From 3c0910a43b61e9d82c2d70e5e8d42c6f1d560441 Mon Sep 17 00:00:00 2001
From: Tom Hughes <tom@compton.nu>
Date: Mon, 2 Mar 2026 22:18:06 +0000
Subject: [PATCH] Configure planet user directly using chef resources

---
 cookbooks/planet/attributes/default.rb  |  2 --
 cookbooks/planet/metadata.rb            |  1 -
 cookbooks/planet/recipes/aws.rb         |  2 +-
 cookbooks/planet/recipes/current.rb     |  4 +---
 cookbooks/planet/recipes/default.rb     |  2 +-
 cookbooks/planet/recipes/dump.rb        |  2 +-
 cookbooks/planet/recipes/notes.rb       |  2 +-
 cookbooks/planet/recipes/replication.rb |  2 +-
 cookbooks/planet/recipes/user.rb        | 32 +++++++++++++++++++++++++
 test/data_bags/accounts/planet.json     |  5 ----
 10 files changed, 38 insertions(+), 16 deletions(-)
 create mode 100644 cookbooks/planet/recipes/user.rb
 delete mode 100644 test/data_bags/accounts/planet.json

diff --git a/cookbooks/planet/attributes/default.rb b/cookbooks/planet/attributes/default.rb
index 7c8a60466..649d9b399 100644
--- a/cookbooks/planet/attributes/default.rb
+++ b/cookbooks/planet/attributes/default.rb
@@ -1,5 +1,3 @@
-default[:accounts][:users][:planet][:status] = :role
-
 default[:planet][:dump][:xml_directory] = "/store/planet/planet"
 default[:planet][:dump][:xml_history_directory] = "/store/planet/planet/full-history"
 default[:planet][:dump][:pbf_directory] = "/store/planet/pbf"
diff --git a/cookbooks/planet/metadata.rb b/cookbooks/planet/metadata.rb
index 2e70109ee..5a53a5804 100644
--- a/cookbooks/planet/metadata.rb
+++ b/cookbooks/planet/metadata.rb
@@ -6,7 +6,6 @@ description       "Installs and configures a planet server"
 
 version           "1.0.0"
 supports          "ubuntu"
-depends           "accounts"
 depends           "apache"
 depends           "apt"
 depends           "awscli"
diff --git a/cookbooks/planet/recipes/aws.rb b/cookbooks/planet/recipes/aws.rb
index 66e89236d..0e6e041e5 100644
--- a/cookbooks/planet/recipes/aws.rb
+++ b/cookbooks/planet/recipes/aws.rb
@@ -17,8 +17,8 @@
 # limitations under the License.
 #
 
-include_recipe "accounts"
 include_recipe "awscli"
+include_recipe "planet::user"
 
 aws_credentials = data_bag_item("planet", "aws")
 
diff --git a/cookbooks/planet/recipes/current.rb b/cookbooks/planet/recipes/current.rb
index 517123f59..a274eac13 100644
--- a/cookbooks/planet/recipes/current.rb
+++ b/cookbooks/planet/recipes/current.rb
@@ -17,9 +17,7 @@
 # limitations under the License.
 #
 
-node.default[:accounts][:users][:planet][:status] = :role
-
-include_recipe "accounts"
+include_recipe "planet::user"
 
 package %w[
   pyosmium
diff --git a/cookbooks/planet/recipes/default.rb b/cookbooks/planet/recipes/default.rb
index ad532f93e..7ca122a56 100644
--- a/cookbooks/planet/recipes/default.rb
+++ b/cookbooks/planet/recipes/default.rb
@@ -17,10 +17,10 @@
 # limitations under the License.
 #
 
-include_recipe "accounts"
 include_recipe "apache"
 include_recipe "geoipupdate"
 include_recipe "planet::aws"
+include_recipe "planet::user"
 
 package %w[
   python3
diff --git a/cookbooks/planet/recipes/dump.rb b/cookbooks/planet/recipes/dump.rb
index d386eaa79..a18f090cf 100644
--- a/cookbooks/planet/recipes/dump.rb
+++ b/cookbooks/planet/recipes/dump.rb
@@ -17,8 +17,8 @@
 # limitations under the License.
 #
 
-include_recipe "accounts"
 include_recipe "git"
+include_recipe "planet::user"
 
 package %w[
   gcc
diff --git a/cookbooks/planet/recipes/notes.rb b/cookbooks/planet/recipes/notes.rb
index e63297081..331744fd1 100644
--- a/cookbooks/planet/recipes/notes.rb
+++ b/cookbooks/planet/recipes/notes.rb
@@ -17,9 +17,9 @@
 # limitations under the License.
 #
 
-include_recipe "accounts"
 include_recipe "git"
 include_recipe "planet::aws"
+include_recipe "planet::user"
 
 db_passwords = data_bag_item("db", "passwords")
 
diff --git a/cookbooks/planet/recipes/replication.rb b/cookbooks/planet/recipes/replication.rb
index f7552ddf2..3dffdf52d 100644
--- a/cookbooks/planet/recipes/replication.rb
+++ b/cookbooks/planet/recipes/replication.rb
@@ -19,10 +19,10 @@
 
 require "yaml"
 
-include_recipe "accounts"
 include_recipe "apt"
 include_recipe "osmosis"
 include_recipe "planet::aws"
+include_recipe "planet::user"
 include_recipe "ruby"
 include_recipe "tools"
 
diff --git a/cookbooks/planet/recipes/user.rb b/cookbooks/planet/recipes/user.rb
new file mode 100644
index 000000000..6ca267610
--- /dev/null
+++ b/cookbooks/planet/recipes/user.rb
@@ -0,0 +1,32 @@
+#
+# Cookbook:: planet
+# Recipe:: user
+#
+# Copyright:: 2026, OpenStreetMap Foundation
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+group "planet" do
+  gid 502
+  append true
+end
+
+user "planet" do
+  uid 502
+  gid 502
+  comment "planet.openstreetmap.org"
+  home "/home/planet"
+  shell "/usr/sbin/nologin"
+  manage_home true
+end
diff --git a/test/data_bags/accounts/planet.json b/test/data_bags/accounts/planet.json
deleted file mode 100644
index b69305fd8..000000000
--- a/test/data_bags/accounts/planet.json
+++ /dev/null
@@ -1,5 +0,0 @@
-{
-  "id": "planet",
-  "uid": "502",
-  "comment": "planet.openstreetmap.org"
-}
-- 
2.47.3