Update Ubuntu base image to release-20261017

Refresh the noble cloud image so newly created VMs start with fewer pending
package upgrades. Old base images are left in place.

.chef/config.rb.example

@@ -12,3 +12,7 @@ local_mode                true # Chef local mode, replacing Solo
 # https://docs.chef.io/attribute_persistence/
 # Source of truth: site-cookbooks/kosmos-base/files/default/chef_attributes.rb
 client_d_dir(File.expand_path("../site-cookbooks/kosmos-base/files/default/chef_attributes.rb"))
+
+# Chef binaries on packages.chef.io are license-gated (HTTP 402); use the
+# community Cinc build for bootstraps and converged nodes.
+knife[:alter_project] = "cinc"

site-cookbooks/kosmos-base/files/default/cacert/class3.crt

@@ -0,0 +1,42 @@
+-----BEGIN CERTIFICATE-----
+MIIHWTCCBUGgAwIBAgIDCkGKMA0GCSqGSIb3DQEBCwUAMHkxEDAOBgNVBAoTB1Jv
+b3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAGA1UEAxMZ
+Q0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYSc3VwcG9y
+dEBjYWNlcnQub3JnMB4XDTExMDUyMzE3NDgwMloXDTIxMDUyMDE3NDgwMlowVDEU
+MBIGA1UEChMLQ0FjZXJ0IEluYy4xHjAcBgNVBAsTFWh0dHA6Ly93d3cuQ0FjZXJ0
+Lm9yZzEcMBoGA1UEAxMTQ0FjZXJ0IENsYXNzIDMgUm9vdDCCAiIwDQYJKoZIhvcN
+AQEBBQADggIPADCCAgoCggIBAKtJNRFIfNImflOUz0Op3SjXQiqL84d4GVh8D57a
+iX3h++tykA10oZZkq5+gJJlz2uJVdscXe/UErEa4w75/ZI0QbCTzYZzA8pD6Ueb1
+aQFjww9W4kpCz+JEjCUoqMV5CX1GuYrz6fM0KQhF5Byfy5QEHIGoFLOYZcRD7E6C
+jQnRvapbjZLQ7N6QxX8KwuPr5jFaXnQ+lzNZ6MMDPWAzv/fRb0fEze5ig1JuLgia
+pNkVGJGmhZJHsK5I6223IeyFGmhyNav/8BBdwPSUp2rVO5J+TJAFfpPBLIukjmJ0
+FXFuC3ED6q8VOJrU0gVyb4z5K+taciX5OUbjchs+BMNkJyIQKopPWKcDrb60LhPt
+XapI19V91Cp7XPpGBFDkzA5CW4zt2/LP/JaT4NsRNlRiNDiPDGCbO5dWOK3z0luL
+oFvqTpa4fNfVoIZwQNORKbeiPK31jLvPGpKK5DR7wNhsX+kKwsOnIJpa3yxdUly6
+R9Wb7yQocDggL9V/KcCyQQNokszgnMyXS0XvOhAKq3A6mJVwrTWx6oUrpByAITGp
+rmB6gCZIALgBwJNjVSKRPFbnr9s6JfOPMVTqJouBWfmh0VMRxXudA/Z0EeBtsSw/
+LIaRmXGapneLNGDRFLQsrJ2vjBDTn8Rq+G8T/HNZ92ZCdB6K4/jc0m+YnMtHmJVA
+BfvpAgMBAAGjggINMIICCTAdBgNVHQ4EFgQUdahxYEyIE/B42Yl3tW3Fid+8sXow
+gaMGA1UdIwSBmzCBmIAUFrUyG9TH8+DmjvO90rA67rI5GNGhfaR7MHkxEDAOBgNV
+BAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEiMCAG
+A1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJARYS
+c3VwcG9ydEBjYWNlcnQub3JnggEAMA8GA1UdEwEB/wQFMAMBAf8wXQYIKwYBBQUH
+AQEEUTBPMCMGCCsGAQUFBzABhhdodHRwOi8vb2NzcC5DQWNlcnQub3JnLzAoBggr
+BgEFBQcwAoYcaHR0cDovL3d3dy5DQWNlcnQub3JnL2NhLmNydDBKBgNVHSAEQzBB
+MD8GCCsGAQQBgZBKMDMwMQYIKwYBBQUHAgEWJWh0dHA6Ly93d3cuQ0FjZXJ0Lm9y
+Zy9pbmRleC5waHA/aWQ9MTAwNAYJYIZIAYb4QgEIBCcWJWh0dHA6Ly93d3cuQ0Fj
+ZXJ0Lm9yZy9pbmRleC5waHA/aWQ9MTAwUAYJYIZIAYb4QgENBEMWQVRvIGdldCB5
+b3VyIG93biBjZXJ0aWZpY2F0ZSBmb3IgRlJFRSwgZ28gdG8gaHR0cDovL3d3dy5D
+QWNlcnQub3JnMA0GCSqGSIb3DQEBCwUAA4ICAQApKIWuRKm5r6R5E/CooyuXYPNc
+7uMvwfbiZqARrjY3OnYVBFPqQvX56sAV2KaC2eRhrnILKVyQQ+hBsuF32wITRHhH
+Va9Y/MyY9kW50SD42CEH/m2qc9SzxgfpCYXMO/K2viwcJdVxjDm1Luq+GIG6sJO4
+D+Pm1yaMMVpyA4RS5qb1MyJFCsgLDYq4Nm+QCaGrvdfVTi5xotSu+qdUK+s1jVq3
+VIgv7nSf7UgWyg1I0JTTrKSi9iTfkuO960NAkW4cGI5WtIIS86mTn9S8nK2cde5a
+lxuV53QtHA+wLJef+6kzOXrnAzqSjiL2jA3k2X4Ndhj3AfnvlpaiVXPAPHG0HRpW
+Q7fDCo1y/OIQCQtBzoyUoPkD/XFzS4pXM+WOdH4VAQDmzEoc53+VGS3FpQyLu7Xt
+hbNc09+4ufLKxw0BFKxwWMWMjTPUnWajGlCVI/xI4AZDEtnNp4Y5LzZyo4AQ5OHz
+0ctbGsDkgJp8E3MGT9ujayQKurMcvEp4u+XjdTilSKeiHq921F73OIZWWonO1sOn
+ebJSoMbxhbQljPI/lrMQ2Y1sVzufb4Y6GIIiNsiwkTjbKqGTqoQ/9SdlrnPVyNXT
+d+pLncdBu8fA46A/5H2kjXPmEkvfoXNzczqA6NXLji/L6hOn1kGLrPo8idck9U60
+4GGSt/M3mMS+lqO3ig==
+-----END CERTIFICATE-----

site-cookbooks/kosmos-base/files/default/cacert/root.crt

@@ -0,0 +1,41 @@
+-----BEGIN CERTIFICATE-----
+MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290
+IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB
+IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA
+Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO
+BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi
+MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ
+ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
+CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ
+8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6
+zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y
+fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7
+w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc
+G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k
+epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q
+laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ
+QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU
+fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826
+YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAc4w
+ggHKMB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TCBowYDVR0jBIGbMIGY
+gBQWtTIb1Mfz4OaO873SsDrusjkY0aF9pHsweTEQMA4GA1UEChMHUm9vdCBDQTEe
+MBwGA1UECxMVaHR0cDovL3d3dy5jYWNlcnQub3JnMSIwIAYDVQQDExlDQSBDZXJ0
+IFNpZ25pbmcgQXV0aG9yaXR5MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QGNhY2Vy
+dC5vcmeCAQAwDwYDVR0TAQH/BAUwAwEB/zAyBgNVHR8EKzApMCegJaAjhiFodHRw
+czovL3d3dy5jYWNlcnQub3JnL3Jldm9rZS5jcmwwMAYJYIZIAYb4QgEEBCMWIWh0
+dHBzOi8vd3d3LmNhY2VydC5vcmcvcmV2b2tlLmNybDA0BglghkgBhvhCAQgEJxYl
+aHR0cDovL3d3dy5jYWNlcnQub3JnL2luZGV4LnBocD9pZD0xMDBWBglghkgBhvhC
+AQ0ESRZHVG8gZ2V0IHlvdXIgb3duIGNlcnRpZmljYXRlIGZvciBGUkVFIGhlYWQg
+b3ZlciB0byBodHRwOi8vd3d3LmNhY2VydC5vcmcwDQYJKoZIhvcNAQEEBQADggIB
+ACjH7pyCArpcgBLKNQodgW+JapnM8mgPf6fhjViVPr3yBsOQWqy1YPaZQwGjiHCc
+nWKdpIevZ1gNMDY75q1I08t0AoZxPuIrA2jxNGJARjtT6ij0rPtmlVOKTV39O9lg
+18p5aTuxZZKmxoGCXJzN600BiqXfEVWqFcofN8CCmHBh22p8lqOOLlQ+TyGpkO/c
+gr/c6EWtTZBzCDyUZbAEmXZ/4rzCahWqlwQ3JNgelE5tDlG+1sSPypZt90Pf6DBl
+Jzt7u0NDY8RD97LsaMzhGY4i+5jhe1o+ATc7iwiwovOVThrLm82asduycPAtStvY
+sONvRUgzEv/+PDIqVPfE94rwiCPCR/5kenHA0R6mY7AHfqQv0wGP3J8rtsYIqQ+T
+SCX8Ev2fQtzzxD72V7DX3WnRBnc0CkvSyqD/HMaMyRa+xMwyN2hzXwj7UfdJUzYF
+CpUCTPJ5GhD22Dp1nPMd8aINcGeGG7MW9S/lpOt5hvk9C8JzC6WZrG/8Z7jlLwum
+GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk
+zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW
+omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD
+-----END CERTIFICATE-----

site-cookbooks/kosmos-base/recipes/default.rb

@@ -3,9 +3,19 @@
 # Recipe:: default
 #
 
+# Resolve the client's own config paths so this works for both Chef (/etc/chef)
+# and Cinc (/etc/cinc) rather than hardcoding /etc/chef.
+config_file  = Chef::Config[:config_file]
+client_d_dir = Chef::Config[:client_d_dir]
+
+directory client_d_dir do
+  recursive true
+  mode "0755"
+end
+
 ruby_block "cleanup client.rb" do
   block do
-    fe = Chef::Util::FileEdit.new("/etc/chef/client.rb")
+    fe = Chef::Util::FileEdit.new(config_file)
     # Delete whitelist attribute definitions, everything is defined in attributes.rb
     fe.search_file_delete_line(/^.*_attribute_whitelist.*/)
     fe.search_file_delete_line(/^allowed_.*_attributes.*/)
@@ -13,7 +23,7 @@ ruby_block "cleanup client.rb" do
   end
 end
 
-cookbook_file "/etc/chef/client.d/attributes.rb" do
+cookbook_file "#{client_d_dir}/attributes.rb" do
   source "chef_attributes.rb"
   mode "0644"
   notifies :create, "ruby_block[reload_client_config]", :immediately
@@ -21,7 +31,10 @@ end
 
 ruby_block "reload_client_config" do
   block do
-    Chef::Config.from_file("/etc/chef/client.rb")
+    # Reload only the attribute-persistence config we just wrote. Reloading the
+    # whole client.rb would reset chef_server_url and break knife-zero's -S
+    # (TCP) override, making server calls fall back to socketless chefzero.
+    Chef::Config.from_file("#{client_d_dir}/attributes.rb")
   end
   action :nothing
 end
@@ -77,10 +90,11 @@ unless node.chef_environment == "development"
     action :create
   end
 
-  ["http://www.cacert.org/certs/root.crt", "http://www.cacert.org/certs/class3.crt"].each do |cert|
-    remote_file "/usr/local/share/ca-certificates/cacert/#{File.basename(cert)}" do
-      source cert
-      action :create_if_missing
+  # CAcert roots, vendored so bootstraps do not depend on cacert.org being
+  # reachable at converge time.
+  %w(root.crt class3.crt).each do |cert|
+    cookbook_file "/usr/local/share/ca-certificates/cacert/#{cert}" do
+      source "cacert/#{cert}"
       notifies :run, "execute[update-ca-certificates]", :immediately
     end
   end

site-cookbooks/kosmos-bitcoin/attributes/default.rb

@@ -60,9 +60,10 @@ node.default['lnd']['tor'] = {
 }
 
 node.default['rtl']['repo'] = 'https://github.com/Ride-The-Lightning/RTL.git'
-node.default['rtl']['revision'] = 'v0.15.2'
+node.default['rtl']['revision'] = 'v0.15.15'
 node.default['rtl']['host'] = '10.1.1.163'
 node.default['rtl']['port'] = '3000'
+node.default['rtl']['block_explorer_url'] = 'https://mempool.space'
 
 node.default['lndhub-go']['repo'] = 'https://github.com/getAlby/lndhub.go.git'
 node.default['lndhub-go']['revision'] = '1.0.2'

site-cookbooks/kosmos-bitcoin/recipes/rtl.rb

@@ -3,7 +3,7 @@
 # Recipe:: rtl
 #
 
-node.override["kosmos_nodejs"]["version"] = "22.23.1"
+node.override["kosmos_nodejs"]["version"] = "22.23.4"
 include_recipe 'kosmos-nodejs'
 
 app_name      = "rtl"
@@ -16,6 +16,9 @@ credentials   = Chef::EncryptedDataBagItem.load('credentials', 'rtl')
 rtl_config = {
   host: node['rtl']['host'],
   port: node['rtl']['port'],
+  # Since RTL 0.15.14 the block explorer URL can only be set here (or via
+  # BLOCK_EXPLORER_URL); it is no longer settable from the settings UI.
+  blockExplorerUrl: node['rtl']['block_explorer_url'],
   defaultNodeIndex: 1,
   SSO: {
     rtlSSO: 0,
@@ -46,6 +49,17 @@ rtl_config = {
   multiPassHashed: credentials["multiPassHashed"]
 }
 
+# Discard any local modifications (e.g. a rewritten package-lock.json) so the
+# checkout below to the pinned revision succeeds.
+execute "reset rtl checkout" do
+  command "git checkout -- ."
+  cwd rtl_dir
+  user bitcoin_user
+  group bitcoin_group
+  environment "HOME" => rtl_dir
+  only_if { ::File.directory?("#{rtl_dir}/.git") }
+end
+
 git rtl_dir do
   user bitcoin_user
   group bitcoin_group
@@ -59,8 +73,8 @@ execute "npm_install" do
   cwd rtl_dir
   environment "HOME" => rtl_dir
   user bitcoin_user
-  # TODO remove --force when upstream dependency issues have been resolved
-  command "npm install --force"
+  # Clean install from the committed lockfile, as recommended since RTL 0.15.6.
+  command "npm ci --omit=dev --legacy-peer-deps"
   action :nothing
 end
 

site-cookbooks/kosmos-hubot/recipes/botka_irc-libera-chat.rb

@@ -48,6 +48,9 @@ end
 
 service_env = {
   "HUBOT_LOG_LEVEL"             => node.chef_environment == "development" ? "debug" : "info",
+  # Node 16 bundles its own CA store, which still trusts the compromised
+  # eMudhra intermediate's root; use the (patched) system trust store instead.
+  "NODE_OPTIONS"                => "--use-openssl-ca",
   "HUBOT_IRC_USESSL"            => "true",
   "HUBOT_IRC_SERVER"            => credentials["znc_host"],
   "HUBOT_IRC_PORT"              => credentials["znc_port"],

site-cookbooks/kosmos-hubot/recipes/hal8000_xmpp.rb

@@ -69,6 +69,9 @@ end
 
 service_env = {
   "HUBOT_LOG_LEVEL"                => node.chef_environment == "development" ? "debug" : "info",
+  # Node 16 bundles its own CA store, which still trusts the compromised
+  # eMudhra intermediate's root; use the (patched) system trust store instead.
+  "NODE_OPTIONS"                   => "--use-openssl-ca",
   "HUBOT_XMPP_USERNAME"            => "hal8000@kosmos.org/hubot",
   "HUBOT_XMPP_PASSWORD"            => data_bag['xmpp_password'],
   "HUBOT_XMPP_HOST"                => "xmpp.kosmos.org",

site-cookbooks/kosmos-ipfs/recipes/kredits_pinner.rb

@@ -32,7 +32,10 @@ execute "npm install" do
 end
 
 service_env = {
-  'DEBUG' => 'ipfs-pinner'
+  'DEBUG' => 'ipfs-pinner',
+  # Node 16 bundles its own CA store, which still trusts the compromised
+  # eMudhra intermediate's root; use the (patched) system trust store instead.
+  'NODE_OPTIONS' => '--use-openssl-ca'
 }
 
 systemd_unit "#{app_name}.service" do

site-cookbooks/kosmos-mastodon/attributes/default.rb

@@ -18,7 +18,7 @@ node.default["kosmos-mastodon"]["deploy"] = true
 node.default["kosmos-mastodon"]["build"] = true
 
 # Runtime versions
-node.default["kosmos-mastodon"]["nodejs_version"]      = "24.21.0"
+node.default["kosmos-mastodon"]["nodejs_version"]      = "24.22.1"
 node.default["kosmos-mastodon"]["ruby_version"]        = "4.0.7"
 node.default["kosmos-mastodon"]["ruby_build_version"]  = "v20260924"
 

site-cookbooks/kosmos-nodejs/recipes/default.rb

@@ -7,3 +7,11 @@ nodejs_install 'nodejs' do
   install_method 'package'
   version node["kosmos_nodejs"]["version"]
 end
+
+# nodejs_install only uses the version to select the Nodesource repo major, then
+# runs a bare `package nodejs`, which Chef considers up to date for an already
+# installed package. Force an upgrade so a newer patch of the same major (e.g.
+# 22.23.1 -> 22.23.4) is actually installed.
+package 'nodejs' do
+  action :upgrade
+end

site-cookbooks/kosmos_kvm/attributes/default.rb

@@ -1,9 +1,9 @@
-release = "20260801"
+release = "20261017"
 img_filename = "ubuntu-24.04-server-cloudimg-amd64"
 
 node.default["kosmos_kvm"]["host"]["qemu_base_image"] = {
   "url" => "https://cloud-images.ubuntu.com/releases/noble/release-#{release}/#{img_filename}.img",
-  "checksum" => "0533b0655c32e68b31d792ecd6ccfca95abdbc536c4446874fe0513bd4140ffe",
+  "checksum" => "04e8f2461a16a44e78a370284471f29616cdd9baf1893df25807b71f985b6c94",
   "path" => "/var/lib/libvirt/images/base/#{img_filename}-#{release}.qcow2"
 }
 

site-cookbooks/kredits-github/recipes/default.rb

@@ -44,7 +44,10 @@ service_env = {
   "LOG_LEVEL" => 'info',
   "APP_ID" => credentials["app_id"],
   "PRIVATE_KEY_PATH" => "#{app_path}/github_app_key.pem",
-  "WEBHOOK_SECRET" => credentials["webhook_secret"]
+  "WEBHOOK_SECRET" => credentials["webhook_secret"],
+  # Node 16 bundles its own CA store, which still trusts the compromised
+  # eMudhra intermediate's root; use the (patched) system trust store instead.
+  "NODE_OPTIONS" => "--use-openssl-ca"
 }
 
 systemd_unit "#{app_name}.service" do

site-cookbooks/sockethub/recipes/default.rb

@@ -3,7 +3,7 @@
 # Recipe:: default
 #
 
-node.override["kosmos_nodejs"]["version"] = "24.21.0"
+node.override["kosmos_nodejs"]["version"] = "24.22.1"
 include_recipe 'kosmos-nodejs'
 
 user  = "sockethub"
@@ -63,6 +63,7 @@ ExecStart=#{entry}
 User=#{user}
 Group=#{group}
 Environment=SOCKETHUB_CONFIG=/etc/sockethub/sockethub.config.json
+Environment=NODE_OPTIONS=--use-openssl-ca
 Restart=always
 
 [Install]