raucao
4dc9c18d46
Bump Node to patched releases (mastodon/sockethub 24.22.1, RTL 22.23.4). Force the pinned major's latest patch in kosmos-nodejs: nodejs_install only selects the repo major and a bare `package nodejs` never upgrades an already installed package. For hosts stuck on Node 16 (no patched 16.x), run the services with NODE_OPTIONS=--use-openssl-ca so they use the patched system trust store: ipfs-pinner, kredits-github, hubot botka/hal8000, sockethub.
76 lines
1.7 KiB
Ruby
76 lines
1.7 KiB
Ruby
#
|
|
# Cookbook Name:: kredits-github
|
|
# Recipe:: default
|
|
|
|
include_recipe 'kosmos-nodejs'
|
|
|
|
app_name = "kredits-github"
|
|
deploy_user = "deploy"
|
|
deploy_group = "deploy"
|
|
credentials = Chef::EncryptedDataBagItem.load('credentials', app_name)
|
|
|
|
group deploy_group
|
|
|
|
user deploy_user do
|
|
group deploy_group
|
|
manage_home true
|
|
shell "/bin/bash"
|
|
comment "deploy user"
|
|
end
|
|
|
|
app_path = "/opt/#{app_name}"
|
|
git app_path do
|
|
user deploy_user
|
|
group deploy_group
|
|
repository "https://github.com/67P/#{app_name}.git"
|
|
revision node[app_name]['revision']
|
|
notifies :restart, "systemd_unit[#{app_name}.service]", :delayed
|
|
end
|
|
|
|
execute "npm install" do
|
|
cwd app_path
|
|
environment "HOME" => app_path
|
|
user deploy_user
|
|
end
|
|
|
|
file "#{app_path}/github_app_key.pem" do
|
|
content credentials['private_key']
|
|
owner deploy_user
|
|
group deploy_group
|
|
mode '0440'
|
|
end
|
|
|
|
service_env = {
|
|
"LOG_LEVEL" => 'info',
|
|
"APP_ID" => credentials["app_id"],
|
|
"PRIVATE_KEY_PATH" => "#{app_path}/github_app_key.pem",
|
|
"WEBHOOK_SECRET" => credentials["webhook_secret"],
|
|
# Node 16 bundles its own CA store, which still trusts the compromised
|
|
# eMudhra intermediate's root; use the (patched) system trust store instead.
|
|
"NODE_OPTIONS" => "--use-openssl-ca"
|
|
}
|
|
|
|
systemd_unit "#{app_name}.service" do
|
|
content({
|
|
Unit: {
|
|
Description: app_name
|
|
},
|
|
|
|
Service: {
|
|
ExecStart: "/usr/bin/node /usr/bin/npm start",
|
|
WorkingDirectory: app_path,
|
|
User: deploy_user,
|
|
Group: deploy_group,
|
|
Environment: service_env.map { |k, v| "'#{k}=#{v}'" },
|
|
Restart: 'always'
|
|
},
|
|
|
|
Install: {
|
|
WantedBy: 'multi-user.target'
|
|
}
|
|
})
|
|
verify false
|
|
triggers_reload true
|
|
action [:create, :enable, :start]
|
|
end
|