community: container definitions should not be world readable

[chef.git] / cookbooks / community / recipes / default.rb

diff --git a/cookbooks/community/recipes/default.rb b/cookbooks/community/recipes/default.rb
index 2297fa76cb52152dd57a3affdf99629a4a79913d..08f316d689e4fe2fd72d950aa3d855d398fc9464 100644 (file)
--- a/cookbooks/community/recipes/default.rb
+++ b/cookbooks/community/recipes/default.rb
@@ -17,13 +17,18 @@
 # limitations under the License.
 #
 
+include_recipe "accounts"
 include_recipe "docker"
 include_recipe "git"
 include_recipe "ssl"
-include_recipe "geoipupdate"
 
 passwords = data_bag_item("community", "passwords")
-license_keys = data_bag_item("geoipupdate", "license-keys")
+license_keys = data_bag_item("geoipupdate", "license-keys") unless kitchen?
+
+# Disable any default installed apache2 service. Web server is embedded within the discourse docker container
+service "apache2" do
+  action [:disable, :stop]
+end
 
 directory "/srv/community.openstreetmap.org" do
   owner "root"
@@ -53,7 +58,7 @@ template "/srv/community.openstreetmap.org/docker/containers/data.yml" do
   source "data.yml.erb"
   owner "root"
   group "root"
-  mode "644"
+  mode "640"
   variables :passwords => passwords
   notifies :run, "execute[discourse_container_data_rebuild]"
 end
@@ -62,7 +67,7 @@ template "/srv/community.openstreetmap.org/docker/containers/web_only.yml" do
   source "web_only.yml.erb"
   owner "root"
   group "root"
-  mode "644"
+  mode "640"
   variables :license_keys => license_keys, :passwords => passwords
   notifies :run, "execute[discourse_container_web_only_bootstrap]"
 end
@@ -71,7 +76,7 @@ template "/srv/community.openstreetmap.org/docker/containers/mail-receiver.yml"
   source "mail-receiver.yml.erb"
   owner "root"
   group "root"
-  mode "644"
+  mode "640"
   variables :passwords => passwords
   notifies :run, "execute[discourse_container_mail_receiver_rebuild]"
 end