Caldance updates

diff --git a/environments/global/roles/caldance.yaml b/environments/global/roles/caldance.yaml
index 1dc7fa8a2cb644dfa1ce729614c55e410499f68e..98382bf4d1303d22348deda102d24c136167a69c 100644 (file)
--- a/environments/global/roles/caldance.yaml
+++ b/environments/global/roles/caldance.yaml
@@ -2,3 +2,11 @@
 classes:
   role::caldance: ~
 letsencrypt::hosts: "%{lookup('base_installation::system_hostname')}"
+role::caldance::user: "caldance"
+role::caldance::group: "caldance"
+role::caldance::home: "/home/caldance"
+role::caldance::web_host: "%{lookup('base_installation::system_hostname')}"
+base_installation::system_users:
+  - username: "%{lookup('role::caldance::user')}"
+    system: true
+    password: "!!"

diff --git a/environments/integration/roles/caldance.yaml b/environments/integration/roles/caldance.yaml
new file mode 100644 (file)
index 0000000..6a8ef9a
--- /dev/null
+++ b/environments/integration/roles/caldance.yaml
@@ -0,0 +1,8 @@
+---
+role::caldance::caldance_version: ~ # Overriden in LDAP
+role::caldance::caldance_sha256: ~
+role::caldance::pg_db: "caldev"
+role::caldance::pg_user: "caldev"
+role::caldance::mail_from: "caldev-nepasrepondre@mail.immae.eu"
+role::caldance::smtp_host: "mail.immae.eu"
+role::caldance::smtp_port: "465"

diff --git a/modules/role/manifests/caldance.pp b/modules/role/manifests/caldance.pp
index 63dda1fd8cac3c9178c799e8932128cd6ee7773c..1cda69cf516c3180a08fd11bd19353763864e9da 100644 (file)
--- a/modules/role/manifests/caldance.pp
+++ b/modules/role/manifests/caldance.pp
@@ -1,5 +1,20 @@
 class role::caldance (
+  String           $user,
+  String           $group,
+  String           $home,
+  String           $web_host,
+  String           $pg_user,
+  String           $pg_db,
+  String           $mail_from,
+  String           $smtp_host,
+  String           $smtp_port,
+  Optional[String] $pg_hostname      = "/run/postgresql",
+  Optional[String] $pg_port          = "5432",
+  Optional[String] $caldance_version = undef,
+  Optional[String] $caldance_sha256  = undef,
 ) {
+  $password_seed = lookup("base_installation::puppet_pass_seed")
+  $web_home = "/home/simon_descarpentries"
   include "base_installation"
 
   include "profile::tools"
@@ -10,9 +25,105 @@ class role::caldance (
 
   ensure_packages(["python-pip", "python-virtualenv", "python-django"])
 
+  $caldance_app = "${home}/app"
+
+  file { $caldance_app:
+    ensure  => "directory",
+    mode    => "0755",
+    owner   => $user,
+    group   => $group,
+    require => User["$user:"],
+  }
+
+  exec { "initialize_venv":
+    user    => $user,
+    require => User["$user:"],
+    command => "/usr/bin/virtualenv ${home}/virtualenv",
+    creates => "${home}/virtualenv",
+  }
+  ->
+  archive { "${home}/caldance_${caldance_version}.tar.gz":
+    path          => "${home}/caldance_${caldance_version}.tar.gz",
+    source        => "https://release.immae.eu/caldance/caldance_${caldance_version}.tar.gz",
+    checksum_type => "sha256",
+    checksum      => $caldance_sha256,
+    cleanup       => false,
+    extract       => true,
+    user          => $user,
+    username      => lookup("base_installation::ldap_cn"),
+    password      => generate_password(24, $password_seed, "ldap"),
+    extract_path  => $caldance_app,
+    require       => [User["$user:"], File[$caldance_app]],
+  } ~>
+  exec { "py-requirements":
+    cwd         => $caldance_app,
+    user        => $user,
+    environment => ["HOME=${home}"],
+    command     => "${home}/virtualenv/bin/pip install -r requirements.txt",
+    require     => User["$user:"],
+    refreshonly => true,
+  } ~>
+  exec { "py-migrate":
+    cwd         => $caldance_app,
+    user        => $user,
+    environment => ["HOME=${home}"],
+    command     => "$caldance_app/manage.py migrate",
+    require     => [User["$user:"], File["$caldance_app/manage.py"], File["$caldance_app/main_app/local_settings.py"]],
+    refreshonly => true,
+  } ~>
+  exec { "py-static":
+    cwd         => $caldance_app,
+    user        => $user,
+    environment => ["HOME=${home}"],
+    command     => "$caldance_app/manage.py collectstatic --no-input",
+    require     => [User["$user:"], File["$caldance_app/manage.py"], File["$caldance_app/main_app/local_settings.py"]],
+    refreshonly => true,
+  } ~>
+  exec { "reload httpd":
+    command     => "/usr/bin/systemctl reload httpd",
+    require     => [User["$user:"], File["$caldance_app/manage.py"], File["$caldance_app/main_app/local_settings.py"]],
+    refreshonly => true,
+  }
+
+  $pg_password = generate_password(24, $password_seed, "postgres_caldance")
+  $secret_key = generate_password(24, $password_seed, "secret_key_caldance")
+  file { "$caldance_app/main_app/local_settings.py":
+    owner   => $user,
+    group   => $group,
+    mode    => "0644",
+    content => template("role/caldance/local_settings.py.erb"),
+    require => [
+      User["$user:"],
+      Archive[ "${home}/caldance_${caldance_version}.tar.gz"],
+    ],
+  }
+
+  $python_path = "${home}/virtualenv/bin/python"
+  file { "$caldance_app/manage.py":
+    owner   => $user,
+    group   => $group,
+    mode    => "0755",
+    content => template("role/caldance/manage.py.erb"),
+    require => [
+      User["$user:"],
+      Archive[ "${home}/caldance_${caldance_version}.tar.gz"],
+    ],
+  }
+
+  profile::postgresql::master { "postgresql master for caldance":
+    letsencrypt_host => $web_host,
+    backup_hosts     => ["backup-1"],
+  }
+
+  postgresql::server::db { $pg_db:
+    user     =>  $pg_user,
+    password =>  postgresql_password($pg_user, $pg_password),
+  }
+
   # pour le script de génération de mdp
   ensure_packages(["perl-digest-sha1"])
 
+  ensure_packages(["postgis", "python-gdal", "ripgrep"])
   file { "/usr/local/bin/ldap_ssha":
     owner   => "root",
     group   => "root",
@@ -20,4 +131,58 @@ class role::caldance (
     source  => "puppet:///modules/base_installation/scripts/ldap_ssha",
     require => Package["perl-digest-sha1"],
   }
+
+  sudo::conf { 'wheel_nopasswd':
+    priority => 99,
+    content  => "%wheel ALL=(ALL) NOPASSWD: ALL",
+    require  => Package["sudo"],
+  }
+
+  ensure_packages(["mod_wsgi"])
+  class { 'apache::mod::wsgi':
+    wsgi_python_home => "$web_home/caldev_virtualenv",
+    wsgi_python_path => "$web_home/caldev/www.cal-dance.com/",
+    require          => Package["mod_wsgi"],
+  }
+  class { 'apache::mod::authn_file': }
+  class { 'apache::mod::authn_core': }
+  class { 'apache::mod::authz_user': }
+  class { 'apache::mod::auth_basic': }
+
+  apache::vhost { $web_host:
+    port                => '443',
+    docroot             => false,
+    manage_docroot      => false,
+    ssl                 => true,
+    ssl_cert            => "/etc/letsencrypt/live/$web_host/cert.pem",
+    ssl_key             => "/etc/letsencrypt/live/$web_host/privkey.pem",
+    ssl_chain           => "/etc/letsencrypt/live/$web_host/chain.pem",
+    require             => Letsencrypt::Certonly[$web_host],
+    directories         => [
+      {
+        path    => "$web_home/caldev/www.cal-dance.com/main_app",
+        require => "all granted",
+      },
+      {
+        path    => "$web_home/caldev/www.cal-dance.com/www/static",
+        require => "all granted",
+      },
+      {
+        path           => "/",
+        provider       => "location",
+        require        => "valid-user",
+        auth_type      => "Basic",
+        auth_name      => "Authentification requise",
+        auth_user_file => "$web_home/caldev/.htpasswd",
+      },
+    ],
+    aliases             => [
+      {
+        alias => "/static/",
+        path => "$web_home/caldev/www.cal-dance.com/www/static/",
+      },
+    ],
+    wsgi_script_aliases => { "/" => "$web_home/caldev/www.cal-dance.com/main_app/wsgi.py" };
+    default: *          => $::profile::apache::apache_vhost_default;
+  }
 }

diff --git a/modules/role/templates/caldance/local_settings.py.erb b/modules/role/templates/caldance/local_settings.py.erb
new file mode 100644 (file)
index 0000000..4da53f6
--- /dev/null
+++ b/modules/role/templates/caldance/local_settings.py.erb
@@ -0,0 +1,25 @@
+import os
+DATABASES = {
+        'default': {
+                'ENGINE': 'django.contrib.gis.db.backends.postgis',
+                'NAME': '<%= @pg_db %>',
+                'USER': '<%= @pg_user %>',
+                'PASSWORD': u'<%= @pg_password %>',
+                'HOST': '<%= @pg_hostname %>',
+                'PORT': '<%= @pg_port %>',
+        }
+}
+
+# SECURITY WARNING: keep the secret key used in production secret!
+SECRET_KEY = os.environ.get('SECRET_KEY', '<%= @secret_key %>')
+DEBUG = False
+SECURE_HSTS_PRELOAD = True  # moved from local settings as local runserver don't do SSL
+SECURE_HSTS_SECONDS = 1
+SECURE_SSL_REDIRECT = True
+LOG_FILE = '<%= @home %>/caldev_django.log'
+
+DEFAULT_FROM_EMAIL = '<%= @mail_from %>'
+EMAIL_USE_SSL = True
+EMAIL_HOST = "<%= @smtp_host %>"
+EMAIL_PORT = <%= @smtp_port %>
+

diff --git a/modules/role/templates/caldance/manage.py.erb b/modules/role/templates/caldance/manage.py.erb
new file mode 100644 (file)
index 0000000..dc06eab
--- /dev/null
+++ b/modules/role/templates/caldance/manage.py.erb
@@ -0,0 +1,9 @@
+#!<%= @python_path %> -O
+import os
+import sys
+
+if __name__ == "__main__":
+        os.environ.setdefault("DJANGO_SETTINGS_MODULE", "main_app.settings")
+
+        from django.core.management import execute_from_command_line
+        execute_from_command_line(sys.argv)