modules/role/manifests/cryptoportfolio.pp

   1 class role::cryptoportfolio {
   2   ensure_resource('exec', 'systemctl daemon-reload', {
   3     command     => '/usr/bin/systemctl daemon-reload',
   4     refreshonly =>  true
   5   })
   6
   7   include "base_installation"
   8
   9   include "profile::tools"
  10   include "profile::postgresql"
  11   include "profile::apache"
  12   include "profile::xmr_stak"
  13
  14   $password_seed = lookup("base_installation::puppet_pass_seed") |$key| { {} }
  15
  16   $cf_pg_user = "cryptoportfolio"
  17   $cf_pg_user_replication = "cryptoportfolio_replication"
  18   $cf_pg_db = "cryptoportfolio"
  19   $cf_pg_password = generate_password(24, $password_seed, "postgres_cryptoportfolio")
  20   $cf_pg_replication_password = generate_password(24, $password_seed, "postgres_cryptoportfolio_replication")
  21   $cf_pg_hostname = "localhost"
  22   $cf_pg_port = "5432"
  23   $cf_pg_host = "${cf_pg_hostname}:${cf_pg_port}"
  24
  25   $cf_user = "cryptoportfolio"
  26   $cf_group = "cryptoportfolio"
  27   $cf_home = "/opt/cryptoportfolio"
  28   $cf_env = "prod"
  29   $cf_front_app_host = lookup("base_installation::system_hostname") |$key| { "example.com" }
  30   $cf_front_app_port = ""
  31   $cf_front_app_ssl = "true"
  32   $cf_front_app = "${cf_home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio/Front"
  33   $cf_front_app_api_workdir = "${cf_front_app}/cmd/app"
  34   $cf_front_app_api_bin = "${cf_front_app_api_workdir}/cryptoportfolio-app"
  35   $cf_front_app_api_conf = "${cf_home}/conf.toml"
  36   $cf_front_app_api_secret = generate_password(24, $password_seed, "cryptoportfolio_api_secret")
  37
  38   $cf_front_app_static_conf = "${cf_front_app}/cmd/web/env/prod.env"
  39
  40   $cf_bot_app = "${cf_home}/bot"
  41   $cf_bot_app_conf = "${cf_home}/bot_config.ini"
  42   $cf_bot_app_reports = "${cf_home}/bot_reports"
  43
  44   file { "/var/lib/postgres/data/certs":
  45     ensure  => directory,
  46     mode    => "0700",
  47     owner   => $::profile::postgresql::pg_user,
  48     group   => $::profile::postgresql::pg_user,
  49     require => File["/var/lib/postgres"],
  50   }
  51
  52   file { "/var/lib/postgres/data/certs/cert.pem":
  53     source  => "file:///etc/letsencrypt/live/$cf_front_app_host/cert.pem",
  54     mode    => "0600",
  55     links   => "follow",
  56     owner   => $::profile::postgresql::pg_user,
  57     group   => $::profile::postgresql::pg_user,
  58     require => [Letsencrypt::Certonly[$cf_front_app_host], File["/var/lib/postgres/data/certs"]]
  59   }
  60
  61   file { "/var/lib/postgres/data/certs/privkey.pem":
  62     source  => "file:///etc/letsencrypt/live/$cf_front_app_host/privkey.pem",
  63     mode    => "0600",
  64     links   => "follow",
  65     owner   => $::profile::postgresql::pg_user,
  66     group   => $::profile::postgresql::pg_user,
  67     require => [Letsencrypt::Certonly[$cf_front_app_host], File["/var/lib/postgres/data/certs"]]
  68   }
  69
  70   postgresql::server::config_entry { "wal_level":
  71     value   => "logical",
  72   }
  73
  74   postgresql::server::config_entry { "ssl":
  75     value   => "on",
  76     require => Letsencrypt::Certonly[$cf_front_app_host],
  77   }
  78
  79   postgresql::server::config_entry { "ssl_cert_file":
  80     value   => "/var/lib/postgres/data/certs/cert.pem",
  81     require => Letsencrypt::Certonly[$cf_front_app_host],
  82   }
  83
  84   postgresql::server::config_entry { "ssl_key_file":
  85     value   => "/var/lib/postgres/data/certs/privkey.pem",
  86     require => Letsencrypt::Certonly[$cf_front_app_host],
  87   }
  88
  89   postgresql::server::db { $cf_pg_db:
  90     user     =>  $cf_pg_user,
  91     password =>  postgresql_password($cf_pg_user, $cf_pg_password),
  92   }
  93   ->
  94   postgresql_psql { "CREATE PUBLICATION ${cf_pg_db}_publication FOR ALL TABLES":
  95     db     => $cf_pg_db,
  96     unless => "SELECT 1 FROM pg_catalog.pg_publication WHERE pubname = '${cf_pg_db}_publication'",
  97   }
  98   ->
  99   postgresql::server::role { $cf_pg_user_replication:
 100     db            => $cf_pg_db,
 101     replication   => true,
 102     password_hash => postgresql_password($cf_pg_user_replication, $cf_pg_replication_password),
 103   }
 104   ->
 105   postgresql::server::database_grant { $cf_pg_user_replication:
 106     db        => $cf_pg_db,
 107     privilege => "CONNECT",
 108     role      => $cf_pg_user_replication,
 109   }
 110   ->
 111   postgresql::server::grant { "all tables in schema:public:$cf_pg_user_replication":
 112     db          => $cf_pg_db,
 113     role        => $cf_pg_user_replication,
 114     privilege   => "SELECT",
 115     object_type => "ALL TABLES IN SCHEMA",
 116     object_name => "public",
 117   }
 118   ->
 119   postgresql::server::grant { "all sequences in schema:public:$cf_pg_user_replication":
 120     db          => $cf_pg_db,
 121     role        => $cf_pg_user_replication,
 122     privilege   => "SELECT",
 123     object_type => "ALL SEQUENCES IN SCHEMA",
 124     object_name => "public",
 125   }
 126
 127   postgresql::server::pg_hba_rule { 'allow localhost TCP access to cryptoportfolio user':
 128     type        => 'host',
 129     database    => $cf_pg_db,
 130     user        => $cf_pg_user,
 131     address     => '127.0.0.1/32',
 132     auth_method => 'md5',
 133     order       => "b0",
 134   }
 135   postgresql::server::pg_hba_rule { 'allow localhost ip6 TCP access to cryptoportfolio user':
 136     type        => 'host',
 137     database    => $cf_pg_db,
 138     user        => $cf_pg_user,
 139     address     => '::1/128',
 140     auth_method => 'md5',
 141     order       => "b0",
 142   }
 143
 144   postgresql::server::pg_hba_rule { 'allow TCP access to replication user from immae.eu':
 145     type        => 'hostssl',
 146     database    => $cf_pg_db,
 147     user        => $cf_pg_user_replication,
 148     address     => 'immae.eu',
 149     auth_method => 'md5',
 150     order       => "b0",
 151   }
 152
 153   letsencrypt::certonly { $cf_front_app_host: ;
 154     default: * => $::profile::apache::letsencrypt_certonly_default;
 155   }
 156
 157   class { 'apache::mod::headers': }
 158   apache::vhost { $cf_front_app_host:
 159     port                => '443',
 160     docroot             => false,
 161     manage_docroot      => false,
 162     proxy_dest          => "http://localhost:8000",
 163     request_headers     => 'set X-Forwarded-Proto "https"',
 164     ssl                 => true,
 165     ssl_cert            => "/etc/letsencrypt/live/$cf_front_app_host/cert.pem",
 166     ssl_key             => "/etc/letsencrypt/live/$cf_front_app_host/privkey.pem",
 167     ssl_chain           => "/etc/letsencrypt/live/$cf_front_app_host/chain.pem",
 168     require             => Letsencrypt::Certonly[$cf_front_app_host],
 169     proxy_preserve_host => true;
 170     default: *          => $::profile::apache::apache_vhost_default;
 171   }
 172
 173   user { $cf_user:
 174     name       => $cf_user,
 175     ensure     => "present",
 176     managehome => true,
 177     home       => $cf_home,
 178     system     => true,
 179     password   => '!!',
 180   }
 181
 182   $front_version = lookup("cryptoportfolio::front_version") |$key| { {} }
 183   $front_sha256 = lookup("cryptoportfolio::front_sha256") |$key| { {} }
 184
 185   $bot_version = lookup("cryptoportfolio::bot_version") |$key| { {} }
 186   $bot_sha256 = lookup("cryptoportfolio::bot_sha256") |$key| { {} }
 187
 188   unless empty($bot_version) {
 189     ensure_packages(["python", "python-pip"])
 190
 191     file { $cf_bot_app:
 192       ensure  => "directory",
 193       mode    => "0700",
 194       owner   => $cf_user,
 195       group   => $cf_group,
 196       require => User[$cf_user],
 197     }
 198
 199     archive { "${cf_home}/${bot_version}.tar.gz":
 200       path          => "${cf_home}/${bot_version}.tar.gz",
 201       source        => "https://git.immae.eu/releases/cryptoportfolio/trader/trader_${bot_version}.tar.gz",
 202       checksum_type => "sha256",
 203       checksum      => $bot_sha256,
 204       cleanup       => false,
 205       extract       => true,
 206       user          => "cryptoportfolio",
 207       username      => $facts["ec2_metadata"]["hostname"],
 208       password      => generate_password(24, $password_seed, "ldap"),
 209       extract_path  => $cf_bot_app,
 210       require       => [User[$cf_user], File[$cf_bot_app]],
 211     } ~>
 212     exec { "py-cryptoportfolio-dependencies":
 213       cwd         => $cf_bot_app,
 214       user        => $cf_user,
 215       environment => ["HOME=${cf_home}"],
 216       command     => "/usr/bin/make install",
 217       require     => User[$cf_user],
 218       refreshonly => true,
 219       before      => [
 220         File[$cf_bot_app_conf],
 221         Cron["py-cryptoportfolio-before"],
 222         Cron["py-cryptoportfolio-after"],
 223       ]
 224     }
 225
 226     file { $cf_bot_app_conf:
 227       owner   => $cf_user,
 228       group   => $cf_group,
 229       mode    => "0600",
 230       content => template("role/cryptoportfolio/bot_config.ini.erb"),
 231       require => [
 232         User[$cf_user],
 233         Archive["${cf_home}/${bot_version}.tar.gz"],
 234       ],
 235     }
 236
 237     cron { "py-cryptoportfolio-before":
 238       ensure      => present,
 239       command     => "cd $cf_bot_app ; python main.py --config $cf_bot_app_conf --before",
 240       user        => "cryptoportfolio",
 241       weekday     => 7, # Sunday
 242       hour        => 22,
 243       minute      => 30,
 244       environment => ["HOME=${cf_home}","PATH=/usr/bin/"],
 245       require     => [
 246         File[$cf_bot_app_conf],
 247         Archive["${cf_home}/${bot_version}.tar.gz"]
 248       ],
 249     }
 250
 251     cron { "py-cryptoportfolio-after":
 252       ensure      => present,
 253       command     => "cd $cf_bot_app ; python main.py --config $cf_bot_app_conf --after",
 254       user        => "cryptoportfolio",
 255       weekday     => 1, # Monday
 256       hour        => 1,
 257       minute      => 0,
 258       environment => ["HOME=${cf_home}","PATH=/usr/bin/"],
 259       require     => [
 260         File[$cf_bot_app_conf],
 261         Archive["${cf_home}/${bot_version}.tar.gz"]
 262       ],
 263     }
 264   }
 265
 266   # FIXME: restore backup
 267   unless empty($front_version) {
 268     ensure_packages(["go", "npm", "nodejs", "yarn"])
 269
 270     file { [
 271         "${cf_home}/go/",
 272         "${cf_home}/go/src",
 273         "${cf_home}/go/src/immae.eu",
 274         "${cf_home}/go/src/immae.eu/Immae",
 275         "${cf_home}/go/src/immae.eu/Immae/Projets",
 276         "${cf_home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies",
 277         "${cf_home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio",
 278         $cf_front_app]:
 279       ensure  => "directory",
 280       mode    => "0700",
 281       owner   => $cf_user,
 282       group   => $cf_group,
 283       require => User[$cf_user],
 284     }
 285
 286     file { "${cf_home}/front":
 287       ensure  => "link",
 288       target  => $cf_front_app,
 289       before => File[$cf_front_app],
 290     }
 291
 292     file { "/etc/systemd/system/cryptoportfolio-app.service":
 293       mode    => "0644",
 294       owner   => "root",
 295       group   => "root",
 296       content => template("role/cryptoportfolio/cryptoportfolio-app.service.erb"),
 297       notify  => Exec["systemctl daemon-reload"],
 298     }
 299
 300     service { 'cryptoportfolio-app':
 301       enable    => true,
 302       ensure    => "running",
 303       subscribe => [Exec["go-cryptoportfolio-app"], Exec["web-cryptoportfolio-build"]],
 304       require   => [
 305         File["/etc/systemd/system/cryptoportfolio-app.service"],
 306         Postgresql::Server::Db[$cf_pg_db]
 307       ],
 308     } ~>
 309     exec { "dump $cf_pg_db structure":
 310       refreshonly => true,
 311       user        => $::profile::postgresql::pg_user,
 312       group       => $::profile::postgresql::pg_user,
 313       command     => "/usr/bin/pg_dump --schema-only --clean --no-publications $cf_pg_db > /var/lib/postgres/${cf_pg_db}.schema",
 314     }
 315
 316     archive { "${cf_home}/${front_version}.tar.gz":
 317       path          => "${cf_home}/${front_version}.tar.gz",
 318       source        => "https://git.immae.eu/releases/cryptoportfolio/front/front_${front_version}.tar.gz",
 319       checksum_type => "sha256",
 320       checksum      => $front_sha256,
 321       cleanup       => false,
 322       extract       => true,
 323       user          => $cf_user,
 324       username      => $facts["ec2_metadata"]["hostname"],
 325       password      => generate_password(24, $password_seed, "ldap"),
 326       extract_path  => $cf_front_app,
 327       require       => [User[$cf_user], File[$cf_front_app]],
 328       notify        => [
 329         Exec["web-cryptoportfolio-dependencies"],
 330         Exec["go-get-dep"],
 331       ]
 332     }
 333
 334     # Api
 335     file { $cf_front_app_api_conf:
 336       owner   => $cf_user,
 337       group   => $cf_group,
 338       mode    => "0600",
 339       content => template("role/cryptoportfolio/api_conf.toml.erb"),
 340       before  => Exec["go-cryptoportfolio-app"],
 341     }
 342
 343     exec { "go-get-dep":
 344       user        => $cf_user,
 345       environment => ["HOME=${cf_home}"],
 346       creates     => "${cf_home}/go/bin/dep",
 347       command     => "/usr/bin/go get -u github.com/golang/dep/cmd/dep",
 348       refreshonly => true,
 349     } ~>
 350     exec { "go-cryptoportfolio-dependencies":
 351       cwd         => $cf_front_app,
 352       user        => $cf_user,
 353       environment => ["HOME=${cf_home}"],
 354       command     => "${cf_home}/go/bin/dep ensure",
 355       refreshonly => true,
 356     } ~>
 357     exec { "go-cryptoportfolio-app":
 358       cwd         => $cf_front_app_api_workdir,
 359       user        => $cf_user,
 360       environment => ["HOME=${cf_home}"],
 361       command     => "/usr/bin/make build",
 362       refreshonly => true,
 363     }
 364
 365     # Static pages
 366     file { $cf_front_app_static_conf:
 367       owner   => $cf_user,
 368       group   => $cf_group,
 369       mode    => "0600",
 370       content => template("role/cryptoportfolio/static_conf.env.erb"),
 371       before  => Exec["web-cryptoportfolio-build"],
 372     }
 373
 374     exec { "web-cryptoportfolio-dependencies":
 375       cwd         => "${cf_front_app}/cmd/web",
 376       environment => ["HOME=${cf_home}"],
 377       command     => "/usr/bin/make install",
 378       refreshonly => true,
 379       require     => [Package["npm"], Package["nodejs"], Package["yarn"]]
 380     } ~>
 381     exec { "web-cryptoportfolio-build":
 382       cwd         => "${cf_front_app}/cmd/web",
 383       environment => ["HOME=${cf_home}"],
 384       path        => ["${cf_front_app}/cmd/web/node_modules/.bin/", "/usr/bin"],
 385       command     => "/usr/bin/make static ENV=${cf_env}",
 386       refreshonly => true,
 387     }
 388   }
 389 }