
+  host: "pg.kosmos.local",
+  port: 5432,
+  database: "drone"
 }
 
 directory deploy_path do

site-cookbooks/kosmos_gitea/templates/default/nginx_conf_web.erb

@@ -18,6 +18,8 @@ server {
 
   client_max_body_size 121M;
 
+  proxy_intercept_errors on;
+
   location ~ ^/(avatars|repo-avatars)/.*$ {
     proxy_buffers 1024 8k;
     proxy_pass http://_gitea_web;
@@ -52,5 +54,18 @@ server {
     proxy_set_header X-Real-IP $remote_addr;
     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
     proxy_set_header X-Forwarded-Proto $scheme;
+    error_page 404 = @slow_404;
+  }
+
+  # Slow down 404 responses to make scraping random URLs less attractive
+  location @slow_404 {
+    internal;
+    default_type text/plain;
+    content_by_lua_block {
+      ngx.sleep(10)
+      ngx.status = 404
+      ngx.say("Not Found")
+      ngx.exit(ngx.HTTP_NOT_FOUND)
+    }
   }
 }

site-cookbooks/kosmos_postgresql/attributes/default.rb

@@ -1,8 +1,3 @@
-node.default['kosmos_postgresql']['postgresql_version'] = "14"
-
 # This is set to false by default, and set to true in the server resource
 # for replicas.
 node.default['kosmos_postgresql']['ready_to_set_up_replica'] = false
-
-# Address space from which clients are allowed to connect
-node.default['kosmos_postgresql']['access_addr'] = "10.1.1.0/24"

site-cookbooks/kosmos_postgresql/files/create_publication.sh

@@ -1,31 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-DB_NAME="${1:?Usage: $0 <database_name>}"
-
-echo "== Processing DB: $DB_NAME =="
-
-# Create publication (idempotent)
-psql -d "$DB_NAME" -v ON_ERROR_STOP=1 <<'SQL'
-DO $$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_publication WHERE pubname = 'migrate_pub'
-  ) THEN
-    CREATE PUBLICATION migrate_pub FOR ALL TABLES;
-  END IF;
-END
-$$;
-SQL
-
-# Create logical replication slot (idempotent-ish)
-SLOT="migrate_slot_${DB_NAME}"
-
-if ! psql -d "$DB_NAME" -Atqc "SELECT 1 FROM pg_replication_slots WHERE slot_name = '$SLOT'" | grep -q 1; then
-  echo "  Creating slot: $SLOT"
-  psql -d "$DB_NAME" -c "SELECT pg_create_logical_replication_slot('$SLOT', 'pgoutput');"
-else
-  echo "  Slot already exists: $SLOT"
-fi
-
-echo "== Done =="

site-cookbooks/kosmos_postgresql/files/create_publications.sh

@@ -1,34 +0,0 @@
-#!/bin/bash
-set -e
-
-echo "== Creating publication in each database =="
-
-for db in $(psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN ('template1','postgres')"); do
-  echo "Processing DB: $db"
-
-  # Create publication (idempotent)
-  psql -d "$db" -v ON_ERROR_STOP=1 <<SQL
-DO \$\$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_publication WHERE pubname = 'migrate_pub'
-  ) THEN
-    CREATE PUBLICATION migrate_pub FOR ALL TABLES;
-  END IF;
-END
-\$\$;
-SQL
-
-  # Create logical replication slot (idempotent-ish)
-  SLOT="migrate_slot_${db}"
-
-  if ! psql -d "$db" -Atqc "SELECT 1 FROM pg_replication_slots WHERE slot_name = '$SLOT'" | grep -q 1; then
-    echo "  Creating slot: $SLOT"
-    psql -d "$db" -c "SELECT pg_create_logical_replication_slot('$SLOT', 'pgoutput');"
-  else
-    echo "  Slot already exists: $SLOT"
-  fi
-
-done
-
-echo "== Done =="

site-cookbooks/kosmos_postgresql/files/drop_publications.sh

@@ -1,34 +0,0 @@
-#!/bin/bash
-set -e
-
-echo "== Dropping subscriptions slots and publications =="
-
-for db in $(psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN ('template1','postgres')"); do
-  echo "Processing DB: $db"
-
-  SLOT="migrate_slot_${db}"
-
-  # Drop slot if exists
-  if psql -d "$db" -Atqc "SELECT 1 FROM pg_replication_slots WHERE slot_name = '$SLOT'" | grep -q 1; then
-    echo "  Dropping slot: $SLOT"
-    psql -d "$db" -c "SELECT pg_drop_replication_slot('$SLOT');"
-  else
-    echo "  Slot not found: $SLOT"
-  fi
-
-  # Drop publication if exists
-  psql -d "$db" -v ON_ERROR_STOP=1 <<SQL
-DO \$\$
-BEGIN
-  IF EXISTS (
-    SELECT 1 FROM pg_publication WHERE pubname = 'migrate_pub'
-  ) THEN
-    DROP PUBLICATION migrate_pub;
-  END IF;
-END
-\$\$;
-SQL
-
-done
-
-echo "== Done =="

site-cookbooks/kosmos_postgresql/files/drop_subscriptions.sh

@@ -1,29 +0,0 @@
-#!/usr/bin/env bash
-set -e
-
-echo "== Dropping subscriptions =="
-
-for db in $(psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN ('template1','postgres')"); do
-  echo "Processing DB: $db"
-
-  SUB="migrate_sub_${db}"
-
-  # Check if subscription exists
-  EXISTS=$(psql -d "$db" -Atqc "SELECT 1 FROM pg_subscription WHERE subname = '$SUB'")
-
-  if [ "$EXISTS" = "1" ]; then
-    echo "  Found subscription: $SUB"
-
-    # Disable first (good practice)
-    psql -d "$db" -c "ALTER SUBSCRIPTION $SUB DISABLE;"
-
-    # Drop it (must be top-level)
-    psql -d "$db" -c "DROP SUBSCRIPTION $SUB;"
-
-  else
-    echo "  No subscription: $SUB"
-  fi
-
-done
-
-echo "== Done =="

site-cookbooks/kosmos_postgresql/files/dump_all_databases.sh

@@ -1,9 +0,0 @@
-#!/bin/bash
-cd /tmp && \
-(pg_dumpall --globals-only > globals.sql) && \
-psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN (''template1'',''postgres'')" | \
-xargs -I{} -P4 sh -c "
-  pg_dump -Fd -j 4 -d \"{}\" -f dump_{} &&
-  tar -cf - dump_{} | zstd -19 -T0 > dump_{}.tar.zst &&
-  rm -rf dump_{}
-"

site-cookbooks/kosmos_postgresql/files/dump_database.sh

@@ -1,10 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-DB_NAME="${1:?Usage: $0 <database_name>}"
-
-cd /tmp
-
-pg_dump -Fd -j 4 -d "$DB_NAME" -f "dump_${DB_NAME}"
-tar -cf - "dump_${DB_NAME}" | zstd -19 -T0 > "dump_${DB_NAME}.tar.zst"
-rm -rf "dump_${DB_NAME}"

site-cookbooks/kosmos_postgresql/files/fix_sequences.sh

@@ -1,35 +0,0 @@
-#!/bin/bash
-set -e
-
-DB="$1"
-
-if [ -z "$DB" ]; then
-  echo "Usage: $0 <database>"
-  exit 1
-fi
-
-echo "== Fixing sequences in database: $DB =="
-
-SQL=$(psql -d "$DB" -Atqc "
-  SELECT
-    'SELECT setval(' ||
-    quote_literal(pg_get_serial_sequence(quote_ident(n.nspname)||'.'||quote_ident(c.relname), a.attname)) ||
-    ', COALESCE(MAX(' || quote_ident(a.attname) || '), 0) + 1, false) FROM ' ||
-    quote_ident(n.nspname)||'.'||quote_ident(c.relname) || ';'
-  FROM pg_class c
-  JOIN pg_namespace n ON n.oid = c.relnamespace
-  JOIN pg_attribute a ON a.attrelid = c.oid
-  WHERE c.relkind = 'r'
-    AND a.attnum > 0
-    AND NOT a.attisdropped
-    AND pg_get_serial_sequence(quote_ident(n.nspname)||'.'||quote_ident(c.relname), a.attname) IS NOT NULL;
-")
-
-if [ -z "$SQL" ]; then
-  echo "No sequences found in $DB"
-  exit 0
-fi
-
-echo "$SQL" | psql -d "$DB"
-
-echo "== Done =="

site-cookbooks/kosmos_postgresql/files/fix_sequences_in_all_databases.sh

@@ -1,38 +0,0 @@
-#!/bin/bash
-set -e
-
-echo "== Fixing sequences across all databases =="
-
-for db in $(psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN ('template1','postgres')"); do
-  echo "---- DB: $db ----"
-
-  # Generate fix statements
-  SQL=$(psql -d "$db" -Atqc "
-    SELECT
-      'SELECT setval(' ||
-      quote_literal(pg_get_serial_sequence(quote_ident(n.nspname)||'.'||quote_ident(c.relname), a.attname)) ||
-      ', COALESCE(MAX(' || quote_ident(a.attname) || '), 0) + 1, false) FROM ' ||
-      quote_ident(n.nspname)||'.'||quote_ident(c.relname) || ';'
-    FROM pg_class c
-    JOIN pg_namespace n ON n.oid = c.relnamespace
-    JOIN pg_attribute a ON a.attrelid = c.oid
-    WHERE c.relkind = 'r'
-      AND a.attnum > 0
-      AND NOT a.attisdropped
-      AND pg_get_serial_sequence(quote_ident(n.nspname)||'.'||quote_ident(c.relname), a.attname) IS NOT NULL;
-  ")
-
-  if [ -z "$SQL" ]; then
-    echo "No sequences found in $db"
-    continue
-  fi
-
-  echo "Fixing sequences in $db..."
-
-  # Execute generated statements
-  echo "$SQL" | psql -d "$db"
-
-done
-
-echo "== Done fixing sequences =="
-

site-cookbooks/kosmos_postgresql/files/list_publications.sh

@@ -1,5 +0,0 @@
-#!/bin/bash
-for db in $(psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN ('template1','postgres')"); do
-  echo "DB: $db"
-  psql -d "$db" -Atqc "SELECT pubname FROM pg_publication;"
-done

site-cookbooks/kosmos_postgresql/files/list_replication_slots.sh

@@ -1,5 +0,0 @@
-#!/bin/bash
-psql -c "
-SELECT slot_name,
-pg_size_pretty(pg_wal_lsn_diff(pg_current_wal_lsn(), restart_lsn))
-FROM pg_replication_slots;"

site-cookbooks/kosmos_postgresql/files/list_subscriptions.sh

@@ -1,16 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-psql -Atqc "
-SELECT datname
-FROM pg_database
-WHERE datallowconn
-  AND datname NOT IN ('template1','postgres')
-" | while read -r db; do
-  result=$(psql -X -At -d "$db" -c "SELECT * FROM pg_stat_subscription;" 2>/dev/null || true)
-
-  if [[ -n "$result" ]]; then
-    echo "==== DB: $db ===="
-    echo "$result"
-  fi
-done

site-cookbooks/kosmos_postgresql/files/restore_all_databases.sh

@@ -1,12 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-cd /tmp
-
-for f in dump_*.tar.zst; do
-  db=$(echo $f | sed "s/dump_\(.*\)\.tar\.zst/\1/")
-  echo "Restoring $db"
-  zstd -d "$f" -c | tar -xf -
-  pg_restore -j 4 -d "$db" dump_$db
-  rm -rf "dump_$db"
-done

site-cookbooks/kosmos_postgresql/files/restore_database.sh

@@ -1,14 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-DB_NAME="${1:?Usage: $0 <database_name>}"
-
-cd /tmp
-
-FILE="dump_${DB_NAME}.tar.zst"
-DIR="dump_${DB_NAME}"
-
-echo "Restoring $DB_NAME"
-zstd -d "$FILE" -c | tar -xf -
-pg_restore -j 4 -d "$DB_NAME" "$DIR"
-rm -rf "$DIR"

site-cookbooks/kosmos_postgresql/libraries/helpers.rb

@@ -36,8 +36,10 @@ class Chef
       end
     end
 
-    def postgresql_version
-      node['kosmos_postgresql']['postgresql_version']
+    def postgresql_service_name
+      postgresql_version = "12"
+
+      "postgresql@#{postgresql_version}-main"
     end
   end
 end

site-cookbooks/kosmos_postgresql/recipes/management_scripts.rb

@@ -1,121 +0,0 @@
-#
-# Cookbook:: kosmos_postgresql
-# Recipe:: management_scripts
-#
-
-credentials = data_bag_item('credentials', 'postgresql')
-
-cookbook_file "/usr/local/bin/pg_dump_all_databases" do
-  source "dump_all_databases.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-cookbook_file "/usr/local/bin/pg_dump_database" do
-  source "dump_database.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-cookbook_file "/usr/local/bin/pg_restore_all_databases" do
-  source "restore_all_databases.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-cookbook_file "/usr/local/bin/pg_restore_database" do
-  source "restore_database.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-cookbook_file "/usr/local/bin/pg_create_replication_publications" do
-  source "create_publications.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-cookbook_file "/usr/local/bin/pg_create_replication_publication" do
-  source "create_publication.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-cookbook_file "/usr/local/bin/pg_drop_replication_publications" do
-  source "drop_publications.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-cookbook_file "/usr/local/bin/pg_list_replication_publications" do
-  source "list_publications.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-cookbook_file "/usr/local/bin/pg_list_replication_slots" do
-  source "list_replication_slots.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-template "/usr/local/bin/pg_create_replication_subscriptions" do
-  source "create_subscriptions.sh.erb"
-  user "postgres"
-  group "postgres"
-  mode "0740"
-  variables pg_host: "pg.kosmos.local",
-            pg_port: 5432,
-            pg_user: "replication",
-            pg_pass: credentials["replication_password"]
-  sensitive true
-end
-
-template "/usr/local/bin/pg_create_replication_subscription" do
-  source "create_subscription.sh.erb"
-  user "postgres"
-  group "postgres"
-  mode "0740"
-  variables pg_host: "pg.kosmos.local",
-            pg_port: 5432,
-            pg_user: "replication",
-            pg_pass: credentials["replication_password"]
-  sensitive true
-end
-
-cookbook_file "/usr/local/bin/pg_drop_replication_subscriptions" do
-  source "drop_subscriptions.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-cookbook_file "/usr/local/bin/pg_list_replication_subscriptions" do
-  source "list_subscriptions.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-cookbook_file "/usr/local/bin/pg_fix_sequences_in_all_databases" do
-  source "fix_sequences.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end
-
-cookbook_file "/usr/local/bin/pg_fix_sequences" do
-  source "fix_sequences.sh"
-  user "postgres"
-  group "postgres"
-  mode "0744"
-end

site-cookbooks/kosmos_postgresql/recipes/primary.rb

@@ -3,6 +3,31 @@
 # Recipe:: primary
 #
 
+postgresql_version = "12"
+postgresql_service = "postgresql@#{postgresql_version}-main"
+
+service postgresql_service do
+  supports restart: true, status: true, reload: true
+end
+
 postgresql_custom_server postgresql_version do
   role "primary"
 end
+
+postgresql_access "zerotier members" do
+  access_type "host"
+  access_db "all"
+  access_user "all"
+  access_addr "10.1.1.0/24"
+  access_method "md5"
+  notifies :reload, "service[#{postgresql_service}]", :immediately
+end
+
+postgresql_access "zerotier members replication" do
+  access_type "host"
+  access_db "replication"
+  access_user "replication"
+  access_addr "10.1.1.0/24"
+  access_method "md5"
+  notifies :reload, "service[#{postgresql_service}]", :immediately
+end

site-cookbooks/kosmos_postgresql/recipes/replica.rb

@@ -3,34 +3,54 @@
 # Recipe:: replica
 #
 
+postgresql_version = "12"
+postgresql_service = "postgresql@#{postgresql_version}-main"
+
 postgresql_custom_server postgresql_version do
   role "replica"
 end
 
+service postgresql_service do
+  supports restart: true, status: true, reload: true
+end
+
 postgresql_data_bag_item = data_bag_item('credentials', 'postgresql')
 
 primary = postgresql_primary
 
-if primary.nil?
-  Chef::Log.warn("No PostgreSQL primary node found. Skipping replication setup.")
-  return
-end
-
-postgresql_service_name = "postgresql@#{postgresql_version}-main"
+unless primary.nil?
+  # TODO
   postgresql_data_dir = "/var/lib/postgresql/#{postgresql_version}/main"
 
-# TODO Replace pg.kosmos.local with private IP once available
-# via proper node attribute
-# https://gitea.kosmos.org/kosmos/chef/issues/263
+  # FIXME get zerotier IP
   execute "set up replication" do
     command <<-EOF
-systemctl stop #{postgresql_service_name}
+systemctl stop #{postgresql_service}
 mv #{postgresql_data_dir} #{postgresql_data_dir}.old
 pg_basebackup -h pg.kosmos.local -U replication -D #{postgresql_data_dir} -R
 chown -R postgres:postgres #{postgresql_data_dir}
-systemctl start #{postgresql_service_name}
+systemctl start #{postgresql_service}
     EOF
     environment 'PGPASSWORD' => postgresql_data_bag_item['replication_password']
     sensitive true
     not_if { ::File.exist? "#{postgresql_data_dir}/standby.signal" }
   end
+
+  postgresql_access "zerotier members" do
+    access_type "host"
+    access_db "all"
+    access_user "all"
+    access_addr "10.1.1.0/24"
+    access_method "md5"
+    notifies :reload, "service[#{postgresql_service}]", :immediately
+  end
+
+  postgresql_access "zerotier members replication" do
+    access_type "host"
+    access_db "replication"
+    access_user "replication"
+    access_addr "10.1.1.0/24"
+    access_method "md5"
+    notifies :reload, "service[#{postgresql_service}]", :immediately
+  end
+end

site-cookbooks/kosmos_postgresql/recipes/replica_logical.rb

@@ -1,15 +0,0 @@
-#
-# Cookbook:: kosmos_postgresql
-# Recipe:: replica_logical
-#
-
-postgresql_custom_server postgresql_version do
-  role "replica_logical"
-end
-
-# primary = postgresql_primary
-#
-# if primary.nil?
-#   Chef::Log.warn("No PostgreSQL primary node found. Skipping replication setup.")
-#   return
-# end

site-cookbooks/kosmos_postgresql/resources/server.rb

@@ -44,28 +44,25 @@ action :create do
 
   shared_buffers = if node['memory']['total'].to_i / 1024 < 1024 # < 1GB RAM
                      "128MB"
-                   else # >= 1GB RAM, use 25% of total RAM
-                     "#{node['memory']['total'].to_i / 1024 / 4}MB"
+                   else # >= 1GB RAM, use 50% of total RAM
+                     "#{node['memory']['total'].to_i / 1024 / 2}MB"
                    end
 
   additional_config = {
     max_connections: 200, # default
     shared_buffers: shared_buffers,
-    work_mem: "4MB",
     unix_socket_directories: "/var/run/postgresql",
     dynamic_shared_memory_type: "posix",
     timezone: "UTC", # default is GMT
     listen_addresses: "0.0.0.0",
     promote_trigger_file: "#{postgresql_data_dir}/failover.trigger",
-    wal_level: "logical",
-    wal_keep_size: 4096, # 256 segments, 16MB each
-    max_replication_slots: 16
+    wal_keep_segments: 256
   }
 
   postgresql_server_conf "main" do
     version postgresql_version
     additional_config additional_config
-    notifies :restart, "service[#{postgresql_service}]", :delayed
+    notifies :reload, "service[#{postgresql_service}]", :delayed
   end
 
   postgresql_user "replication" do
@@ -73,24 +70,6 @@ action :create do
     replication true
     password postgresql_credentials['replication_password']
   end
-
-  postgresql_access "all members" do
-    access_type "host"
-    access_db "all"
-    access_user "all"
-    access_addr node['kosmos_postgresql']['access_addr']
-    access_method "md5"
-    notifies :reload, "service[#{postgresql_service}]", :immediately
-  end
-
-  postgresql_access "replication members" do
-    access_type "host"
-    access_db "replication"
-    access_user "replication"
-    access_addr node['kosmos_postgresql']['access_addr']
-    access_method "md5"
-    notifies :reload, "service[#{postgresql_service}]", :immediately
-  end
 end
 
 action_class do

site-cookbooks/kosmos_postgresql/templates/create_subscription.sh.erb

@@ -1,31 +0,0 @@
-#!/bin/bash
-set -euo pipefail
-
-DB_NAME="${1:?Usage: $0 <database_name>}"
-
-echo "== Processing DB: $DB_NAME =="
-
-SLOT="migrate_slot_${DB_NAME}"
-SUB="migrate_sub_${DB_NAME}"
-
-psql -d "$DB_NAME" -v ON_ERROR_STOP=1 <<SQL
-DO \$\$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_subscription WHERE subname = '$SUB'
-  ) THEN
-    CREATE SUBSCRIPTION $SUB
-    CONNECTION 'host=<%= @pg_host %> port=<%= @pg_port %> dbname=$DB_NAME user=<%= @pg_user %> password=<%= @pg_pass %>'
-    PUBLICATION migrate_pub
-    WITH (
-      slot_name = '$SLOT',
-      create_slot = false,
-      copy_data = false,
-      enabled = true
-    );
-  END IF;
-END
-\$\$;
-SQL
-
-echo "== Done =="

site-cookbooks/kosmos_postgresql/templates/create_subscriptions.sh.erb

@@ -1,34 +0,0 @@
-#!/bin/bash
-set -e
-
-echo "== Creating subscriptions for all databases =="
-
-for db in $(psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN ('template1','postgres')"); do
-  echo "Processing DB: $db"
-
-  SLOT="migrate_slot_${db}"
-  SUB="migrate_sub_${db}"
-
-  psql -d "$db" -v ON_ERROR_STOP=1 <<SQL
-DO \$\$
-BEGIN
-  IF NOT EXISTS (
-    SELECT 1 FROM pg_subscription WHERE subname = '$SUB'
-  ) THEN
-    CREATE SUBSCRIPTION $SUB
-    CONNECTION 'host=<%= @pg_host %> port=<%= @pg_port %> dbname=$db user=<%= @pg_user %> password=<%= @pg_pass %>'
-    PUBLICATION migrate_pub
-    WITH (
-      slot_name = '$SLOT',
-      create_slot = false,
-      copy_data = false,
-      enabled = true
-    );
-  END IF;
-END
-\$\$;
-SQL
-
-done
-
-echo "== Done =="