modules/role/manifests/caldance.pp

   1 class role::caldance (
   2   String           $user,
   3   String           $group,
   4   String           $home,
   5   String           $web_host,
   6   String           $pg_user,
   7   String           $pg_db,
   8   String           $mail_from,
   9   String           $smtp_host,
  10   String           $smtp_port,
  11   Optional[String] $pg_hostname      = "/run/postgresql",
  12   Optional[String] $pg_port          = "5432",
  13   Optional[String] $caldance_version = undef,
  14   Optional[String] $caldance_sha256  = undef,
  15   Optional[Array]  $cron_pip         = [],
  16 ) {
  17   $password_seed = lookup("base_installation::puppet_pass_seed")
  18   include "base_installation"
  19
  20   include "profile::mail"
  21   include "profile::tools"
  22   include "profile::postgresql"
  23   include "profile::apache"
  24   include "profile::redis"
  25   include "profile::monitoring"
  26
  27   ensure_packages(["python-pip", "python-virtualenv", "python-django"])
  28
  29   $caldance_app = "${home}/app"
  30   $pg_password = generate_password(24, $password_seed, "postgres_caldance")
  31   $secret_key = generate_password(24, $password_seed, "secret_key_caldance")
  32
  33   $environment = {
  34     "DB_NAME"     => $pg_db,
  35     "DB_USER"     => $pg_user,
  36     "DB_PASSWORD" => $pg_password,
  37     "DB_HOST"     => $pg_hostname,
  38     "DB_PORT"     => $pg_port,
  39     "SECRET_KEY"  => $secret_key,
  40     "DEBUG"       => "False",
  41     "LOG_FILE"    => "$home/caldev_django.log",
  42     "MEDIA_ROOT"  => "$home/media",
  43   }
  44   $shell_env = $environment.map |$key, $value| { "$key=$value" }
  45   $apache_env = $environment.map |$key, $value| { "CALDANCE_$key   $value" }
  46
  47   file { $home:
  48     mode => "0755",
  49   }
  50   file { "${home}/caldev_django.log":
  51     mode    => "0664",
  52     owner   => $user,
  53     group   => "http",
  54   }
  55
  56   file { $caldance_app:
  57     ensure  => "directory",
  58     mode    => "0755",
  59     owner   => $user,
  60     group   => $group,
  61     require => User["$user:"],
  62   } ->
  63   file { "${home}/media":
  64     ensure => "directory",
  65     mode   => "0755",
  66     owner  => "http",
  67     group  => "http",
  68   }
  69
  70   exec { "initialize_venv":
  71     user    => $user,
  72     require => User["$user:"],
  73     command => "/usr/bin/virtualenv ${home}/virtualenv",
  74     creates => "${home}/virtualenv",
  75   }
  76   ->
  77   archive { "${home}/caldance_${caldance_version}.tar.gz":
  78     path          => "${home}/caldance_${caldance_version}.tar.gz",
  79     source        => "https://release.immae.eu/caldance/caldance_${caldance_version}.tar.gz",
  80     checksum_type => "sha256",
  81     checksum      => $caldance_sha256,
  82     cleanup       => false,
  83     extract       => true,
  84     user          => $user,
  85     username      => lookup("base_installation::ldap_cn"),
  86     password      => generate_password(24, $password_seed, "ldap"),
  87     extract_path  => $caldance_app,
  88     require       => [User["$user:"], File[$caldance_app]],
  89   } ~>
  90   exec { "py-requirements":
  91     cwd         => $caldance_app,
  92     user        => $user,
  93     environment => concat(["HOME=${home}"], $shell_env),
  94     command     => "/usr/bin/sed -i -e '/GDAL/d' requirements.txt && ${home}/virtualenv/bin/pip install -r requirements.txt --upgrade",
  95     require     => User["$user:"],
  96     refreshonly => true,
  97   } ~>
  98   exec { "py-migrate":
  99     cwd         => $caldance_app,
 100     user        => $user,
 101     environment => concat(["HOME=${home}"], $shell_env),
 102     command     => "$caldance_app/manage.py migrate",
 103     require     => [User["$user:"], File["$caldance_app/manage.py"]],
 104     refreshonly => true,
 105   } ~>
 106   exec { "py-static":
 107     cwd         => $caldance_app,
 108     user        => $user,
 109     environment => concat(["HOME=${home}"], $shell_env),
 110     command     => "$caldance_app/manage.py collectstatic --no-input",
 111     require     => [User["$user:"], File["$caldance_app/manage.py"]],
 112     refreshonly => true,
 113   } ~>
 114   exec { "reload httpd":
 115     command     => "/usr/bin/systemctl reload httpd",
 116     require     => [User["$user:"], File["$caldance_app/manage.py"]],
 117     refreshonly => true,
 118   }
 119
 120   $python_path = "${home}/virtualenv/bin/python"
 121   file { "$caldance_app/manage.py":
 122     owner   => $user,
 123     group   => $group,
 124     mode    => "0755",
 125     content => template("role/caldance/manage.py.erb"),
 126     require => [
 127       User["$user:"],
 128       Archive[ "${home}/caldance_${caldance_version}.tar.gz"],
 129     ],
 130   }
 131
 132   profile::postgresql::master { "postgresql master for caldance":
 133     letsencrypt_host => $web_host,
 134     backup_hosts     => ["backup-1"],
 135   }
 136
 137   postgresql::server::db { $pg_db:
 138     user     =>  $pg_user,
 139     password =>  postgresql_password($pg_user, $pg_password),
 140   }
 141
 142   # pour le script de génération de mdp
 143   ensure_packages(["perl-digest-sha1"])
 144
 145   ensure_packages(["postgis", "python-gdal", "ripgrep"])
 146   file { "/usr/local/bin/ldap_ssha":
 147     owner   => "root",
 148     group   => "root",
 149     mode    => "0755",
 150     source  => "puppet:///modules/base_installation/scripts/ldap_ssha",
 151     require => Package["perl-digest-sha1"],
 152   }
 153
 154   sudo::conf { 'wheel_nopasswd':
 155     priority => 99,
 156     content  => "%wheel ALL=(ALL) NOPASSWD: ALL",
 157     require  => Package["sudo"],
 158   }
 159
 160   ensure_packages(["mod_wsgi"])
 161   class { 'apache::mod::wsgi':
 162     wsgi_python_home => "${home}/virtualenv",
 163     wsgi_python_path => $caldance_app,
 164     require          => Package["mod_wsgi"],
 165   }
 166   class { 'apache::mod::authn_file': }
 167   class { 'apache::mod::authn_core': }
 168   class { 'apache::mod::authz_user': }
 169   class { 'apache::mod::auth_basic': }
 170
 171   apache::vhost { $web_host:
 172     port                => '443',
 173     docroot             => false,
 174     manage_docroot      => false,
 175     ssl                 => true,
 176     ssl_cert            => "/etc/letsencrypt/live/$web_host/cert.pem",
 177     ssl_key             => "/etc/letsencrypt/live/$web_host/privkey.pem",
 178     ssl_chain           => "/etc/letsencrypt/live/$web_host/chain.pem",
 179     require             => Letsencrypt::Certonly[$web_host],
 180     additional_includes => "$home/caldance_env",
 181     directories         => [
 182       {
 183         path    => "$caldance_app/main_app",
 184         require => "all granted",
 185       },
 186       {
 187         path    => "$caldance_app/www/static",
 188         require => "all granted",
 189       },
 190       {
 191         path    => "$home/media",
 192         require => "all granted",
 193         options => ["-Indexes"],
 194       },
 195       {
 196         path           => "/",
 197         provider       => "location",
 198         require        => "valid-user",
 199         auth_type      => "Basic",
 200         auth_name      => "Authentification requise",
 201         auth_user_file => "$home/htpasswd",
 202       },
 203     ],
 204     aliases             => [
 205       {
 206         alias => "/static/",
 207         path => "$caldance_app/www/static/",
 208       },
 209       {
 210         alias => "/media/",
 211         path => "$home/media/",
 212       },
 213     ],
 214     setenv              => $apache_env,
 215     wsgi_script_aliases => { "/" => "$caldance_app/main_app/wsgi.py" };
 216     default: *          => $::profile::apache::apache_vhost_default;
 217   }
 218
 219   $mailtos = join($cron_pip, ",")
 220   cron::job { "list_outdated_pip_packages":
 221     ensure      => present,
 222     user        => $user,
 223     environment => concat(["HOME=${home}","MAILTO=${mailtos}"], $shell_env),
 224     command     => "${home}/virtualenv/bin/pip list --outdated",
 225     minute      => "15",
 226     hour        => "0",
 227     require     => Exec["initialize_venv"],
 228   }
 229 }