raucao
3bf51f44d5
Probot 14 changed its default webhook path from "/" (Probot 7) to "/api/github/webhooks", but the GitHub App still POSTs to https://kredits-github.kosmos.org/. Every delivery returned 404, so the app never processed pull_request events and never created the Kredits check run. Serve "/" again via WEBHOOK_PATH. Chef's systemd_unit :create only runs daemon-reload and never restarts a running unit, so the env change above would not have taken effect until the next repo change or reboot. Manage the unit with :create/:enable and restart it from a service resource that subscribes to unit changes. Apply the same fix to the kosmos-hubot bot resource.
108 lines
2.6 KiB
Ruby
108 lines
2.6 KiB
Ruby
#
|
|
# Cookbook Name:: kredits-github
|
|
# Recipe:: default
|
|
|
|
node.override["kosmos_nodejs"]["version"] = "22.23.4"
|
|
include_recipe 'kosmos-nodejs'
|
|
|
|
app_name = "kredits-github"
|
|
deploy_user = "deploy"
|
|
deploy_group = "deploy"
|
|
credentials = Chef::EncryptedDataBagItem.load('credentials', app_name)
|
|
|
|
group deploy_group
|
|
|
|
user deploy_user do
|
|
group deploy_group
|
|
manage_home true
|
|
shell "/bin/bash"
|
|
comment "deploy user"
|
|
end
|
|
|
|
app_path = "/opt/#{app_name}"
|
|
|
|
directory app_path do
|
|
owner deploy_user
|
|
group deploy_group
|
|
mode "0755"
|
|
end
|
|
|
|
git app_path do
|
|
user deploy_user
|
|
group deploy_group
|
|
repository "https://github.com/67P/#{app_name}.git"
|
|
revision node[app_name]['revision']
|
|
notifies :restart, "service[#{app_name}]", :delayed
|
|
end
|
|
|
|
execute "npm install" do
|
|
cwd app_path
|
|
environment "HOME" => app_path
|
|
user deploy_user
|
|
end
|
|
|
|
file "#{app_path}/github_app_key.pem" do
|
|
content credentials['private_key']
|
|
owner deploy_user
|
|
group deploy_group
|
|
mode '0440'
|
|
end
|
|
|
|
service_env = {
|
|
"LOG_LEVEL" => 'info',
|
|
"NODE_ENV" => 'production',
|
|
# Bind on all interfaces so the openresty reverse proxy (draco/fornax) can
|
|
# reach the app over ZeroTier; port 3000 is firewalled to 10.1.1.0/24 below.
|
|
"HOST" => '0.0.0.0',
|
|
# Probot 14 changed its default webhook path from "/" (Probot 7) to
|
|
# "/api/github/webhooks". The GitHub App is still configured to POST to
|
|
# "https://kredits-github.kosmos.org/", so keep serving there.
|
|
"WEBHOOK_PATH" => '/',
|
|
"APP_ID" => credentials["app_id"],
|
|
"PRIVATE_KEY_PATH" => "#{app_path}/github_app_key.pem",
|
|
"WEBHOOK_SECRET" => credentials["webhook_secret"]
|
|
}
|
|
|
|
systemd_unit "#{app_name}.service" do
|
|
content({
|
|
Unit: {
|
|
Description: app_name
|
|
},
|
|
|
|
Service: {
|
|
ExecStart: "/usr/bin/node /usr/bin/npm start",
|
|
WorkingDirectory: app_path,
|
|
User: deploy_user,
|
|
Group: deploy_group,
|
|
Environment: service_env.map { |k, v| "'#{k}=#{v}'" },
|
|
Restart: 'always'
|
|
},
|
|
|
|
Install: {
|
|
WantedBy: 'multi-user.target'
|
|
}
|
|
})
|
|
verify false
|
|
triggers_reload true
|
|
action [:create, :enable]
|
|
end
|
|
|
|
# `systemd_unit` only reloads the daemon and never restarts a running unit, so
|
|
# unit/env changes would not take effect until the next repo change or reboot.
|
|
# Restart whenever the unit file changes.
|
|
service app_name do
|
|
action [:enable, :start]
|
|
subscribes :restart, "systemd_unit[#{app_name}.service]", :delayed
|
|
end
|
|
|
|
unless node.chef_environment == "development"
|
|
include_recipe "kosmos-base::firewall"
|
|
|
|
firewall_rule 'kredits-github' do
|
|
port node['kredits-github']['port'].to_i
|
|
source '10.1.1.0/24'
|
|
protocol :tcp
|
|
command :allow
|
|
end
|
|
end
|