2cf611279b
This way the environment variables are kept secret. Only root can read `/proc/$ID/environ`
96 lines
2.8 KiB
Ruby
96 lines
2.8 KiB
Ruby
#
|
|
# Cookbook Name:: kredits-github
|
|
# Recipe:: default
|
|
#
|
|
# The MIT License (MIT)
|
|
#
|
|
# Copyright:: 2019, Kosmos Developers
|
|
#
|
|
# Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
# of this software and associated documentation files (the "Software"), to deal
|
|
# in the Software without restriction, including without limitation the rights
|
|
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
# copies of the Software, and to permit persons to whom the Software is
|
|
# furnished to do so, subject to the following conditions:
|
|
#
|
|
# The above copyright notice and this permission notice shall be included in
|
|
# all copies or substantial portions of the Software.
|
|
#
|
|
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
|
|
# THE SOFTWARE.
|
|
|
|
include_recipe 'kosmos-nodejs'
|
|
|
|
app_name = "kredits-github"
|
|
deploy_user = "deploy"
|
|
deploy_group = "deploy"
|
|
credentials = Chef::EncryptedDataBagItem.load('credentials', app_name)
|
|
|
|
group deploy_group
|
|
|
|
user deploy_user do
|
|
group deploy_group
|
|
manage_home true
|
|
shell "/bin/bash"
|
|
comment "deploy user"
|
|
end
|
|
|
|
path_to_deploy = "/opt/#{app_name}"
|
|
application path_to_deploy do
|
|
owner deploy_user
|
|
group deploy_group
|
|
|
|
git do
|
|
user deploy_user
|
|
group deploy_group
|
|
repository "https://github.com/67P/#{app_name}.git"
|
|
revision node[app_name]['revision']
|
|
end
|
|
|
|
npm_install do
|
|
user deploy_user
|
|
end
|
|
|
|
execute "systemctl daemon-reload" do
|
|
command "systemctl daemon-reload"
|
|
action :nothing
|
|
end
|
|
|
|
file "#{path_to_deploy}/github_app_key.pem" do
|
|
content credentials['private_key']
|
|
owner deploy_user
|
|
group deploy_group
|
|
mode '0440'
|
|
end
|
|
|
|
template "/lib/systemd/system/#{app_name}.service" do
|
|
source 'nodejs.systemd.service.erb'
|
|
owner 'root'
|
|
group 'root'
|
|
mode '0640'
|
|
variables(
|
|
user: deploy_user,
|
|
group: deploy_group,
|
|
app_dir: path_to_deploy,
|
|
entry: "/usr/bin/node /usr/bin/npm start",
|
|
environment: {
|
|
'LOG_LEVEL' => "info",
|
|
'APP_ID' => credentials['app_id'],
|
|
'PRIVATE_KEY_PATH' => "#{path_to_deploy}/github_app_key.pem",
|
|
'WEBHOOK_SECRET' => credentials['webhook_secret'],
|
|
}
|
|
)
|
|
notifies :run, "execute[systemctl daemon-reload]", :delayed
|
|
notifies :restart, "service[#{app_name}]", :delayed
|
|
end
|
|
|
|
service app_name do
|
|
action [:enable, :start]
|
|
end
|
|
end
|