{
  "name": "prod_neo4j_backup",
  "description": "role applied to prod neo4j backup hosts",
  "run_list": [
    "role[prod_base_linux]",
    "recipe[irrigate-docker::install]",
    "recipe[maven::default]",
    "recipe[irrigate-neo4j::packages]",
    "recipe[irrigate-neo4j::service]",
    "recipe[irrigate-neo4j::neo4j_user]",
    "recipe[irrigate-neo4j::volume_directories]",
    "recipe[irrigate-neo4j::ulimit]",
    "recipe[irrigate-neo4j::firewall]",
    "recipe[irrigate-neo4j::selinux]",
    "recipe[irrigate-python::uv]",
    "recipe[irrigate-neo4j::config]",
    "recipe[irrigate-neo4j::plugins]",
    "recipe[irrigate-neo4j::certificates]",
    "recipe[irrigate-neo4j::backup]"
  ],
  "override_attributes": {
    "sshd": {
      "sshd_config": {
        "ClientAliveCountMax": "60",
        "ClientAliveInterval": "60"
      }
    }
  },
  "default_attributes": {
    "aide_update": {
      "excluded_directories": [
        "/var/lib/neo4j",
        "/mnt"
      ]
    },
    "firewall": {
      "firewalld": {
        "permanent": true
      }
    },
    "datadog": {
      "neo4j_credentials_data_bag_name": "prod_neo4j_datadog_credentials",
      "max_message_size_bytes": 500000,
      "tags": {
        "service_name": "neo4j-backup"
      }
    },
    "neo4j": {
      "apoc": {
          "install_url": "https://github.com/neo4j/apoc/releases/download/5.26.21/apoc-5.26.21-core.jar",
          "checksum": "a097e5dd303641b40b9cbce64dc1065c540ee355c1496e413dea852272c34490"
        },
      "version": "5.26.21",
      "data_volume_type": "instance_ssd",
      "backup": {
        "NEO4J_BACKUP_ASG_NAME": "prod-neo4j-backup"
      },
      "config": {
        "dbms.memory.heap.initial_size": "12G",
        "dbms.memory.heap.max_size": "12G",
        "dbms.memory.pagecache.size": "12000000000",
        "dbms.logs.query.rotation.size": "100m",
        "dbms.logs.query.rotation.keep_number": "10",
        "dbms.logs.gc.options": "-Xlog:gc*,safepoint,age*=trace",
        "restart_on_change": false,
        "ssl_policy": {
          "policies": {
            "backup": {
              "base_directory": "/etc/neo4j/default",
              "allow_key_generation": "false",
              "data_bag_name": "prod_neo4j_certificate",
              "trust_all": "false",
              "client_auth": "NONE",
              "verify_hostname": "false",
              "tls_versions": "TLSv1.2",
              "ciphers": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
            },
            "bolt": {
              "base_directory": "/etc/neo4j/default",
              "allow_key_generation": "false",
              "data_bag_name": "prod_neo4j_certificate",
              "trust_all": "false",
              "client_auth": "NONE",
              "verify_hostname": "false",
              "tls_versions": "TLSv1.2",
              "ciphers": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"
            },
            "cluster": {
              "base_directory": "/etc/neo4j/cluster_policy",
              "allow_key_generation": "false",
              "data_bag_name": "prod_neo4j_certificate",
              "trust_all": "false",
              "client_auth": "REQUIRE",
              "verify_hostname": "false",
              "tls_versions": "TLSv1.2",
              "ciphers": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
            }
          }
        },
        "apoc.export.file.enabled": "true",
        "apoc.trigger.enabled": "true"
      },
      "netty-tcnative": {
        "version": "2.0.45.Final"
      },
      "netty-tcnative-53": {
        "version": "2.0.65.Final",
        "tcnative-classes-url": "https://repo1.maven.org/maven2/io/netty/netty-tcnative-classes/2.0.65.Final/netty-tcnative-classes-2.0.65.Final.jar",
        "tcnative-boringssl-url": "https://repo1.maven.org/maven2/io/netty/netty-tcnative-boringssl-static/2.0.65.Final/netty-tcnative-boringssl-static-2.0.65.Final-linux-x86_64.jar"
      },
      "route53": {
        "domain_name": "theorchard.io",
        "zone_id": "Z2RSKZ9M7TJ9Z"
      },
      "service": {
        "enabled": false
      }
    },
    "unattended_upgrades": {
      "automatic_reboot": true,
      "unattended_upgrade": 7,
      "package_blacklist": [
        "neo4j-enterprise",
        "cypher-shell"
      ]
    }
  }
}