From 1d4c415dd836b27904f6c6c18c2d8489cfe845db Mon Sep 17 00:00:00 2001 From: Greg Karekinian Date: Sat, 1 Aug 2026 11:17:13 +0200 Subject: [PATCH 1/6] Update Gitea to 1.27.1 The webhooks allowed list was moved to the security part of the config file This is running on gitea-2 --- site-cookbooks/kosmos_gitea/attributes/default.rb | 4 ++-- site-cookbooks/kosmos_gitea/metadata.rb | 2 +- site-cookbooks/kosmos_gitea/templates/default/app.ini.erb | 8 +++----- 3 files changed, 6 insertions(+), 8 deletions(-) diff --git a/site-cookbooks/kosmos_gitea/attributes/default.rb b/site-cookbooks/kosmos_gitea/attributes/default.rb index 8e632db..7108259 100644 --- a/site-cookbooks/kosmos_gitea/attributes/default.rb +++ b/site-cookbooks/kosmos_gitea/attributes/default.rb @@ -1,5 +1,5 @@ -node.default["gitea"]["version"] = "1.26.4" -node.default["gitea"]["checksum"] = "0faa36d151918f8f7d6e0f3ae67597d1c338583d695add146ac393109d0fc44a" +node.default["gitea"]["version"] = "1.27.1" +node.default["gitea"]["checksum"] = "86a7ac26e7f9c9cca0f56c4fac07fff205d5fc3bca0e54af23a204f07b833bc9" node.default["gitea"]["repo"] = nil node.default["gitea"]["revision"] = nil node.default["gitea"]["working_directory"] = "/var/lib/gitea" diff --git a/site-cookbooks/kosmos_gitea/metadata.rb b/site-cookbooks/kosmos_gitea/metadata.rb index d643f62..bd9bc2f 100644 --- a/site-cookbooks/kosmos_gitea/metadata.rb +++ b/site-cookbooks/kosmos_gitea/metadata.rb @@ -4,7 +4,7 @@ maintainer_email 'ops@kosmos.org' license 'MIT' description 'Installs/configures Gitea' long_description 'Installs/configures Gitea' -version '0.2.0' +version '0.2.1' chef_version '>= 14.0' depends "firewall" diff --git a/site-cookbooks/kosmos_gitea/templates/default/app.ini.erb b/site-cookbooks/kosmos_gitea/templates/default/app.ini.erb index 9d0fb7b..9b50f1a 100644 --- a/site-cookbooks/kosmos_gitea/templates/default/app.ini.erb +++ b/site-cookbooks/kosmos_gitea/templates/default/app.ini.erb @@ -62,6 +62,9 @@ FROM = <%= @email %> INTERNAL_TOKEN = <%= @internal_token %> INSTALL_LOCK = true SECRET_KEY = <%= @secret_key %> +<% if c = @config["webhook"] %> +<% if c["allowed_host_list"] %>ALLOWED_HOST_LIST = <%= c["allowed_host_list"] %><% end %> +<% end %> [service] REGISTER_EMAIL_CONFIRM = false @@ -101,11 +104,6 @@ RUN_AT_START = false NOTICE_ON_SUCCESS = false SCHEDULE = @every 15m -<% if c = @config["webhook"] %> -[webhook] -<% if c["allowed_host_list"] %>ALLOWED_HOST_LIST = <%= c["allowed_host_list"] %><% end %> -<% end %> - <% if c = @config["storage"] %> [storage] <% if c["type"] == "minio" %> -- 2.50.1 From e2cb6032a57925b47da75c8a7359535cdcc455d9 Mon Sep 17 00:00:00 2001 From: Greg Karekinian Date: Sat, 1 Aug 2026 11:21:32 +0200 Subject: [PATCH 2/6] Update nodes submodule --- nodes | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nodes b/nodes index 503f8ec..2ad8da7 160000 --- a/nodes +++ b/nodes @@ -1 +1 @@ -Subproject commit 503f8ec5ff8252eddc1d9baec9f373eb72eba322 +Subproject commit 2ad8da7428e583990d1165b2e286450cfcb8f914 -- 2.50.1 From cafc4b6f62518de8631585d5a682c58f57447a78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Fri, 24 Jul 2026 15:19:59 +0200 Subject: [PATCH 3/6] Make create_vm work on all OS versions in use Makes it work with the same cloudinit code on Ubuntu 20.04 by mounting it from a custom ISO as CD-ROM --- site-cookbooks/kosmos_kvm/recipes/host.rb | 10 ++++++- .../kosmos_kvm/templates/create_vm.erb | 28 +++++++++++++++++++ 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/site-cookbooks/kosmos_kvm/recipes/host.rb b/site-cookbooks/kosmos_kvm/recipes/host.rb index be25ce8..e1d72cf 100644 --- a/site-cookbooks/kosmos_kvm/recipes/host.rb +++ b/site-cookbooks/kosmos_kvm/recipes/host.rb @@ -5,6 +5,11 @@ package %w(virtinst libvirt-daemon-system libvirt-clients) +# Required on legacy hosts (Ubuntu 20.04) to build the NoCloud seed ISO +# via cloud-localds. Modern virt-install (>= 4.0.0, Ubuntu >= 22.04) +# handles cloud-init natively via --cloud-init and does not need it. +package "cloud-image-utils" if node["platform_version"].to_f < 22.04 + directory "/var/lib/libvirt/images/base" do recursive true owner "libvirt-qemu" @@ -24,7 +29,10 @@ end template "/usr/local/sbin/create_vm" do source "create_vm.erb" mode "0750" - variables base_image_path: node["kosmos_kvm"]["host"]["qemu_base_image"]["path"] + variables( + base_image_path: node["kosmos_kvm"]["host"]["qemu_base_image"]["path"], + modern_virt_install: node["platform_version"].to_f >= 22.04 + ) end firewall_rule 'ssh-alt-port' do diff --git a/site-cookbooks/kosmos_kvm/templates/create_vm.erb b/site-cookbooks/kosmos_kvm/templates/create_vm.erb index b94b79b..8dd3ed7 100644 --- a/site-cookbooks/kosmos_kvm/templates/create_vm.erb +++ b/site-cookbooks/kosmos_kvm/templates/create_vm.erb @@ -64,6 +64,7 @@ EOS popd fi +<% if @modern_virt_install -%> virt-install \ --name "$VMNAME" \ --ram "$RAM" \ @@ -83,3 +84,30 @@ virt-install \ --autostart \ --import \ --cloud-init root-password-generate=off,disable=on,meta-data=$CIDATA_PATH/meta-data,user-data=$CIDATA_PATH/user-data +<% else -%> +# Legacy path for hosts running virt-install < 4.0.0 (e.g. Ubuntu 20.04, +# virt-install 2.2.x). These versions predate the --osinfo/--cloud-init +# options, so we build a NoCloud seed ISO from the same user-data and +# meta-data files and attach it as a cdrom. The guest receives the +# exact same cloud-init configuration as on modern hosts. +cloud-localds "$CIDATA_PATH/seed.iso" "$CIDATA_PATH/user-data" "$CIDATA_PATH/meta-data" + +virt-install \ + --name "$VMNAME" \ + --ram "$RAM" \ + --vcpus "$CPUS" \ + --cpu host \ + --arch x86_64 \ + --hvm \ + --virt-type kvm \ + --disk "$IMAGE_PATH" \ + --disk "$CIDATA_PATH/seed.iso,device=cdrom" \ + --boot hd \ + --network=bridge=virbr0,model=virtio \ + --graphics none \ + --serial pty \ + --console pty \ + --channel unix,mode=bind,path=/var/lib/libvirt/qemu/$VMNAME.guest_agent.0,target_type=virtio,name=org.qemu.guest_agent.0 \ + --autostart \ + --import +<% end -%> -- 2.50.1 From e051a6b5053b0baf6701c44c93f016810e494f11 Mon Sep 17 00:00:00 2001 From: Greg Karekinian Date: Sat, 1 Aug 2026 13:20:26 +0200 Subject: [PATCH 4/6] Add new Redis node --- nodes | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nodes b/nodes index 2ad8da7..13c12de 160000 --- a/nodes +++ b/nodes @@ -1 +1 @@ -Subproject commit 2ad8da7428e583990d1165b2e286450cfcb8f914 +Subproject commit 13c12de5742a0c3c7b8bc4f75a6eb97d7575e713 -- 2.50.1 From 5e8ac6de93a473e08dec5000667ab8de546baae7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Fri, 24 Jul 2026 19:15:51 +0200 Subject: [PATCH 5/6] Update backup ignorelist --- environments/production.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/environments/production.json b/environments/production.json index 9a3e2cb..12a372e 100644 --- a/environments/production.json +++ b/environments/production.json @@ -81,7 +81,7 @@ "garage-", "lq-", "rsk-", - "postgres-6" + "postgres-11" ] } }, -- 2.50.1 From 2beff22afc32a25ddc4ea6c9df525835e4612f82 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?R=C3=A2u=20Cao?= Date: Fri, 24 Jul 2026 15:19:43 +0200 Subject: [PATCH 6/6] Add new Redis node --- clients/redis-4.json | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 clients/redis-4.json diff --git a/clients/redis-4.json b/clients/redis-4.json new file mode 100644 index 0000000..3a287e0 --- /dev/null +++ b/clients/redis-4.json @@ -0,0 +1,4 @@ +{ + "name": "redis-4", + "public_key": "-----BEGIN PUBLIC KEY-----\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAn3Zdzfao+n3PdtlJlViJ\nnpVDcL8ofw2rb2/VK7ivpWMKaL7mOq8HIQ+R+ghvllX/vPmN6co3+aUxOvvQ6KGC\nmAcnc7StqOpYUK0g6QZFROESO0vz1hy078AL9D2dEwOj7XS8leWCQyGgA1Z89T9n\naatXqEF1zGuvnVLA340prYkJk5S1X6KHq1WIi9H23hYehvGZlpkJ87wv8sKIo4Y3\nzIVA5hio0t0q+JyStOGr+xRl3mM43b25XcIh2ibrzKp3YoRWSCvMfhAdMKm1WEEI\njM/3fQRtkI1OQSb0o/wUoAmpUEEOTIvbWU2SuFVY7HYRuPwEilvbrGZKgrvbp8R+\nZQIDAQAB\n-----END PUBLIC KEY-----\n" +} \ No newline at end of file -- 2.50.1