Automatically determine OS package name

Co-authored-by: Greg Karékinian <greg@karekinian.com>
Add new RSK testnet VM
2026-04-12 14:31:13 +04:00 · 2026-04-12 08:52:24 +04:00 · 2026-04-11 19:16:19 +04:00
137 changed files with 935 additions and 2412 deletions
@@ -28,7 +28,5 @@ knife[:automatic_attribute_whitelist] = %w[
 # Added to /etc/chef/client.rb on node bootstrap
 # https://docs.chef.io/attribute_persistence/
-# Source of truth: site-cookbooks/kosmos-base/files/default/chef_normal_attributes.yml
+knife[:normal_attribute_allowlist] = ['knife_zero', 'kosmos_kvm', 'kosmos-ejabberd', 'openresty']
-normal_attrs = YAML.load_file(File.expand_path("../site-cookbooks/kosmos-base/files/default/chef_normal_attributes.yml", __dir__))
+knife[:allowed_normal_attributes] = ['knife_zero', 'kosmos_kvm', 'kosmos-ejabberd', 'openresty']
 knife[:normal_attribute_allowlist] = normal_attrs
 knife[:allowed_normal_attributes] = normal_attrs
@@ -1,40 +0,0 @@
 #!/usr/bin/env bash
 set -euo pipefail
 SCRIPT="$(git rev-parse --show-toplevel)/scripts/util/sanitize_node.sh"
 FILES=$(git diff --cached --name-only --diff-filter=ACM -- 'nodes/*.json' || true)
 [[ -z "$FILES" ]] && exit 0
 DIRTY=0
 while IFS= read -r file; do
  staged_tmp=$(mktemp)
  sanitized_tmp=$(mktemp)
  # 1. get staged version
  git show ":$file" > "$staged_tmp"
  # 2. sanitize IN PLACE (on temp copy)
  cp "$staged_tmp" "$sanitized_tmp"
  "$SCRIPT" "$sanitized_tmp"
  # 3. if sanitizer changed file, update working tree
  if ! diff -q "$staged_tmp" "$sanitized_tmp" >/dev/null; then
    cp "$sanitized_tmp" "$file"
    echo "Sanitized: $file"
    DIRTY=1
  fi
  rm -f "$staged_tmp" "$sanitized_tmp"
 done <<< "$FILES"
 if [[ "$DIRTY" -ne 0 ]]; then
  echo ""
  echo "Commit paused, sanitized files must be re-staged."
  exit 1
 fi
 exit 0
@@ -10,6 +10,3 @@
 [submodule "site-cookbooks/deno"]
 	path = site-cookbooks/deno
 	url = git@gitea.kosmos.org:kosmos/deno-cookbook.git
 [submodule "site-cookbooks/blossom"]
 	path = site-cookbooks/blossom
 	url = git@gitea.kosmos.org:kosmos/blossom-cookbook.git
@@ -24,7 +24,6 @@ cookbook 'composer',               '~> 2.7.0'
 cookbook 'fail2ban',               '~> 7.0.4'
 cookbook 'git',                    '~> 10.0.0'
 cookbook 'golang',                 '~> 5.3.1'
 cookbook 'homebrew',               '>= 6.0.0'
 cookbook 'hostname',               '= 0.4.2'
 cookbook 'hostsfile',              '~> 3.0.1'
 cookbook 'java',                   '~> 4.3.0'
@@ -8,7 +8,6 @@ DEPENDENCIES
  firewall (~> 6.2.16)
  git (~> 10.0.0)
  golang (~> 5.3.1)
  homebrew (>= 6.0.0)
  hostname (= 0.4.2)
  hostsfile (~> 3.0.1)
  ipfs
@@ -63,7 +62,7 @@ GRAPH
  git (10.0.0)
  golang (5.3.1)
    ark (>= 6.0)
-  homebrew (6.0.2)
+  homebrew (5.4.1)
  hostname (0.4.2)
    hostsfile (>= 0.0.0)
  hostsfile (3.0.1)
@@ -1,3 +1,3 @@
 source 'https://rubygems.org'
-gem 'knife-zero', '~> 2.6.0'
+gem 'knife-zero', '>= 2.4.2'
@@ -1,399 +1,264 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    abbrev (0.1.2)
+    addressable (2.8.0)
-    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 5.0)
-      public_suffix (>= 2.0.2, < 8.0)
+    aws-eventstream (1.2.0)
-    ast (2.4.3)
+    aws-partitions (1.551.0)
-    aws-eventstream (1.4.0)
+    aws-sdk-core (3.125.6)
    aws-partitions (1.1263.0)
    aws-sdk-core (3.252.0)
      aws-eventstream (~> 1, >= 1.3.0)
      aws-partitions (~> 1, >= 1.992.0)
      aws-sigv4 (~> 1.9)
      base64
      bigdecimal
      jmespath (~> 1, >= 1.6.1)
      logger
    aws-sdk-kms (1.129.0)
      aws-sdk-core (~> 3, >= 3.248.0)
      aws-sigv4 (~> 1.5)
    aws-sdk-s3 (1.226.0)
      aws-sdk-core (~> 3, >= 3.248.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.5)
    aws-sdk-secretsmanager (1.133.0)
      aws-sdk-core (~> 3, >= 3.248.0)
      aws-sigv4 (~> 1.5)
    aws-sigv4 (1.12.1)
      aws-eventstream (~> 1, >= 1.0.2)
-    base64 (0.3.0)
+      aws-partitions (~> 1, >= 1.525.0)
-    bcrypt_pbkdf (1.1.2)
+      aws-sigv4 (~> 1.1)
-    bcrypt_pbkdf (1.1.2-arm64-darwin)
+      jmespath (~> 1.0)
-    bcrypt_pbkdf (1.1.2-x86_64-darwin)
+    aws-sdk-kms (1.53.0)
-    benchmark (0.5.0)
+      aws-sdk-core (~> 3, >= 3.125.0)
-    bigdecimal (4.1.2)
+      aws-sigv4 (~> 1.1)
-    builder (3.3.0)
+    aws-sdk-s3 (1.111.3)
-    chef (19.3.15)
+      aws-sdk-core (~> 3, >= 3.125.0)
      aws-sdk-kms (~> 1)
      aws-sigv4 (~> 1.4)
    aws-sdk-secretsmanager (1.56.0)
      aws-sdk-core (~> 3, >= 3.125.0)
      aws-sigv4 (~> 1.1)
    aws-sigv4 (1.4.0)
      aws-eventstream (~> 1, >= 1.0.2)
    bcrypt_pbkdf (1.1.0)
    builder (3.2.4)
    chef (17.9.42)
      addressable
      aws-sdk-s3 (~> 1.91)
      aws-sdk-secretsmanager (~> 1.46)
-      bcrypt_pbkdf (~> 1.0)
+      chef-config (= 17.9.42)
-      chef-config (= 19.3.15)
+      chef-utils (= 17.9.42)
      chef-licensing (~> 1.3)
      chef-utils (= 19.3.15)
      chef-vault
-      chef-zero (~> 15.1.0)
+      chef-zero (>= 14.0.11)
      corefoundation (~> 0.3.4)
-      csv (~> 3.3.5)
+      diff-lcs (>= 1.2.4, < 1.4.0)
      diff-lcs (~> 1.6.0)
      ed25519 (~> 1.2)
      erubis (~> 2.7)
-      ffi (>= 1.15.5, < 1.18.0)
+      ffi (>= 1.5.0)
      ffi-libarchive (~> 1.0, >= 1.0.3)
-      ffi-yajl (>= 2.2, < 4.0)
+      ffi-yajl (~> 2.2)
      iniparse (~> 1.4)
-      inspec-core (~> 7.0.107)
+      inspec-core (~> 4.23)
      license-acceptance (>= 1.0.5, < 3)
      mixlib-archive (>= 0.4, < 2.0)
      mixlib-authentication (>= 2.1, < 4)
      mixlib-cli (>= 2.1.1, < 3.0)
      mixlib-log (>= 2.0.3, < 4.0)
-      mixlib-shellout (>= 3.3.8, < 3.5.0)
+      mixlib-shellout (>= 3.1.1, < 4.0)
-      net-ftp
+      net-sftp (>= 2.1.2, < 4.0)
-      net-sftp (>= 2.1.2, < 5.0)
+      ohai (~> 17.0)
      ohai (~> 19.0)
      plist (~> 3.2)
-      proxifier2 (~> 1.1)
+      proxifier (~> 1.0)
      syslog
      syslog-logger (~> 1.6)
-      train-core (~> 3.13, >= 3.13.4)
+      train-core (~> 3.2, >= 3.2.28)
-      train-rest (>= 0.4.1)
+      train-winrm (>= 0.2.5)
-      train-winrm (>= 0.2.17)
+      uuidtools (>= 2.1.5, < 3.0)
-      unf_ext (~> 0.0.9.1)
+      vault (~> 0.16)
-      uri (>= 1.0.4, < 1.2.0)
+    chef-config (17.9.42)
      vault (>= 0.18.2, < 0.21.0)
    chef-config (19.3.15)
      addressable
-      chef-utils (= 19.3.15)
+      chef-utils (= 17.9.42)
      fuzzyurl
      mixlib-config (>= 2.2.12, < 4.0)
      mixlib-shellout (>= 2.0, < 4.0)
-      racc
+      tomlrb (~> 1.2)
      tomlrb (>= 1.2, < 3.0)
    chef-gyoku (1.5.0)
      builder (>= 2.1.2)
      rexml (~> 3.4)
    chef-licensing (1.4.1)
      chef-config (>= 15)
      faraday (>= 1, < 3)
      faraday-http-cache
      mixlib-log (~> 3.0)
      ostruct (~> 0.6.0)
      pstore (~> 0.1.1)
      tty-prompt (~> 0.23)
      tty-spinner (~> 0.9.3)
    chef-telemetry (1.1.1)
      chef-config
      concurrent-ruby (~> 1.0)
-    chef-utils (19.3.15)
+    chef-utils (17.9.42)
      concurrent-ruby
-    chef-vault (4.2.12)
+    chef-vault (4.1.5)
-      syslog (~> 0.3)
+    chef-zero (15.0.11)
-    chef-winrm (2.5.0)
+      ffi-yajl (~> 2.2)
-      builder (>= 2.1.2)
+      hashie (>= 2.0, < 5.0)
      chef-gyoku (~> 1.5)
      erubi (~> 1.8)
      gssapi (~> 1.2)
      httpclient (~> 2.2, >= 2.2.0.2)
      logging (>= 1.6.1, < 3.0)
      nori (~> 2.7)
      rexml (>= 3.4.2, < 4.0)
      rubyntlm (~> 0.6.0, >= 0.6.3)
    chef-winrm-elevated (1.2.5)
      chef-winrm (>= 2.3.11)
      chef-winrm-fs (>= 1.3.7)
      erubi (~> 1.8)
    chef-winrm-fs (1.4.2)
      benchmark (~> 0.5.0)
      chef-winrm (~> 2.4)
      csv (~> 3.3)
      erubi (>= 1.7)
      logging (>= 1.6.1, < 3.0)
      rubyzip (~> 2.0)
    chef-zero (15.1.11)
      ffi-yajl (>= 2.2, < 4.0)
      hashie (>= 2.0, < 6.0)
      mixlib-log (>= 2.0, < 4.0)
-      rack (~> 3.2, >= 3.2.6)
+      rack (~> 2.0, >= 2.0.6)
-      rackup (~> 2.3, >= 2.3.1)
+      uuidtools (~> 2.1)
      uuidtools (>= 2.1, < 4.0)
      webrick
    coderay (1.1.3)
-    concurrent-ruby (1.3.7)
+    concurrent-ruby (1.1.9)
-    connection_pool (2.5.5)
+    corefoundation (0.3.10)
    cookstyle (8.7.6)
      rubocop (= 1.86.1)
    corefoundation (0.3.19)
      ffi (>= 1.15.0)
-    csv (3.3.5)
+    diff-lcs (1.3)
-    date (3.5.1)
+    erubi (1.10.0)
    diff-lcs (1.6.2)
    domain_name (0.6.20240107)
    ed25519 (1.4.0)
    erubi (1.13.1)
    erubis (2.7.0)
-    faraday (2.14.3)
+    faraday (1.4.3)
-      faraday-net_http (>= 2.0, < 3.5)
+      faraday-em_http (~> 1.0)
-      json
+      faraday-em_synchrony (~> 1.0)
-      logger
+      faraday-excon (~> 1.1)
-    faraday-follow_redirects (0.5.0)
+      faraday-net_http (~> 1.0)
-      faraday (>= 1, < 3)
+      faraday-net_http_persistent (~> 1.1)
-    faraday-http-cache (2.5.1)
+      multipart-post (>= 1.2, < 3)
-      faraday (>= 0.8)
+      ruby2_keywords (>= 0.0.4)
-    faraday-net_http (3.4.4)
+    faraday-em_http (1.0.0)
-      net-http (~> 0.5)
+    faraday-em_synchrony (1.0.0)
-    ffi (1.17.4-arm64-darwin)
+    faraday-excon (1.1.0)
-    ffi (1.17.4-x86_64-darwin)
+    faraday-net_http (1.0.1)
-    ffi (1.17.4-x86_64-linux-gnu)
+    faraday-net_http_persistent (1.2.0)
-    ffi-libarchive (1.1.14)
+    faraday_middleware (1.2.0)
      faraday (~> 1.0)
    ffi (1.15.5)
    ffi-libarchive (1.1.3)
      ffi (~> 1.0)
-    ffi-yajl (2.7.11)
+    ffi-yajl (2.4.0)
-      libyajl2 (>= 2.1)
+      libyajl2 (>= 1.2)
    fuzzyurl (0.9.0)
    gssapi (1.3.1)
      ffi (>= 1.0.1)
-    hashie (5.1.0)
+    gyoku (1.3.1)
-      logger
+      builder (>= 2.1.2)
-    highline (3.1.2)
+    hashie (4.1.0)
-      reline
+    highline (2.0.3)
-    http-accept (1.7.0)
+    httpclient (2.8.3)
    http-cookie (1.1.6)
      domain_name (~> 0.5)
    httpclient (2.9.0)
      mutex_m
    iniparse (1.5.0)
-    inspec-core (7.0.107)
+    inspec-core (4.52.9)
      addressable (~> 2.4)
      chef-licensing (>= 1.2.0)
      chef-telemetry (~> 1.0, >= 1.0.8)
-      cookstyle
+      faraday (>= 0.9.0, < 1.5)
-      csv (~> 3.0)
+      faraday_middleware (~> 1.0)
-      faraday (>= 1, < 3)
+      hashie (>= 3.4, < 5.0)
      faraday-follow_redirects (~> 0.3)
      hashie (>= 3.4, < 6.0)
      license-acceptance (>= 0.2.13, < 3.0)
      method_source (>= 0.8, < 2.0)
      mixlib-log (~> 3.0)
      multipart-post (~> 2.0)
      ostruct (>= 0.1, < 0.7)
      parallel (~> 1.9)
-      parslet (>= 1.5, < 3.0)
+      parslet (>= 1.5, < 2.0)
      pry (~> 0.13)
-      rspec (>= 3.9, <= 3.14)
+      rspec (>= 3.9, < 3.11)
-      rspec-its (>= 1.2, < 3.0)
+      rspec-its (~> 1.2)
-      rubyzip (>= 1.2.2, < 4.0)
+      rubyzip (>= 1.2.2, < 3.0)
      semverse (~> 3.0)
      sslshake (~> 1.2)
-      syslog (~> 0.1)
+      thor (>= 0.20, < 2.0)
-      thor (>= 0.20, < 1.5.0)
+      tomlrb (>= 1.2, < 2.1)
-      tomlrb (>= 1.3, < 2.1)
+      train-core (~> 3.0)
      train-core (~> 3.16, >= 3.16.1)
      tty-prompt (~> 0.17)
      tty-table (~> 0.10)
    io-console (0.8.2)
    ipaddress (0.8.3)
-    jmespath (1.6.2)
+    jmespath (1.5.0)
-    json (2.20.0)
+    json (2.6.1)
-    knife (19.0.134)
+    knife (17.9.26)
      abbrev
      bcrypt_pbkdf (~> 1.1)
-      chef-licensing (~> 1.2)
+      chef (>= 17)
      chef-config (>= 17)
      chef-utils (>= 17)
      chef-vault
      ed25519 (>= 1.2, < 2.0)
      erubis (~> 2.7)
-      ffi (>= 1.15, < 1.18.0)
+      ffi (>= 1.15)
-      ffi-yajl (>= 2.2, < 3.0)
+      ffi-yajl (~> 2.2)
-      highline (>= 1.6.9, < 4)
+      highline (>= 1.6.9, < 3)
      license-acceptance (>= 1.0.5, < 3)
      mixlib-archive (>= 0.4, < 2.0)
      mixlib-cli (>= 2.1.1, < 3.0)
-      net-ssh (>= 5.1, < 8)
+      net-ssh (>= 5.1, < 7)
      net-ssh-multi (~> 1.2, >= 1.2.1)
      ohai (~> 17.0)
      pastel
-      proxifier2 (~> 1.1)
+      train-core (~> 3.2, >= 3.2.28)
-      train-core (~> 3.13, >= 3.13.4)
+      train-winrm (>= 0.2.5)
      train-winrm (>= 0.2.17)
      tty-prompt (~> 0.21)
      tty-screen (~> 0.6)
      tty-table (~> 0.11)
-    knife-zero (2.6.0)
+    knife-zero (2.4.2)
-      chef (>= 16.6)
+      chef (>= 15.0)
      knife (>= 17.0)
    language_server-protocol (3.17.0.5)
    libyajl2 (2.1.0)
    license-acceptance (2.1.13)
      pastel (~> 0.7)
      tomlrb (>= 1.2, < 3.0)
      tty-box (~> 0.6)
      tty-prompt (~> 0.20)
    lint_roller (1.1.0)
    little-plugger (1.1.4)
-    logger (1.7.0)
+    logging (2.3.0)
    logging (2.4.0)
      little-plugger (~> 1.1)
      multi_json (~> 1.14)
-    method_source (1.1.0)
+    method_source (1.0.0)
-    mime-types (3.7.0)
+    mixlib-archive (1.1.7)
      logger
      mime-types-data (~> 3.2025, >= 3.2025.0507)
    mime-types-data (3.2026.0701)
    mixlib-archive (1.3.3)
      mixlib-log
    mixlib-authentication (3.0.10)
    mixlib-cli (2.1.8)
-    mixlib-config (3.0.27)
+    mixlib-config (3.0.9)
      tomlrb
-    mixlib-log (3.2.3)
+    mixlib-log (3.0.9)
-      ffi (>= 1.15.5)
+    mixlib-shellout (3.2.5)
    mixlib-shellout (3.4.10)
      chef-utils
-    multi_json (1.19.1)
+    multi_json (1.15.0)
-    multipart-post (2.4.1)
+    multipart-post (2.1.1)
-    mutex_m (0.3.0)
+    net-scp (3.0.0)
-    net-ftp (0.3.9)
+      net-ssh (>= 2.6.5, < 7.0.0)
-      net-protocol
+    net-sftp (3.0.0)
-      time
+      net-ssh (>= 5.0.0, < 7.0.0)
-    net-http (0.9.1)
+    net-ssh (6.1.0)
      uri (>= 0.11.1)
    net-http-persistent (4.0.8)
      connection_pool (>= 2.2.4, < 4)
    net-protocol (0.2.2)
      timeout
    net-scp (4.1.0)
      net-ssh (>= 2.6.5, < 8.0.0)
    net-sftp (4.0.0)
      net-ssh (>= 5.0.0, < 8.0.0)
    net-ssh (7.3.3)
    net-ssh-gateway (2.0.0)
      net-ssh (>= 4.0.0)
    net-ssh-multi (1.2.1)
      net-ssh (>= 2.6.5)
      net-ssh-gateway (>= 1.2.0)
-    netrc (0.11.0)
+    nori (2.6.0)
-    nori (2.7.1)
+    ohai (17.9.0)
-      bigdecimal
+      chef-config (>= 14.12, < 18)
-    ohai (19.1.40)
+      chef-utils (>= 16.0, < 18)
-      base64
+      ffi (~> 1.9)
-      chef-config (>= 14.12, < 20)
+      ffi-yajl (~> 2.2)
      chef-utils (>= 16.0, < 20)
      ffi (>= 1.15.5)
      ffi-yajl (>= 2.2, < 3.0)
      ipaddress
      mixlib-cli (>= 1.7.0)
      mixlib-config (>= 2.0, < 4.0)
      mixlib-log (>= 2.0.1, < 4.0)
-      mixlib-shellout (>= 3.3.6, < 3.5.0)
+      mixlib-shellout (~> 3.2, >= 3.2.5)
      plist (~> 3.1)
      train-core
      wmi-lite (~> 1.0)
-    ostruct (0.6.3)
+    parallel (1.21.0)
-    parallel (1.28.0)
+    parslet (1.8.2)
    parser (3.3.11.1)
      ast (~> 2.4.1)
      racc
    parslet (2.0.0)
    pastel (0.8.0)
      tty-color (~> 0.5)
-    plist (3.7.2)
+    plist (3.6.0)
-    prism (1.9.0)
+    proxifier (1.0.3)
-    proxifier2 (1.1.0)
+    pry (0.14.1)
    pry (0.16.0)
      coderay (~> 1.1)
      method_source (~> 1.0)
-      reline (>= 0.6.0)
+    public_suffix (4.0.6)
-    pstore (0.1.4)
+    rack (2.2.3)
-    public_suffix (6.0.2)
+    rspec (3.10.0)
-    racc (1.8.1)
+      rspec-core (~> 3.10.0)
-    rack (3.2.6)
+      rspec-expectations (~> 3.10.0)
-    rackup (2.3.1)
+      rspec-mocks (~> 3.10.0)
-      rack (>= 3)
+    rspec-core (3.10.2)
-    rainbow (3.1.1)
+      rspec-support (~> 3.10.0)
-    regexp_parser (2.12.0)
+    rspec-expectations (3.10.2)
    reline (0.6.3)
      io-console (~> 0.5)
    rest-client (2.1.0)
      http-accept (>= 1.7.0, < 2.0)
      http-cookie (>= 1.0.2, < 2.0)
      mime-types (>= 1.16, < 4.0)
      netrc (~> 0.8)
    rexml (3.4.4)
    rspec (3.13.2)
      rspec-core (~> 3.13.0)
      rspec-expectations (~> 3.13.0)
      rspec-mocks (~> 3.13.0)
    rspec-core (3.13.6)
      rspec-support (~> 3.13.0)
    rspec-expectations (3.13.5)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
+      rspec-support (~> 3.10.0)
-    rspec-its (2.0.0)
+    rspec-its (1.3.0)
-      rspec-core (>= 3.13.0)
+      rspec-core (>= 3.0.0)
-      rspec-expectations (>= 3.13.0)
+      rspec-expectations (>= 3.0.0)
-    rspec-mocks (3.13.8)
+    rspec-mocks (3.10.3)
      diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.13.0)
+      rspec-support (~> 3.10.0)
-    rspec-support (3.13.7)
+    rspec-support (3.10.3)
-    rubocop (1.86.1)
+    ruby2_keywords (0.0.5)
-      json (~> 2.3)
+    rubyntlm (0.6.3)
-      language_server-protocol (~> 3.17.0.2)
+    rubyzip (2.3.2)
-      lint_roller (~> 1.1.0)
+    semverse (3.0.0)
      parallel (>= 1.10)
      parser (>= 3.3.0.2)
      rainbow (>= 2.2.2, < 4.0)
      regexp_parser (>= 2.9.3, < 3.0)
      rubocop-ast (>= 1.49.0, < 2.0)
      ruby-progressbar (~> 1.7)
      unicode-display_width (>= 2.4.0, < 4.0)
    rubocop-ast (1.49.1)
      parser (>= 3.3.7.2)
      prism (~> 1.7)
    ruby-progressbar (1.13.0)
    rubyntlm (0.6.5)
      base64
    rubyzip (2.4.1)
    semverse (3.0.2)
    socksify (1.8.1)
    sslshake (1.3.1)
    strings (0.2.1)
      strings-ansi (~> 0.2)
      unicode-display_width (>= 1.5, < 3.0)
      unicode_utils (~> 1.4)
    strings-ansi (0.2.0)
    syslog (0.4.0)
      logger
    syslog-logger (1.6.8)
-    thor (1.4.0)
+    thor (1.2.1)
-    time (0.4.2)
+    tomlrb (1.3.0)
-      date
+    train-core (3.8.7)
    timeout (0.6.1)
    tomlrb (2.0.4)
    train-core (3.16.5)
      addressable (~> 2.5)
-      ffi (>= 1.16.0, < 1.18)
+      ffi (!= 1.13.0)
-      json (>= 2.19.2, < 3.0)
+      json (>= 1.8, < 3.0)
      mixlib-shellout (>= 2.0, < 4.0)
-      net-scp (>= 1.2, < 5.0)
+      net-scp (>= 1.2, < 4.0)
-      net-ssh (>= 2.9, < 8.0)
+      net-ssh (>= 2.9, < 7.0)
-    train-rest (0.5.0)
+    train-winrm (0.2.12)
-      aws-sigv4 (~> 1.5)
+      winrm (>= 2.3.6, < 3.0)
-      rest-client (~> 2.1)
+      winrm-elevated (~> 1.2.2)
-      train-core (~> 3.0)
+      winrm-fs (~> 1.0)
    train-winrm (0.4.3)
      chef-winrm (>= 2.4.4, < 3.0)
      chef-winrm-elevated (>= 1.2.5, < 2.0)
      chef-winrm-fs (>= 1.4.1, < 2.0)
      socksify (~> 1.8)
    tty-box (0.7.0)
      pastel (~> 0.8)
      strings (~> 0.2.0)
@@ -407,34 +272,45 @@ GEM
      tty-cursor (~> 0.7)
      tty-screen (~> 0.8)
      wisper (~> 2.0)
-    tty-screen (0.8.2)
+    tty-screen (0.8.1)
    tty-spinner (0.9.3)
      tty-cursor (~> 0.7)
    tty-table (0.12.0)
      pastel (~> 0.8)
      strings (~> 0.2.0)
      tty-screen (~> 0.8)
-    unf_ext (0.0.9.1)
+    unicode-display_width (2.1.0)
    unicode-display_width (2.6.0)
    unicode_utils (1.4.0)
-    uri (1.1.1)
+    uuidtools (2.2.0)
-    uuidtools (3.0.0)
+    vault (0.16.0)
    vault (0.20.1)
      aws-sigv4
-      base64
+    webrick (1.7.0)
-      net-http-persistent (~> 4.0, >= 4.0.2)
+    winrm (2.3.6)
-    webrick (1.9.2)
+      builder (>= 2.1.2)
      erubi (~> 1.8)
      gssapi (~> 1.2)
      gyoku (~> 1.0)
      httpclient (~> 2.2, >= 2.2.0.2)
      logging (>= 1.6.1, < 3.0)
      nori (~> 2.0)
      rubyntlm (~> 0.6.0, >= 0.6.3)
    winrm-elevated (1.2.3)
      erubi (~> 1.8)
      winrm (~> 2.0)
      winrm-fs (~> 1.0)
    winrm-fs (1.3.5)
      erubi (~> 1.8)
      logging (>= 1.6.1, < 3.0)
      rubyzip (~> 2.0)
      winrm (~> 2.0)
    wisper (2.0.1)
-    wmi-lite (1.0.7)
+    wmi-lite (1.0.5)
 PLATFORMS
  arm64-darwin-22
  x86_64-darwin-18
  x86_64-darwin-19
  x86_64-linux
 DEPENDENCIES
-  knife-zero (~> 2.6.0)
+  knife-zero (>= 2.4.2)
 BUNDLED WITH
   2.2.15
@@ -28,10 +28,6 @@ Clone this repository, `cd` into it, and run:
    bundle install
 ### Enable Git hooks
    git config core.hooksPath .githooks
 ## Common tasks
 ### Bootstrap a new host server
@@ -0,0 +1,4 @@
 {
  "name": "garage-10",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAw2+3Wo+KkXVJCOX1SxT9\nSdwKXgPbCDM3EI9uwoxhMxQfRyN53dxIsBDsQUVOIe1Z8yqm4FenMQlNmeDR+QLE\nvNFf1fisinW+D9VVRm+CjcJy96i/Dyt786Z6YRrDlB860HxCbfTL2Zv5BRtbyIKg\nhz5gO+9PMEpPVR2ij9iue4K6jbM1AAL2ia/P6zDWLJqeIzUocCeHV5N0Z3jXH6qr\nf444v78x35MMJ+3tg5h95SU1/PDCpdSTct4uHEuKIosiN7p4DlYMoM5iSyvVoujr\nflRQPEpGzS9qEt3rDo/F4ltzYMx6bf1tB/0QaBKD+zwPZWTTwf61tSBo5/NkGvJc\nFQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
@@ -0,0 +1,4 @@
 {
  "name": "garage-12",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9GtHHi298BjiIqpZ3WkT\nkYAPfWD60hFe/8icYcq/F/6cHLYKZQ4chek9X/hDCMq4tHEN6Oh58T5x/nuNdPrK\nIAMGyVAGk6ekWlmD4jwdEf6TGb/J3ffJTRDvwX/I8xD/DW3wtXsN+X24T59ByGTm\nrnwRmmmwHF3otRx9wnCsIgDQ0AjiUujsfNNv1FcLXD/WJLys9lEeU5aJ4XtHTwDv\ntJM8YyVEFhEnuvgdKmzn5+F5k9VGdUwForlFOBfvzbCnTZMDMmDVeiUtAUv/7xWQ\nQl2mLUGCtgWuYJYXsQacAJ6pa3h+7cQyshC6w3dwUG+1fS9lNO0Yp1GGX1AGYKpp\nPQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
@@ -0,0 +1,4 @@
 {
  "name": "garage-13",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvbqWc6OwRxgHfsQuTNL4\naxeVvNen5d9srYpZSHjuBB/k9NHB+9P6vU5qF37XHkw1lVUGeYbPHzhYsx3O0/kZ\nH5f4+4SMy/P9jc6SE7AJF4qtYKgJ88koZdqCww07c6K9g+BnEGFFZui/h3hUBxWj\nTfhBHEWPyQ2bl/lr9sIJwsEz+EN0isGn/eIXkmw9J6LdLJ5Q0LLks33K28FNOU7q\nfeAN4MiBVMUtgCGyT2Voe6WrOXwQLSDXQONOp3sfSfFExsIJ1s24xdd7AMD7/9a7\n4sFDZ4swhqAWgWmW2giR7Kb8wTvGQLO/O/uUbmKz3DZXgkOKXHdHCEB/PZx1mRNM\nEwIDAQAB\n-----END PUBLIC KEY-----\n"
 }
@@ -1,4 +0,0 @@
 {
  "name": "garage-16",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqYCUN4WNP05pjbxVJd1/\nvmDZU6XRrVVZS5piSSRzs+uxrcUQZew9oe8YwnB9Acf7nl1igS1Fa3e3TyVdrdrM\n+zKLIszJfZw8qH0BhUHYhIm5o+NXeUDR6zor5/4msq9yyXxMFM3FY6HSnz1IBY6P\n43GdArRqAhccGZTBzvowHZvVTkG553oYF1ETxlUWn+9l142YZufNK+B2JGUGSnf3\nS0A2vlQi7DGHBcUaPPqCLeaXB1cQ4Q6SqMvnExpi0xTdY2QXLlSIBJvJVowLtQKs\npS5qHxwCabMY/uHVoEKxgmMcGvjp4L0PoaXRcev5I2sDfbLuz1VxYfatjgI/1psg\ntwIDAQAB\n-----END PUBLIC KEY-----\n"
 }
@@ -0,0 +1,4 @@
 {
  "name": "garage-9",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnMHzKE8JBrsQkmRDeMjX\n71mBzvRzNM90cwA8xtvIkXesdTyGqohX9k/PJbCY5ySGK9PpMaYDPVAnwnUP8LFQ\n3G98aSbLxUjqU/PBzRsnWpihehr05uz9zYcNFzr4LTNvGQZsq47nN9Tk+LG3zHP7\nAZViv2mJ4ZRnukXf6KHlyoVvhuTu+tiBM8QzjTF97iP/aguNPzYHmrecy9Uf5bSA\nZrbNZT+ayxtgswC2OclhRucx7XLSuHXtpwFqsQzSAhiX1aQ3wwCyH9WJtVwpfUsE\nlxTjcQiSM9aPZ8iSC0shpBaKD1j3iF/2K2Jk+88++zMhJJPLermvaJxzsdePgvyk\nKQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
@@ -1,4 +0,0 @@
 {
  "name": "postgres-11",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1foYpuubS2ovlg3uHO12\nQ/ROZ8MpG+LkCAM46uVfPaoWwfY0vdfMsBOanHDgm9DGUCEBJZ6LPrvCvGXbpPy6\n9GSswK75zVWODblNjvvV4ueGFq4bBFwRuZNjyMlqgyzeU+srZL0ivelu5XEuGuoD\nPYCBKWYqGMz85/eMC7/tinTJtKPyOtXe/G8meji+r7gh3j+ypj/EWeKfcRDa4aGe\n/DmMCurIjjPAXFLMAA6fIqPWVfcPw4APNPE60Z92yPGsTbPu7bL54M5f7udmmu7H\nOgk1HjMAmXCuLDzTkfaxqHP+57yELg/YpXR1E93VmBeQuIBsyOFEk6AmUmA1Ib6e\nnQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
@@ -1,4 +0,0 @@
 {
  "name": "postgres-12",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1mYGrYB8keUKmXA8dhWc\ncCLzp50xR0ajSw+bWYydyRqD5wuEVKjiJu4+G9QmTVXkVgJ+AYI0Y9/WZYpDqVH6\nvLUo6BSNQaWx20q93qIdOGLy8YG3Qyznezk4l8T9u9vWZDyDpKw6gCxzikMkrXxb\n0cqOYtyud8+PtSEEMogSjOKhRURVHlVrlVH3SQO7Whke9rkiFcbXzubsK9yjkUtF\nxZafSoGorOlDsPvFTfYnkepVB+GHcgiribRYSrO+73GypC2kqMhCpWrb6a0VWsP/\nh53+q3JL3vBvdvjcv51Wpf4n6JdnXnQGn2/MdXEzw+NXgjU4/IdYtbORSbaI8F5t\nowIDAQAB\n-----END PUBLIC KEY-----\n"
 }
@@ -1,4 +0,0 @@
 {
  "name": "prometheus-1",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAp7T/OBo/TZm3YqnN4+ok\nHwcJ0kW9w2rl9UfrOlWUvoPHBd2LrqpEv3Az3a150IylQ1H/UozmQA7DtjIoTA7d\nV3oLY970vYrYiURcojOo8qAZBy8EH7dfAHxuZryUeELr+3vdcHF5WrrfSt2FdFVX\nPTY95ikafAnOO0Nt8jvnlPoDn7REV8TOE6KOiUzcHKa2xGlfaIe0oRC21LD86uQm\nR09xY1YaJkVgZfeN/opoRjZawkU3FFs3jlUEVBF8k153oOw9W3bgsFFjSOtRtRRg\nDwyQ7oDeMH83kXnaCdpkNZd59wjzPcpxYAL4LRN52ZXA4Btr4DTi+GxHz98Dr0kU\nUQIDAQAB\n-----END PUBLIC KEY-----\n"
 }
@@ -0,0 +1,4 @@
 {
  "name": "rsk-testnet-5",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx/UHlgcSeh9Do7CTCKXC\n/4/aO2OvT+ijDVmrMYCNtE4sMeuFqKPnV1zxJZmRm4VNhkSQDkdWYD+6XvuFYW60\nyjB/N6D5lLlyjG4HD6fTkfh0K6f7t5mOYV7o4T59OoA3cBZuSROjtWmJ8jEFJ+k9\nII2kcyhPQcFN01ckzvZKRSPbVRccMoc+AKTjB3ZUfs/ERtlVoDrK4jEHluXOxUJO\nBKCcLonjJuLlpRLh7QfKrKFcR4idn5Ir43R6aSUesI/ipKwKsXnR3Bu7vXp74VF3\nMJ3EkdSBG+qJzy51fbRfQiUPAr/vSoVQZwW7FkIhIqqLkMaYCymn7qKfTGujoNU7\nlwIDAQAB\n-----END PUBLIC KEY-----\n"
 }
@@ -0,0 +1,4 @@
 {
  "name": "uploads-1",
  "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwJwWaz8TeGv3SFlKzLMx\nqN8GTL/c0N9ppBvv8xNSS/yF9Y40SbL418uxYzm9hIhOXgIygIgLT2EKIXX32t+R\neOJCdYycQFM3At2fhMkjhuUW0gmDRcYBcBJLC5hLh2EZ+A8V7k4qgrBpPLOjEv48\nhQY0vuAw2DGndWr4QLh5NLUmQiOrfuzcZSSNCBOTIgUZgNmRd9QcCHDq4WDH3poa\nosJo4a9JGEGUL1irOivvEdyJPwEd2f++nYAdWwj8pjCYgpRshQlLhxOlylMx7MxB\nQt2bgJC9sahfbfJCOqdlCU3DMJL0bRUiuxK77WeSsxWBJmrsiF3+Ljs2Ix+s7fnS\nywIDAQAB\n-----END PUBLIC KEY-----\n"
 }
@@ -3,5 +3,3 @@ config:
  line-length: false # MD013
  no-duplicate-heading: false # MD024
  reference-links-images: false # MD052
 ignores:
  - .github/copilot-instructions.md
@@ -2,48 +2,6 @@
 This file is used to list changes made in each version of the homebrew cookbook.
 ## 6.0.2 - *2025-09-04*
 Standardise files with files in sous-chefs/repo-management
 Standardise files with files in sous-chefs/repo-management
 ## 6.0.1 - *2025-03-24*
 ## 6.0.0 - *2025-03-17*
 - Updated library call for new homebrew class name found in chef-client 18.6.2+ releases
 ## 5.4.9 - *2024-11-18*
 Standardise files with files in sous-chefs/repo-management
 Standardise files with files in sous-chefs/repo-management
 Standardise files with files in sous-chefs/repo-management
 Standardise files with files in sous-chefs/repo-management
 Standardise files with files in sous-chefs/repo-management
 ## 5.4.8 - *2024-05-07*
 ## 5.4.7 - *2024-05-06*
 - Explicitly include `Which` module from `Chef` which fixes runs on 18.x clients.
 ## 5.4.6 - *2024-05-06*
 ## 5.4.5 - *2023-11-01*
 Standardise files with files in sous-chefs/repo-management
 ## 5.4.4 - *2023-09-28*
 ## 5.4.3 - *2023-09-04*
 ## 5.4.2 - *2023-07-10*
 ## 5.4.1 - *2023-06-01*
 ## 5.4.0 - *2023-04-24*
@@ -20,9 +20,8 @@
 #
 class HomebrewUserWrapper
-  require 'chef/mixin/homebrew'
+  require 'chef/mixin/homebrew_user'
-  include Chef::Mixin::Homebrew
+  include Chef::Mixin::HomebrewUser
  include Chef::Mixin::Which
 end
 module Homebrew
@@ -60,17 +59,41 @@ module Homebrew
  def owner
    @owner ||= begin
-                 HomebrewUserWrapper.new.find_homebrew_username
+      # once we only support 14.0 we can switch this to find_homebrew_username
-               rescue
+      require 'etc'
-                 Chef::Exceptions::CannotDetermineHomebrewPath
+      ::Etc.getpwuid(HomebrewUserWrapper.new.find_homebrew_uid).name
               rescue Chef::Exceptions::CannotDetermineHomebrewOwner
                 calculate_owner
    end.tap do |owner|
      Chef::Log.debug("Homebrew owner is #{owner}")
    end
  end
  private
  def calculate_owner
    owner = homebrew_owner_attr || sudo_user || current_user
    if owner == 'root'
      raise Chef::Exceptions::User,
           "Homebrew owner is 'root' which is not supported. " \
           "To set an explicit owner, please set node['homebrew']['owner']."
    end
    owner
  end
  def homebrew_owner_attr
    Chef.node['homebrew']['owner']
  end
  def sudo_user
    ENV['SUDO_USER']
  end
  def current_user
    ENV['USER']
  end
 end unless defined?(Homebrew)
 class HomebrewWrapper
  include Homebrew
 end
 Chef::Mixin::Homebrew.include(Homebrew)
@@ -17,13 +17,13 @@
  "recipes": {
  },
-  "version": "6.0.2",
+  "version": "5.4.1",
  "source_url": "https://github.com/sous-chefs/homebrew",
  "issues_url": "https://github.com/sous-chefs/homebrew/issues",
  "privacy": false,
  "chef_versions": [
    [
-      ">= 18.6.2"
+      ">= 15.3"
    ]
  ],
  "ohai_versions": [
@@ -3,9 +3,9 @@ maintainer       'Sous Chefs'
 maintainer_email 'help@sous-chefs.org'
 license          'Apache-2.0'
 description      'Install Homebrew and includes resources for working with taps and casks'
-version          '6.0.2'
+version          '5.4.1'
 supports         'mac_os_x'
 source_url 'https://github.com/sous-chefs/homebrew'
 issues_url 'https://github.com/sous-chefs/homebrew/issues'
-chef_version '>= 18.6.2'
+chef_version '>= 15.3'
@@ -1,10 +1,9 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": ["config:base"],
-  "packageRules": [
+  "packageRules": [{
    {
      "groupName": "Actions",
-      "matchUpdateTypes": ["minor", "patch", "pin"],
+      "matchUpdateTypes": ["patch", "pin", "digest"],
      "automerge": true,
      "addLabels": ["Release: Patch", "Skip: Announcements"]
    },
@@ -19,7 +19,6 @@
 # limitations under the License.
 #
 unified_mode true
 chef_version_for_provides '< 14.0' if respond_to?(:chef_version_for_provides)
 property :cask_name, String, regex: %r{^[\w/-]+$}, name_property: true
@@ -19,7 +19,6 @@
 # limitations under the License.
 #
 unified_mode true
 chef_version_for_provides '< 14.0' if respond_to?(:chef_version_for_provides)
 property :tap_name, String, name_property: true, regex: %r{^[\w-]+(?:\/[\w-]+)+$}
@@ -1,24 +0,0 @@
 {
  "id": "blossom",
  "admin_password": {
    "encrypted_data": "Gd6AzFmySL0p+xo1PnRn9p4Fwge1m3CQj+NRLIUD8P9u1C8=\n",
    "iv": "l6KVzF9xEEBRRAmh\n",
    "auth_tag": "P791KMh9TxuHiWJpDKxWQA==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_access_key": {
    "encrypted_data": "S8jB2LDQOxI/p5ugggW1Sk50TS9TJe9sLv04O/VD9/v22SSM7J6ETomTA+Hd\n",
    "iv": "dUIIZbdAT9q72ioX\n",
    "auth_tag": "+5fCNOuTE/+FqdV6rDNbkw==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  },
  "s3_secret_key": {
    "encrypted_data": "soT63l2frBJDNmHetXmEPvNYBsTpvTyR95FA2rxuZXvVE7hMj21La8/0Amk7\nv+mHOBUMaGG9BTLN0tVFkL0+lGPXdZJTbtDHgluk5l6lLPyc8KY=\n",
    "iv": "RuXs2pL9C/wpwJ/w\n",
    "auth_tag": "nu7dE2udTkxaUZCR42h09w==\n",
    "version": 3,
    "cipher": "aes-256-gcm"
  }
 }
@@ -1,287 +0,0 @@
 # Migrating PostgreSQL cluster to a new major version
 ## Summary
 1. Dump from a replica
 2. Restore to fresh VM running new major version
 3. Add logical replication for delta sync from current/old primary
 4. Switch primary to new server
 5. Remove logical replication on new server
 ## Runbook
 * Primary host: `PRIMARY_HOST`
 * Replica host: `REPLICA_HOST`
 * New PG14 host: `NEW_HOST`
 * PostgreSQL superuser: `postgres`
 * Running locally on each machine via `sudo -u postgres`
 Adjust hostnames/IPs/etc. where needed.
 ---
 ### 🟢 0. PRIMARY — Pre-checks
 ```bash
 sudo -u postgres psql -c "SHOW wal_level;"
 sudo -u postgres psql -c "SHOW max_replication_slots;"
 ```
 If needed, edit config:
 ```bash
 sudo -u postgres vi $PGDATA/postgresql.conf
 ```
 Ensure:
 ```conf
 wal_level = logical
 max_replication_slots = 10
 ```
 Restart if changed:
 ```bash
 sudo systemctl restart postgresql
 ```
 ---
 ### 🔵🟡 3. Create keypair for syncing dump later
 🔵 On NEW_HOST:
 ```bash
 sudo mkdir -p /home/postgres/.ssh && \
 sudo chown -R postgres:postgres /home/postgres && \
 sudo chmod 700 /home/postgres/.ssh && \
 sudo -u postgres bash -c 'ssh-keygen -t ecdsa -b 256 -f /home/postgres/.ssh/id_ecdsa -N "" -C "postgres@$(hostname)"' && \
 sudo cat /home/postgres/.ssh/id_ecdsa.pub
 ```
 Copy the public key from the above output
 🟡 On replica:
 ```bash
 sudo mkdir -p /home/postgres/.ssh && \
 sudo chown -R postgres:postgres /home/postgres && \
 sudo chmod 700 /home/postgres/.ssh && \
 echo [public_key] | sudo tee /home/postgres/.ssh/authorized_keys > /dev/null && \
 sudo chmod 700 /home/postgres/.ssh
 ```
 ---
 ### 🟢 1. PRIMARY — Create publication and replication slots
 ```bash
 sudo -u postgres pg_create_replication_publications
 ```
 or
 ```bash
 sudo -u postgres pg_create_replication_publication [db_name]
 ```
 Listing publications and slots:
 ```bash
 sudo -u postgres pg_list_replication_publications
 sudo -u postgres pg_list_replication_slots
 ```
 ---
 ### 🟡 3. REPLICA — Pause replication
 ```bash
 sudo -u postgres psql -c "SELECT pg_wal_replay_pause();"
 ```
 Verify:
 ```bash
 sudo -u postgres psql -c "SELECT pg_is_wal_replay_paused();"
 ```
 ---
 ### 🟡 4. REPLICA — Run dump
 ```bash
 sudo -u postgres pg_dump_all_databases
 ```
 or
 ```bash
 sudo -u postgres bash -c "pg_dumpall --globals-only > /tmp/globals.sql"
 sudo -u postgres pg_dump_database [db_name]
 ```
 ---
 ### 🟡 5. REPLICA — Resume replication
 ```bash
 sudo -u postgres psql -c "SELECT pg_wal_replay_resume();"
 ```
 ---
 ### 🔵 6. COPY dumps to NEW HOST
 From NEW_HOST:
 ```bash
 export REPLICA_HOST=[private_ip] && \
 cd /tmp && \
 sudo -u postgres scp "postgres@$REPLICA_HOST:/tmp/globals.sql" . && \
 sudo -u postgres scp "postgres@$REPLICA_HOST:/tmp/dump_*.tar.zst" .
 ```
 ---
 ### 🔵 7. NEW HOST (PostgreSQL 14) — Restore
 #### 7.1 Restore globals
 ```bash
 sudo -u postgres psql -f /tmp/globals.sql
 ```
 ---
 #### 7.2 Create databases
 ```bash
 sudo -u postgres psql -Atqc "SELECT datname FROM pg_database WHERE datallowconn AND datname NOT IN ('template1')" | \
 xargs -I{} sudo -u postgres createdb {}
 ```
 or
 ```bash
 sudo -u postgres createdb [db_name]
 ```
 ---
 #### 7.3 Restore each database
 ```bash
 sudo -u postgres pg_restore_all_databases
 ```
 or
 ```bash
 sudo -u postgres pg_restore_database [db_name]
 ```
 ---
 ### 🔵 8. NEW HOST — Create subscriptions
 ```bash
 sudo -u postgres pg_create_replication_subscriptions
 ```
 or
 ```bash
 sudo -u postgres pg_create_replication_subscription [db_name]
 ```
 ---
 ### 🔵 9. NEW HOST — Monitor replication
 ```bash
 sudo -u postgres pg_list_replication_subscriptions
 ```
 ---
 ### 🔴 11. CUTOVER
 #### 11.1 Stop writes on old primary
 Put app(s) in maintenance mode, stop the app/daemons.
 ---
 #### 11.2 Wait for replication to catch up
 TODO: not the best way to check, since WAL LSNs keep increasing
 ```bash
 sudo -u postgres psql -d [db_name] -c "SELECT * FROM pg_stat_subscription;"
 ```
 ---
 #### 11.3 Fix sequences
 Run per DB:
 ```bash
 sudo -u postgres pg_fix_sequences_in_all_databases
 ```
 or
 ```bash
 sudo -u postgres pg_fix_sequences [db_name]
 ```
 ---
 #### 11.4 Point app to NEW_HOST
 1. Update `pg.kosmos.local` in `/etc/hosts` on app server(s). For example:
   ```bash
   export NEW_PG_PRIMARY=[private_ip]
   knife ssh roles:ejabberd -a knife_zero.host "sudo sed -r \"s/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\s(pg.kosmos.local)/$NEW_PG_PRIMARY\t\1/\" -i /etc/hosts"
   ```
   Or override node attribute(s) if necessary and/or approporiate.
 2. Start the app/daemons, and deactivate maintenance mode.
 ---
 ### 🧹 12. CLEANUP NEW_HOST
 ```bash
 sudo -u postgres pg_drop_replication_subscriptions
 ```
 ---
 ### 🧹 13. CLEANUP PRIMARY
 TODO: Looks like slots are dropped automatically, when subscriptions are dropped
 ```bash
 sudo -u postgres pg_drop_replication_publications
 ```
 ---
 ### 🧹 13. CLEANUP Chef
 Once all apps/databases are migrated, update the role in the node
 config of the new primary to 'postgres_primary' and converge it.
 Also delete the old primary node config from the Chef repo.
 ---
 ### ✅ DONE
 ---
@@ -18,16 +18,6 @@
        "relay_url": "wss://nostr.kosmos.org"
      }
    },
    "blossom": {
      "domain": "blossom.kosmos.org",
      "storage": {
        "s3": {
          "endpoint": "s3.kosmos.org",
          "region": "garage",
          "bucket": "blossom"
        }
      }
    },
    "discourse": {
      "domain": "community.kosmos.org"
    },
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.144"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "akkounts-1",
@@ -68,13 +67,13 @@
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.10.17",
+        "version": "18.2.7",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.2.7/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.13",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
      }
    }
  },
@@ -3,13 +3,12 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.163"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "bitcoin-2",
    "os": "linux",
-    "os_version": "5.4.0-216-generic",
+    "os_version": "5.4.0-163-generic",
    "hostname": "bitcoin-2",
    "ipaddress": "192.168.122.148",
    "roles": [
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.35"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "discourse-2",
@@ -62,7 +61,7 @@
    }
  },
  "run_list": [
-    "role[base]",
+    "recipe[kosmos-base]",
    "role[kvm_guest]",
    "role[garage_gateway]",
    "role[kosmos_discourse]"
@@ -46,7 +46,6 @@
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
      "kosmos_assets::nginx_site",
      "kosmos_blossom::nginx",
      "kosmos_discourse::nginx",
      "kosmos_drone::nginx",
      "kosmos_garage::nginx_web",
@@ -113,13 +112,13 @@
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.10.17",
+        "version": "18.2.7",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.2.7/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.13",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
      }
    }
  },
@@ -3,8 +3,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.128"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "drone-1",
@@ -56,7 +55,7 @@
    }
  },
  "run_list": [
-    "role[base]",
+    "recipe[kosmos-base]",
    "role[kvm_guest]",
    "role[drone]"
  ]
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.113"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "ejabberd-4",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.123"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "ejabberd-8",
@@ -39,7 +39,6 @@
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
      "kosmos_assets::nginx_site",
      "kosmos_blossom::nginx",
      "kosmos_discourse::nginx",
      "kosmos_drone::nginx",
      "kosmos_garage::nginx_web",
@@ -106,13 +105,13 @@
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.10.17",
+        "version": "18.2.7",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.2.7/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.13",
+        "version": "18.1.4",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
      }
    }
  },
@@ -0,0 +1,64 @@
 {
  "name": "garage-10",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.27"
    }
  },
  "automatic": {
    "fqdn": "garage-10",
    "os": "linux",
    "os_version": "5.4.0-1090-kvm",
    "hostname": "garage-10",
    "ipaddress": "192.168.122.70",
    "roles": [
      "base",
      "kvm_guest",
      "garage_node"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
      "kosmos_garage::firewall_apis",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
      "firewall::default"
    ],
    "platform": "ubuntu",
    "platform_version": "20.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.5.0",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.1.11",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[garage_node]"
  ]
 }
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.165"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "garage-11",
@@ -21,7 +20,6 @@
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_prometheus::node_exporter",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
@@ -32,7 +30,6 @@
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -1,18 +1,17 @@
 {
-  "name": "garage-16",
+  "name": "garage-12",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
-      "host": "10.1.1.153"
+      "host": "10.1.1.224"
-    },
+    }
    "vm_host": "leo"
  },
  "automatic": {
-    "fqdn": "garage-16",
+    "fqdn": "garage-12",
    "os": "linux",
-    "os_version": "6.8.0-106-generic",
+    "os_version": "5.15.0-1059-kvm",
-    "hostname": "garage-16",
+    "hostname": "garage-12",
-    "ipaddress": "192.168.122.182",
+    "ipaddress": "192.168.122.173",
    "roles": [
      "base",
      "kvm_guest",
@@ -21,7 +20,6 @@
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_prometheus::node_exporter",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
@@ -30,6 +28,8 @@
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
@@ -43,17 +43,17 @@
      "firewall::default"
    ],
    "platform": "ubuntu",
-    "platform_version": "24.04",
+    "platform_version": "22.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.10.17",
+        "version": "18.7.10",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.7.10/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.13",
+        "version": "18.2.5",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.5/lib/ohai"
      }
    }
  },
@@ -1,33 +1,35 @@
 {
-  "name": "prometheus-1",
+  "name": "garage-13",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
-      "host": "10.1.1.146"
+      "host": "10.1.1.179"
-    },
+    }
    "vm_host": "leo"
  },
  "automatic": {
-    "fqdn": "prometheus-1",
+    "fqdn": "garage-13",
    "os": "linux",
-    "os_version": "6.8.0-134-generic",
+    "os_version": "5.15.0-1059-kvm",
-    "hostname": "prometheus-1",
+    "hostname": "garage-13",
-    "ipaddress": "192.168.122.166",
+    "ipaddress": "192.168.122.27",
    "roles": [
      "base",
      "kvm_guest",
-      "prometheus_server"
+      "garage_node"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_prometheus::node_exporter",
      "kosmos_kvm::guest",
-      "kosmos_prometheus::server",
+      "kosmos_garage",
-      "kosmos_prometheus::alertmanager",
+      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
      "kosmos_garage::firewall_apis",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
@@ -41,23 +43,23 @@
      "firewall::default"
    ],
    "platform": "ubuntu",
-    "platform_version": "24.04",
+    "platform_version": "22.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.10.17",
+        "version": "18.7.10",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.7.10/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.13",
+        "version": "18.2.5",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.5/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
-    "role[prometheus_server]"
+    "role[garage_node]"
  ]
 }
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.151"
-    },
+    }
    "vm_host": "leo"
  },
  "automatic": {
    "fqdn": "garage-14",
@@ -21,7 +20,6 @@
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_prometheus::node_exporter",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.82"
-    },
+    }
    "vm_host": "leo"
  },
  "automatic": {
    "fqdn": "garage-15",
@@ -21,7 +20,6 @@
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_prometheus::node_exporter",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.40"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "garage-2",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.182"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "garage-7",
@@ -21,7 +20,6 @@
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_prometheus::node_exporter",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
@@ -32,7 +30,6 @@
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.61"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "garage-8",
@@ -21,7 +20,6 @@
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_prometheus::node_exporter",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
@@ -32,7 +30,6 @@
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -0,0 +1,64 @@
 {
  "name": "garage-9",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.223"
    }
  },
  "automatic": {
    "fqdn": "garage-9",
    "os": "linux",
    "os_version": "5.4.0-1090-kvm",
    "hostname": "garage-9",
    "ipaddress": "192.168.122.21",
    "roles": [
      "base",
      "kvm_guest",
      "garage_node"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_garage",
      "kosmos_garage::default",
      "kosmos_garage::firewall_rpc",
      "kosmos_garage::firewall_apis",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
      "firewall::default"
    ],
    "platform": "ubuntu",
    "platform_version": "20.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.5.0",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.1.11",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[garage_node]"
  ]
 }
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.21"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "gitea-2",
@@ -34,7 +33,7 @@
      "kosmos_gitea",
      "kosmos_gitea::default",
      "kosmos_gitea::backup",
-      "kosmos_gitea::runner",
+      "kosmos_gitea::act_runner",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
@@ -3,8 +3,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.198"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "ipfs-1",
@@ -61,7 +60,7 @@
    }
  },
  "run_list": [
-    "role[base]",
+    "recipe[kosmos-base]",
    "role[kvm_guest]",
    "role[ipfs_gateway]"
  ]
@@ -3,8 +3,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.6"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "ldap-3.kosmos.org",
@@ -58,7 +57,7 @@
    }
  },
  "run_list": [
-    "role[base]",
+    "recipe[kosmos-base]",
    "role[kvm_guest]",
    "role[dirsrv_supplier]"
  ]
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.106"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "ldap-4.kosmos.org",
@@ -1,15 +1,14 @@
 {
-  "name": "leo.kosmos.org",
+  "name": "leo",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
-      "host": "10.1.1.204"
+      "host": "leo.kosmos.org"
    }
  },
  "automatic": {
-    "fqdn": "leo.kosmos.org",
+    "fqdn": "leo",
    "os": "linux",
-    "os_version": "5.15.0-173-generic",
+    "os_version": "5.15.0-164-generic",
    "hostname": "leo",
    "ipaddress": "5.9.81.116",
    "roles": [
@@ -18,7 +17,6 @@
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_prometheus::node_exporter",
      "kosmos_kvm::host",
      "apt::default",
      "timezone_iii::default",
@@ -34,8 +32,7 @@
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
-      "hostname::default",
+      "hostname::default"
      "firewall::default"
    ],
    "platform": "ubuntu",
    "platform_version": "22.04",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.87"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "lq-1",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.188"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "lq-2",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.95"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "mail.kosmos.org",
@@ -31,7 +30,6 @@
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.30"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "mastodon-3",
@@ -84,7 +83,7 @@
    }
  },
  "run_list": [
-    "role[base]",
+    "recipe[kosmos-base]",
    "role[kvm_guest]",
    "role[ldap_client]",
    "role[garage_gateway]",
@@ -3,8 +3,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.138"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "nodejs-4",
@@ -1,18 +1,17 @@
 {
-  "name": "postgres-12",
+  "name": "postgres-10",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
-      "host": "10.1.1.134"
+      "host": "10.1.1.176"
-    },
+    }
    "vm_host": "her"
  },
  "automatic": {
-    "fqdn": "postgres-12",
+    "fqdn": "postgres-10",
    "os": "linux",
-    "os_version": "5.15.0-1096-kvm",
+    "os_version": "5.15.0-1095-kvm",
-    "hostname": "postgres-12",
+    "hostname": "postgres-10",
-    "ipaddress": "192.168.122.139",
+    "ipaddress": "192.168.122.41",
    "roles": [
      "base",
      "kvm_guest",
@@ -25,7 +24,6 @@
      "kosmos_postgresql::hostsfile",
      "kosmos_postgresql::replica",
      "kosmos_postgresql::firewall",
      "kosmos_postgresql::management_scripts",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
@@ -1,18 +1,16 @@
 {
-  "name": "postgres-11",
+  "name": "postgres-6",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
-      "host": "10.1.1.91"
+      "host": "10.1.1.196"
-    },
+    }
    "vm_host": "leo"
  },
  "automatic": {
-    "fqdn": "postgres-11",
+    "fqdn": "postgres-6",
    "os": "linux",
-    "os_version": "5.15.0-1095-kvm",
+    "os_version": "5.4.0-173-generic",
-    "hostname": "postgres-11",
+    "hostname": "postgres-6",
-    "ipaddress": "192.168.122.142",
+    "ipaddress": "192.168.122.60",
    "roles": [
      "base",
      "kvm_guest",
@@ -23,20 +21,18 @@
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_postgresql::primary",
      "kosmos_postgresql::firewall",
      "kosmos-akkounts::pg_db",
      "kosmos-bitcoin::lndhub-go_pg_db",
      "kosmos-bitcoin::nbxplorer_pg_db",
      "kosmos_drone::pg_db",
      "kosmos_gitea::pg_db",
      "kosmos-mastodon::pg_db",
      "kosmos_postgresql::firewall",
      "kosmos_postgresql::management_scripts",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
@@ -48,17 +44,17 @@
      "hostname::default"
    ],
    "platform": "ubuntu",
-    "platform_version": "22.04",
+    "platform_version": "20.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
-        "version": "18.10.17",
+        "version": "18.4.2",
-        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.10.17/lib",
+        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.4.2/lib",
        "chef_effortless": null
      },
      "ohai": {
-        "version": "18.2.13",
+        "version": "18.1.11",
-        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.13/lib/ohai"
+        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
      }
    }
  },
@@ -0,0 +1,62 @@
 {
  "name": "postgres-8",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.99"
    }
  },
  "automatic": {
    "fqdn": "postgres-8",
    "os": "linux",
    "os_version": "5.15.0-1059-kvm",
    "hostname": "postgres-8",
    "ipaddress": "192.168.122.100",
    "roles": [
      "base",
      "kvm_guest",
      "postgresql_replica"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_postgresql::hostsfile",
      "kosmos_postgresql::replica",
      "kosmos_postgresql::firewall",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default"
    ],
    "platform": "ubuntu",
    "platform_version": "22.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.5.0",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.5.0/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.1.11",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.11/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[postgresql_replica]"
  ]
 }
@@ -0,0 +1,63 @@
 {
  "name": "postgres-9",
  "chef_environment": "production",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.3"
    }
  },
  "automatic": {
    "fqdn": "postgres-9",
    "os": "linux",
    "os_version": "5.15.0-1059-kvm",
    "hostname": "postgres-9",
    "ipaddress": "192.168.122.64",
    "roles": [
      "base",
      "kvm_guest",
      "postgresql_replica"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_postgresql::hostsfile",
      "kosmos_postgresql::replica",
      "kosmos_postgresql::firewall",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::journald_conf",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default"
    ],
    "platform": "ubuntu",
    "platform_version": "22.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.8.54",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.8.54/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.2.8",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.2.8/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[postgresql_replica]"
  ]
 }
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.225"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "redis-1",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.208"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "redis-2",
@@ -3,8 +3,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.187"
-    },
+    }
    "vm_host": "fornax"
  },
  "automatic": {
    "fqdn": "rs-discourse-1",
@@ -56,7 +55,7 @@
    }
  },
  "run_list": [
-    "role[base]",
+    "recipe[kosmos-base]",
    "role[kvm_guest]",
    "role[remotestorage_discourse]"
  ]
@@ -3,8 +3,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.150"
-    },
+    }
    "vm_host": "her"
  },
  "automatic": {
    "fqdn": "rsk-mainnet-3",
@@ -3,8 +3,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.126"
-    },
+    }
    "vm_host": "her"
  },
  "automatic": {
    "fqdn": "rsk-testnet-4",
@@ -0,0 +1,61 @@
 {
  "name": "rsk-testnet-5",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.194"
    }
  },
  "automatic": {
    "fqdn": "rsk-testnet-5",
    "os": "linux",
    "os_version": "5.4.0-1103-kvm",
    "hostname": "rsk-testnet-5",
    "ipaddress": "192.168.122.171",
    "roles": [
      "base",
      "kvm_guest",
      "rskj_testnet"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos_rsk::rskj",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
      "kosmos_rsk::firewall",
      "firewall::default"
    ],
    "platform": "ubuntu",
    "platform_version": "20.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "18.3.0",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/chef-18.3.0/lib",
        "chef_effortless": null
      },
      "ohai": {
        "version": "18.1.4",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/3.1.0/gems/ohai-18.1.4/lib/ohai"
      }
    }
  },
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
    "role[rskj_testnet]"
  ]
 }
@@ -3,8 +3,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.20"
-    },
+    }
    "vm_host": "leo"
  },
  "automatic": {
    "fqdn": "rsk-testnet-6",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.132"
-    },
+    }
    "vm_host": "her"
  },
  "automatic": {
    "fqdn": "sentry-1",
@@ -4,8 +4,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.164"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "strfry-1",
@@ -17,8 +16,7 @@
      "base",
      "kvm_guest",
      "strfry",
-      "ldap_client",
+      "ldap_client"
      "blossom"
    ],
    "recipes": [
      "kosmos-base",
@@ -30,8 +28,6 @@
      "kosmos_strfry::policies",
      "kosmos_strfry::firewall",
      "kosmos_strfry::substr",
      "kosmos_blossom",
      "kosmos_blossom::default",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
@@ -47,8 +43,7 @@
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
-      "deno::default",
+      "deno::default"
      "blossom::default"
    ],
    "platform": "ubuntu",
    "platform_version": "22.04",
@@ -68,7 +63,6 @@
  "run_list": [
    "role[base]",
    "role[kvm_guest]",
-    "role[strfry]",
+    "role[strfry]"
    "role[blossom]"
  ]
 }
@@ -0,0 +1,67 @@
 {
  "name": "uploads-1",
  "normal": {
    "knife_zero": {
      "host": "10.1.1.98"
    }
  },
  "automatic": {
    "fqdn": "uploads-1",
    "os": "linux",
    "os_version": "5.4.0-128-generic",
    "hostname": "uploads-1",
    "ipaddress": "192.168.122.230",
    "roles": [
      "kvm_guest"
    ],
    "recipes": [
      "kosmos-base",
      "kosmos-base::default",
      "kosmos_kvm::guest",
      "kosmos-ejabberd::upload_service",
      "apt::default",
      "timezone_iii::default",
      "timezone_iii::debian",
      "ntp::default",
      "ntp::apparmor",
      "kosmos-base::systemd_emails",
      "apt::unattended-upgrades",
      "kosmos-base::firewall",
      "kosmos-postfix::default",
      "postfix::default",
      "postfix::_common",
      "postfix::_attributes",
      "postfix::sasl_auth",
      "hostname::default",
      "kosmos-nginx::with_perl",
      "nginx::default",
      "nginx::package",
      "nginx::ohai_plugin",
      "nginx::repo",
      "nginx::commons",
      "nginx::commons_dir",
      "nginx::commons_script",
      "nginx::commons_conf",
      "kosmos-nginx::firewall",
      "kosmos-base::letsencrypt"
    ],
    "platform": "ubuntu",
    "platform_version": "20.04",
    "cloud": null,
    "chef_packages": {
      "chef": {
        "version": "15.14.0",
        "chef_root": "/opt/chef/embedded/lib/ruby/gems/2.6.0/gems/chef-15.14.0/lib"
      },
      "ohai": {
        "version": "15.12.0",
        "ohai_root": "/opt/chef/embedded/lib/ruby/gems/2.6.0/gems/ohai-15.12.0/lib/ohai"
      }
    }
  },
  "run_list": [
    "recipe[kosmos-base]",
    "role[kvm_guest]",
    "recipe[kosmos-ejabberd::upload_service]"
  ]
 }
@@ -3,8 +3,7 @@
  "normal": {
    "knife_zero": {
      "host": "10.1.1.206"
-    },
+    }
    "vm_host": "draco"
  },
  "automatic": {
    "fqdn": "wiki-1",
@@ -2,5 +2,4 @@ name "base"
 run_list %w(
  kosmos-base::default
  kosmos_prometheus::node_exporter
 )
@@ -1,16 +0,0 @@
 name "blossom"
 override_attributes(
  "blossom" => {
    "allowed_pubkeys" => [
      # "b3e1b7c0ef48294bd856203bfd460625de95d3afb894e5f09b14cd1f0e7097cf",
      # "07e188a1ff87ce171d517b8ed2bb7a31b1d3453a0db3b15379ec07b724d232f3",
      # "898a73f2c1f9a9f42d9ef4ac363622f92fdd4290c8f190340a0862d8e0f70046"
    ]
  },
 )
 run_list %w(
  role[ldap_client]
  kosmos_blossom::default
 )
@@ -1,5 +1,5 @@
 name "gitea_actions_runner"
 run_list %w(
-  kosmos_gitea::runner
+  kosmos_gitea::act_runner
 )
@@ -19,7 +19,6 @@ production_run_list = %w(
  role[openresty]
  role[garage_gateway]
  kosmos_assets::nginx_site
  kosmos_blossom::nginx
  kosmos_discourse::nginx
  kosmos_drone::nginx
  kosmos_garage::nginx_web
@@ -1,13 +1,12 @@
 name "postgresql_primary"
-run_list [
+run_list %w(
-  "kosmos_postgresql::primary",
+  kosmos_postgresql::primary
-  "kosmos-akkounts::pg_db",
+  kosmos_postgresql::firewall
-  "kosmos-bitcoin::lndhub-go_pg_db",
+  kosmos-akkounts::pg_db
-  "kosmos-bitcoin::nbxplorer_pg_db",
+  kosmos-bitcoin::lndhub-go_pg_db
-  "kosmos_drone::pg_db",
+  kosmos-bitcoin::nbxplorer_pg_db
-  "kosmos_gitea::pg_db",
+  kosmos_drone::pg_db
-  "kosmos-mastodon::pg_db",
+  kosmos_gitea::pg_db
-  "kosmos_postgresql::firewall",
+  kosmos-mastodon::pg_db
-  "kosmos_postgresql::management_scripts"
+)
 ]
@@ -1,8 +1,7 @@
 name "postgresql_replica"
-run_list [
+run_list %w(
-  "kosmos_postgresql::hostsfile",
+  kosmos_postgresql::hostsfile
-  "kosmos_postgresql::replica",
+  kosmos_postgresql::replica
-  "kosmos_postgresql::firewall",
+  kosmos_postgresql::firewall
-  "kosmos_postgresql::management_scripts"
+)
 ]
@@ -1,8 +0,0 @@
 name "postgresql_replica_logical"
 run_list [
  "kosmos_postgresql::hostsfile",
  "kosmos_postgresql::replica_logical",
  "kosmos_postgresql::firewall",
  "kosmos_postgresql::management_scripts"
 ]
@@ -1,12 +0,0 @@
 name "prometheus_server"
 default_run_list = [
  "kosmos_prometheus::server",
  "kosmos_prometheus::alertmanager"
 ]
 env_run_lists(
  "_default" => default_run_list,
  "development" => default_run_list,
  "production" => default_run_list
 )
@@ -1,69 +0,0 @@
 #!/usr/bin/env bash
 # Strip the top-level "override" and "default" attributes from Chef node JSON files.
 #
 # Usage:
 #   ./scripts/util/strip_node_attrs.sh <node> [<node> ...]
 #   ./scripts/util/strip_node_attrs.sh --all
 #
 # A <node> may be a bare node name (e.g. "prometheus-1"), a path relative to the
 # repository root (e.g. "nodes/prometheus-1.json"), or an absolute path.
 #
 # Exit codes:
 #   0 - all target files processed successfully
 #   1 - one or more targets could not be processed (missing args, missing jq,
 #       file not found, invalid JSON, or write failure)
 set -uo pipefail
 command -v jq >/dev/null 2>&1 || exit 1
 root="$(git rev-parse --show-toplevel 2>/dev/null)" || root="$(pwd)"
 targets=()
 if [ "$#" -eq 0 ]; then
  exit 1
 fi
 for arg in "$@"; do
  if [ "$arg" = "--all" ]; then
    shopt -s nullglob
    for f in "$root"/nodes/*.json; do
      targets+=("$f")
    done
    shopt -u nullglob
    continue
  fi
  if [[ "$arg" == */* ]]; then
    if [[ "$arg" = /* ]]; then
      targets+=("$arg")
    else
      targets+=("$root/$arg")
    fi
  else
    targets+=("$root/nodes/$arg.json")
  fi
 done
 if [ "${#targets[@]}" -eq 0 ]; then
  exit 1
 fi
 rc=0
 for file in "${targets[@]}"; do
  [ -f "$file" ] || { rc=1; continue; }
  jq -e . "$file" >/dev/null 2>&1 || { rc=1; continue; }
  tmp="$(mktemp "${file}.XXXXXX")" || { rc=1; continue; }
  if jq --indent 2 'del(.override, .default)' "$file" > "$tmp" 2>/dev/null; then
    truncate -s -1 "$tmp" 2>/dev/null || true
    mv "$tmp" "$file" || { rm -f "$tmp"; rc=1; continue; }
  else
    rm -f "$tmp"
    rc=1
    continue
  fi
 done
 exit "$rc"
@@ -230,6 +230,7 @@ systemd_unit "akkounts.service" do
      WorkingDirectory: deploy_path,
      Environment: "RAILS_ENV=#{rails_env} SOLID_QUEUE_IN_PUMA=true",
      ExecStart: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid",
      ExecStop: "#{bundle_path} exec puma -C config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid stop",
      ExecReload: "#{bundle_path} exec pumactl -F config/puma.rb --pidfile #{deploy_path}/tmp/puma.pid phased-restart",
      PIDFile: "#{deploy_path}/tmp/puma.pid",
      TimeoutSec: "10",
@@ -1,6 +0,0 @@
 ---
 - knife_zero
 - kosmos_kvm
 - kosmos-ejabberd
 - openresty
 - vm_host
@@ -24,44 +24,11 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 # THE SOFTWARE.
-include_recipe "apt"
+include_recipe 'apt'
-
+include_recipe 'timezone_iii'
-cookbook_file "/etc/chef/chef_normal_attributes.yml" do
+include_recipe 'ntp'
-  source "chef_normal_attributes.yml"
+include_recipe 'kosmos-base::journald_conf'
-  owner "root"
+include_recipe 'kosmos-base::systemd_emails'
  group "root"
  mode "0644"
 end
 ruby_block "update allowed_normal_attributes in client.rb" do
  block do
    whitelist = YAML.load_file("/etc/chef/chef_normal_attributes.yml")
    fe = Chef::Util::FileEdit.new("/etc/chef/client.rb")
    fe.search_file_replace_line(
      /^allowed_normal_attributes.*/,
      "allowed_normal_attributes #{whitelist.inspect}"
    )
    fe.write_file
    Chef::Config[:allowed_normal_attributes] = whitelist
    Chef::Config[:normal_attribute_allowlist] = whitelist
  end
  not_if do
    whitelist = YAML.load_file("/etc/chef/chef_normal_attributes.yml")
    client_rb = ::File.read("/etc/chef/client.rb")
    whitelist.all? { |attr| client_rb.include?(attr) }
  end
 end
 directory "/etc/apt/keyrings" do
  mode "0755"
  action :create
 end
 include_recipe "timezone_iii"
 include_recipe "ntp" if node["platform"] == "ubuntu" && node["platform_version"].to_f < 24.04
 include_recipe "kosmos-base::journald_conf"
 include_recipe "kosmos-base::systemd_emails"
 node.override["apt"]["unattended_upgrades"]["enable"] = true
 node.override["apt"]["unattended_upgrades"]["mail_only_on_error"] = false
@@ -76,20 +43,20 @@ node.override["apt"]["unattended_upgrades"]["allowed_origins"] = [
 ]
 node.override["apt"]["unattended_upgrades"]["mail"] = "ops@kosmos.org"
 node.override["apt"]["unattended_upgrades"]["syslog_enable"] = true
-include_recipe "apt::unattended-upgrades"
+include_recipe 'apt::unattended-upgrades'
-package "mailutils"
+package 'mailutils'
-package "mosh"
+package 'mosh'
-package "vim"
+package 'vim'
 # Don't create users and rewrite the sudo config in development environment.
 # It breaks the vagrant user
 unless node.chef_environment == "development"
  # Searches data bag "users" for groups attribute "sysadmin".
  # Places returned users in Unix group "sysadmin" with GID 2300.
-  users_manage "sysadmin" do
+  users_manage 'sysadmin' do
    group_id 2300
-    action %i[remove create]
+    action [:remove, :create]
  end
  sudo "sysadmin" do
@@ -98,35 +65,35 @@ unless node.chef_environment == "development"
    defaults [
    # not default on Ubuntu, explicitely enable. Uses a minimal white list of
    # environment variables
-      "env_reset",
+    'env_reset',
    # Send emails on unauthorized attempts
-      "mail_badpass",
+    'mail_badpass',
-      'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"'
+    'secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"',
    ]
  end
  include_recipe "kosmos-base::firewall"
-  include_recipe "kosmos-postfix"
+  include_recipe 'kosmos-postfix'
-  node.override["set_fqdn"] = "*"
+  node.override['set_fqdn'] = '*'
-  include_recipe "hostname"
+  include_recipe 'hostname'
-  package "ca-certificates"
+  package 'ca-certificates'
-  directory "/usr/local/share/ca-certificates/cacert" do
+  directory '/usr/local/share/ca-certificates/cacert' do
    action :create
  end
-  ["http://www.cacert.org/certs/root.crt", "http://www.cacert.org/certs/class3.crt"].each do |cert|
+  ['http://www.cacert.org/certs/root.crt', 'http://www.cacert.org/certs/class3.crt'].each do |cert|
    remote_file "/usr/local/share/ca-certificates/cacert/#{File.basename(cert)}" do
      source cert
      action :create_if_missing
-      notifies :run, "execute[update-ca-certificates]", :immediately
+      notifies :run, 'execute[update-ca-certificates]', :immediately
    end
  end
-  execute "update-ca-certificates" do
+  execute 'update-ca-certificates' do
    action :nothing
  end
 end
@@ -10,10 +10,10 @@ tor_service "ejabberd" do
  public_key tor_services['ejabberd']['public_key']
  secret_key tor_services['ejabberd']['secret_key']
  # TODO configure IP from node attribute
-  # (This is hardcoded for ejabberd-4 atm)
+  # (This is hardcoded for draco atm)
-  ports      [ "5222 10.1.1.113:5222",
+  ports      [ "5222 148.251.237.73:5222",
-               "5223 10.1.1.113:5223",
+               "5223 148.251.237.73:5223",
-               "5269 10.1.1.113:5269" ]
+               "5269 148.251.237.73:5269" ]
 end
 tor_service "web" do
@@ -86,6 +86,9 @@ node.default['lndhub-go']['branding'] = {
  'footer' => 'about=https://kosmos.org'
 }
 node.default['dotnet']['ms_packages_src_url'] = "https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb"
 node.default['dotnet']['ms_packages_src_checksum'] = "4df5811c41fdded83eb9e2da9336a8dfa5594a79dc8a80133bd815f4f85b9991"
 node.default['nbxplorer']['repo'] = 'https://github.com/dgarage/NBXplorer'
 node.default['nbxplorer']['revision'] = 'v2.5.26'
 node.default['nbxplorer']['source_dir'] = '/opt/nbxplorer'
@@ -95,7 +98,7 @@ node.default['nbxplorer']['postgres']['database'] = 'nbxplorer'
 node.default['nbxplorer']['postgres']['user'] = 'nbxplorer'
 node.default['btcpay']['repo'] = 'https://github.com/btcpayserver/btcpayserver'
-node.default['btcpay']['revision'] = 'v2.3.7'
+node.default['btcpay']['revision'] = 'v2.1.1'
 node.default['btcpay']['source_dir'] = '/opt/btcpay'
 node.default['btcpay']['config_path'] = "/home/#{node['bitcoin']['username']}/.btcpayserver/Main/settings.config"
 node.default['btcpay']['log_path'] = "/home/#{node['bitcoin']['username']}/.btcpayserver/debug.log"
@@ -5,16 +5,29 @@
 build_essential
-remote_file "/opt/dotnet-install.sh" do
+apt_repository 'universe' do
-  source "https://dot.net/v1/dotnet-install.sh"
+  uri 'http://archive.ubuntu.com/ubuntu/'
-  mode "0755"
+  distribution 'focal'
  components ['universe']
 end
-execute "install_dotnet_10" do
+apt_package 'apt-transport-https'
-  command "/opt/dotnet-install.sh -c 10.0 --install-dir /usr/share/dotnet"
+
-  not_if '/usr/share/dotnet/dotnet --version | grep -q "^10\."'
+remote_file '/opt/packages-microsoft-prod.deb' do
  source node['dotnet']['ms_packages_src_url']
  checksum node['dotnet']['ms_packages_src_checksum']
  action :create_if_missing
 end
-link "/usr/bin/dotnet" do
+dpkg_package 'packages-microsoft-prod' do
-  to "/usr/share/dotnet/dotnet"
+  source '/opt/packages-microsoft-prod.deb'
  action :install
  notifies :run, 'execute[apt_update]'
 end
 execute 'apt_update' do
  command 'apt update'
  action :nothing
 end
 apt_package 'dotnet-sdk-8.0'
@@ -1 +0,0 @@
 # No attributes here, use the blossom cookbook's attributes
@@ -1,6 +0,0 @@
 name 'kosmos_blossom'
 description 'Configures Blossom server for Kosmos infrastructure'
 version '0.1.0'
 depends 'blossom'
 depends 'kosmos-base'
 depends 'kosmos_openresty'
@@ -1,38 +0,0 @@
 #
 # Cookbook Name:: kosmos_blossom
 # Recipe:: default
 #
 credentials = Chef::EncryptedDataBagItem.load('credentials', 'blossom')
 ldap_credentials = Chef::EncryptedDataBagItem.load('credentials', 'dirsrv')
 node.default['blossom']['repo_url'] = 'https://github.com/67P/blossom-server.git'
 node.default['blossom']['revision'] = 'feature/ldap'
 node.default['blossom']['storage']['backend'] = 's3'
 node.default['blossom']['storage']['s3']['access_key'] = credentials['s3_access_key']
 node.default['blossom']['storage']['s3']['secret_key'] = credentials['s3_secret_key']
 node.default['blossom']['allow_anonymous_uploads'] = false
 node.default['blossom']['ldap']['enabled'] = true
 node.default['blossom']['ldap']['url'] = 'ldap://ldap.kosmos.local:389'
 node.default['blossom']['ldap']['bind_dn'] = ldap_credentials["service_dn"]
 node.default['blossom']['ldap']['password'] = ldap_credentials["service_password"]
 node.default['blossom']['ldap']['search_dn'] = "ou=kosmos.org,cn=users,dc=kosmos,dc=org"
 node.default['blossom']['ldap']['search_filter'] = "(nostrKey={pubkey})"
 node.default['blossom']['dashboard']['enabled'] = true
 node.default['blossom']['dashboard']['username'] = credentials['admin_username'] || 'admin'
 node.default['blossom']['dashboard']['password'] = credentials['admin_password']
 node.default['blossom']['landing']['title'] = 'Kosmos Blossom Server'
 include_recipe 'blossom::default'
 firewall_rule 'blossom' do
  port     node['blossom']['port']
  source   '10.1.1.0/24'
  protocol :tcp
  command  :allow
 end
@@ -1,28 +0,0 @@
 #
 # Cookbook Name:: kosmos_blossom
 # Recipe:: nginx
 #
 domain = node['blossom']['domain']
 blossom_node = search(:node, 'role:blossom').first
 if blossom_node.nil?
  Chef::Log.warn("No node found with 'blossom' role. Not configuring nginx site.")
  return
 end
 tls_cert_for domain do
  auth 'gandi_dns'
  action :create
 end
 openresty_site domain do
  template 'nginx_conf_blossom.erb'
  variables domain: domain,
            upstream_host: blossom_node['knife_zero']['host'],
            upstream_port: node['blossom']['port'],
            max_size_mb: node['blossom']['max_size'] / 1024 / 1024,
            ssl_cert: "/etc/letsencrypt/live/#{domain}/fullchain.pem",
            ssl_key: "/etc/letsencrypt/live/#{domain}/privkey.pem"
 end
@@ -1,26 +0,0 @@
 upstream _blossom {
  server <%= @upstream_host %>:<%= @upstream_port %>;
 }
 server {
  server_name <%= @domain %>;
  listen <%= "#{node['openresty']['listen_ip']}:" if node['openresty']['listen_ip'] %>443 ssl http2;
  listen <%= "[#{node['openresty']['listen_ipv6']}]" %>:443 ssl http2;
  access_log "/var/log/nginx/<%= @domain %>.access.log";
  error_log "/var/log/nginx/<%= @domain %>.error.log";
  client_max_body_size <%= @max_size_mb %>M;
  ssl_certificate <%= @ssl_cert %>;
  ssl_certificate_key <%= @ssl_key %>;
  location / {
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_pass http://_blossom;
    proxy_http_version 1.1;
  }
 }
@@ -1,6 +1,2 @@
 node.default["kosmos_drone"]["domain"] = "drone.kosmos.org"
 node.default["kosmos_drone"]["upstream_port"] = 80
 node.default["kosmos_drone"]["pg_host"] = "pg.kosmos.local"
 node.default["kosmos_drone"]["pg_port"] = 5432
 node.default["kosmos_drone"]["pg_db"] = "drone"
 node.default["kosmos_drone"]["pg_user"] = "drone"
@@ -9,11 +9,11 @@ credentials = data_bag_item("credentials", "drone")
 drone_credentials = data_bag_item('credentials', 'drone')
 postgres_config = {
-  host: node["kosmos_drone"]["pg_host"],
+  username: "drone",
-  port: node["kosmos_drone"]["pg_port"],
+  password: drone_credentials["postgresql_password"],
-  database: node["kosmos_drone"]["pg_db"],
+  host: "pg.kosmos.local",
-  username: node["kosmos_drone"]["pg_user"],
+  port: 5432,
-  password: drone_credentials["postgresql_password"]
+  database: "drone"
 }
 directory deploy_path do
@@ -1,5 +1,5 @@
-node.default["gitea"]["version"] = "1.26.4"
+node.default["gitea"]["version"] = "1.25.4"
-node.default["gitea"]["checksum"] = "0faa36d151918f8f7d6e0f3ae67597d1c338583d695add146ac393109d0fc44a"
+node.default["gitea"]["checksum"] = "a3031853e67c53714728ef705642c9046a11fb0ea356aff592e23efe6114607d"
 node.default["gitea"]["repo"] = nil
 node.default["gitea"]["revision"] = nil
 node.default["gitea"]["working_directory"] = "/var/lib/gitea"
@@ -23,5 +23,5 @@ node.default["gitea"]["config"] = {
  }
 }
-node.default["gitea"]["runner"]["version"] = "2.0.0"
+node.default["gitea"]["act_runner"]["version"] = "0.2.13"
-node.default["gitea"]["runner"]["checksum"] = "447156b33407ee045409f5552bd4a188a315cdd4085b4b498d8d4a9ad26c9f73"
+node.default["gitea"]["act_runner"]["checksum"] = "3acac8b506ac8cadc88a55155b5d6378f0fab0b8f62d1e0c0450f4ccd69733e2"
@@ -1,10 +1,10 @@
 #
 # Cookbook:: kosmos_gitea
-# Recipe:: runner
+# Recipe:: act_runner
 #
-version           = node["gitea"]["runner"]["version"]
+version           = node["gitea"]["act_runner"]["version"]
-download_url      = "https://dl.gitea.com/gitea-runner/#{version}/gitea-runner-#{version}-linux-amd64"
+download_url      = "https://dl.gitea.com/act_runner/#{version}/act_runner-#{version}-linux-amd64"
 working_directory = node["gitea"]["working_directory"]
 gitea_credentials = data_bag_item("credentials", "gitea")
 runners           = gitea_credentials["runners"]
@@ -25,9 +25,9 @@ end
  package apt_pkg
 end
-remote_file "/usr/local/bin/gitea_runner" do
+remote_file "/usr/local/bin/act_runner" do
  source download_url
-  checksum node["gitea"]["runner"]["checksum"]
+  checksum node["gitea"]["act_runner"]["checksum"]
  mode "0750"
 end
@@ -46,7 +46,7 @@ runners.each do |runner|
  bash "register_#{runner["org"]}_runner" do
    cwd runner_dir
    code <<-EOF
-gitea_runner register \
+act_runner register \
  --no-interactive \
  --instance #{gitea_host} \
  --name #{runner_name} \
@@ -59,7 +59,7 @@ gitea_runner register \
    content({
      Unit: {
        Description: "Gitea Actions Runner for '#{runner["org"]}' org",
-        Documentation: ["https://gitea.com/gitea/runner"],
+        Documentation: ["https://gitea.com/gitea/act_runner"],
        Requires: "gitea.service",
        After: "syslog.target network.target"
      },
@@ -67,7 +67,7 @@ gitea_runner register \
        Type: "simple",
        WorkingDirectory: runner_dir,
        Environment: "HOME=/root",
-        ExecStart: "/usr/local/bin/gitea_runner daemon",
+        ExecStart: "/usr/local/bin/act_runner daemon",
        ExecStartPre: "/bin/sleep 3", # Wait for Gitea's API to be up when restarting at the same time
        Restart: "always",
      },
@@ -75,6 +75,10 @@ DEFAULT_ALLOW_CREATE_ORGANIZATION = false
 DEFAULT_ENABLE_TIMETRACKING       = false
 NO_REPLY_ADDRESS                  = noreply.kosmos.org
 [picture]
 DISABLE_GRAVATAR        = false
 ENABLE_FEDERATED_AVATAR = true
 [openid]
 ENABLE_OPENID_SIGNIN = false
 ENABLE_OPENID_SIGNUP = false
@@ -18,8 +18,6 @@ server {
  client_max_body_size 121M;
  proxy_intercept_errors on;
  location ~ ^/(avatars|repo-avatars)/.*$ {
    proxy_buffers 1024 8k;
    proxy_pass http://_gitea_web;
@@ -54,18 +52,5 @@ server {
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    error_page 404 = @slow_404;
  }
  # Slow down 404 responses to make scraping random URLs less attractive
  location @slow_404 {
    internal;
    default_type text/plain;
    content_by_lua_block {
      ngx.sleep(10)
      ngx.status = 404
      ngx.say("Not Found")
      ngx.exit(ngx.HTTP_NOT_FOUND)
    }
  }
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
raucao	a5f2c3d257	Automatically determine OS package name Co-authored-by: Greg Karékinian <greg@karekinian.com>	2026-04-12 14:31:13 +04:00
raucao	b0cdeac30e	Add new RSK testnet VM	2026-04-12 08:52:24 +04:00
raucao	1c6bf34386	Upgrade rskj to v9.0.1 and Ubuntu 24.04	2026-04-11 19:16:19 +04:00
`@@ -1,3 +1,3 @@`
	`source 'https://rubygems.org'`	`source 'https://rubygems.org'`

	`gem 'knife-zero', '~> 2.6.0'`	`gem 'knife-zero', '>= 2.4.2'`
		`@@ -1 +0,0 @@`
			`# No attributes here, use the blossom cookbook's attributes`