# chef-server

Chef Server Docker image repository

## Implementation Details

The image build uses packages from [Cinc](https://cinc.sh/), which provides free distributions of Chef software, as newer versions of Chef required a paid subscription.

The server is configured in an opinionated way, using external services for storage where possible. In particular:

* External Opensearch
* External Postgres database
* S3 for Berkshelf storage

The Nginx proxy is configured to use HTTP. For production usage, it is assumed that SSL termination will be handled by an ELB.

The following directories also contain persistent data and should be configured as volumes:

* `/etc/cinc-project`
* `/var/opt/cinc-project`

### Entrypoint

The entrypoint script calls `cinc-server-ctl reconfigure` to configure and start the services.

On first start, it will create an initial admin user and organization. The private key of the admin user will be uploaded to the S3 bucket specified by the `SECRETS_BUCKET` environment variable. This user can then be used to create additional users without requiring direct shell access to the container.

## Running Locally

Build the Docker image with `docker compose build`

Copy `.env.shadow` to `.env` and amend as appropriate.

Configure AWS credentials (using e.g. `awsume`). These credentials must grant RW access to the S3 bucket specified by the `SECRETS_BUCKET` environment variable, in order to upload the initial Chef keys.

Bring up stack:

```
docker compose up
```

Retrieve Chef admin key from S3:

```
aws s3 cp s3://dev-chef-server-secrets/local-chef-server/admin.pem admin.pem
```

Run a `knife` command to verify everything is working

```
knife node create test -d
```