modules/role/manifests/cryptoportfolio.pp

   1 class role::cryptoportfolio {
   2   ensure_resource('exec', 'systemctl daemon-reload', {
   3     command     => '/usr/bin/systemctl daemon-reload',
   4     refreshonly =>  true
   5   })
   6
   7   include "base_installation"
   8
   9   include "profile::tools"
  10   include "profile::postgresql"
  11   include "profile::apache"
  12   include "profile::xmr_stak"
  13
  14   $password_seed = lookup("base_installation::puppet_pass_seed") |$key| { {} }
  15
  16   $cf_pg_user = "cryptoportfolio"
  17   $cf_pg_user_replication = "cryptoportfolio_replication"
  18   $cf_pg_db = "cryptoportfolio"
  19   $cf_pg_password = generate_password(24, $password_seed, "postgres_cryptoportfolio")
  20   $cf_pg_replication_password = generate_password(24, $password_seed, "postgres_cryptoportfolio_replication")
  21   $cf_pg_hostname = "localhost"
  22   $cf_pg_port = "5432"
  23   $cf_pg_host = "${cf_pg_hostname}:${cf_pg_port}"
  24
  25   $cf_user = "cryptoportfolio"
  26   $cf_group = "cryptoportfolio"
  27   $cf_home = "/opt/cryptoportfolio"
  28   $cf_env = "prod"
  29   $cf_front_app_host = "cryptoportfolio.immae.eu"
  30   $cf_front_app_port = ""
  31   $cf_front_app_ssl = "true"
  32   $cf_front_app = "${cf_home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio/Front"
  33   $cf_front_app_api_workdir = "${cf_front_app}/cmd/app"
  34   $cf_front_app_api_bin = "${cf_front_app_api_workdir}/cryptoportfolio-app"
  35   $cf_front_app_api_conf = "${cf_home}/conf.toml"
  36   $cf_front_app_api_secret = generate_password(24, $password_seed, "cryptoportfolio_api_secret")
  37
  38   $cf_front_app_static_conf = "${cf_front_app}/cmd/web/env/prod.env"
  39
  40   $cf_bot_app = "${cf_home}/bot"
  41   $cf_bot_app_conf = "${cf_home}/bot_config.ini"
  42   $cf_bot_app_reports = "${cf_home}/bot_reports"
  43
  44   file { "/var/lib/postgres/data/certs":
  45     ensure  => directory,
  46     mode    => "0700",
  47     owner   => $::profile::postgresql::pg_user,
  48     group   => $::profile::postgresql::pg_user,
  49     require => File["/var/lib/postgres"],
  50   }
  51
  52   file { "/var/lib/postgres/data/certs/cert.pem":
  53     source  => "file:///etc/letsencrypt/live/$cf_front_app_host/cert.pem",
  54     mode    => "0600",
  55     links   => "follow",
  56     owner   => $::profile::postgresql::pg_user,
  57     group   => $::profile::postgresql::pg_user,
  58     require => [Letsencrypt::Certonly[$cf_front_app_host], File["/var/lib/postgres/data/certs"]]
  59   }
  60
  61   file { "/var/lib/postgres/data/certs/privkey.pem":
  62     source  => "file:///etc/letsencrypt/live/$cf_front_app_host/privkey.pem",
  63     mode    => "0600",
  64     links   => "follow",
  65     owner   => $::profile::postgresql::pg_user,
  66     group   => $::profile::postgresql::pg_user,
  67     require => [Letsencrypt::Certonly[$cf_front_app_host], File["/var/lib/postgres/data/certs"]]
  68   }
  69
  70   postgresql::server::config_entry { "wal_level":
  71     value   => "logical",
  72   }
  73
  74   postgresql::server::config_entry { "ssl":
  75     value   => "on",
  76     require => Letsencrypt::Certonly[$cf_front_app_host],
  77   }
  78
  79   postgresql::server::config_entry { "ssl_cert_file":
  80     value   => "/var/lib/postgres/data/certs/cert.pem",
  81     require => Letsencrypt::Certonly[$cf_front_app_host],
  82   }
  83
  84   postgresql::server::config_entry { "ssl_key_file":
  85     value   => "/var/lib/postgres/data/certs/privkey.pem",
  86     require => Letsencrypt::Certonly[$cf_front_app_host],
  87   }
  88
  89   postgresql::server::db { $cf_pg_db:
  90     user     =>  $cf_pg_user,
  91     password =>  postgresql_password($cf_pg_user, $cf_pg_password),
  92   }
  93   ->
  94   postgresql_psql { "CREATE PUBLICATION ${cf_pg_db}_publication FOR ALL TABLES":
  95     db     => $cf_pg_db,
  96     unless => "SELECT 1 FROM pg_catalog.pg_publication WHERE pubname = '${cf_pg_db}_publication'",
  97   }
  98   ->
  99   postgresql::server::role { $cf_pg_user_replication:
 100     db            => $cf_pg_db,
 101     replication   => true,
 102     password_hash => postgresql_password($cf_pg_user_replication, $cf_pg_replication_password),
 103   }
 104   ->
 105   postgresql::server::database_grant { $cf_pg_user_replication:
 106     db        => $cf_pg_db,
 107     privilege => "CONNECT",
 108     role      => $cf_pg_user_replication,
 109   }
 110   ->
 111   postgresql::server::grant { "all tables in schema:public:$cf_pg_user_replication":
 112     db          => $cf_pg_db,
 113     role        => $cf_pg_user_replication,
 114     privilege   => "SELECT",
 115     object_type => "ALL TABLES IN SCHEMA",
 116     object_name => "public",
 117   }
 118   ->
 119   postgresql::server::grant { "all sequences in schema:public:$cf_pg_user_replication":
 120     db          => $cf_pg_db,
 121     role        => $cf_pg_user_replication,
 122     privilege   => "SELECT",
 123     object_type => "ALL SEQUENCES IN SCHEMA",
 124     object_name => "public",
 125   }
 126
 127   postgresql::server::pg_hba_rule { 'allow localhost TCP access to cryptoportfolio user':
 128     type        => 'host',
 129     database    => $cf_pg_db,
 130     user        => $cf_pg_user,
 131     address     => '127.0.0.1/32',
 132     auth_method => 'md5',
 133     order       => "b0",
 134   }
 135   postgresql::server::pg_hba_rule { 'allow localhost ip6 TCP access to cryptoportfolio user':
 136     type        => 'host',
 137     database    => $cf_pg_db,
 138     user        => $cf_pg_user,
 139     address     => '::1/128',
 140     auth_method => 'md5',
 141     order       => "b0",
 142   }
 143
 144   postgresql::server::pg_hba_rule { 'allow TCP access to replication user from immae.eu':
 145     type        => 'hostssl',
 146     database    => $cf_pg_db,
 147     user        => $cf_pg_user_replication,
 148     address     => 'immae.eu',
 149     auth_method => 'md5',
 150     order       => "b0",
 151   }
 152
 153   letsencrypt::certonly { $cf_front_app_host: ;
 154     default: * => $::profile::apache::letsencrypt_certonly_default;
 155   }
 156
 157   class { 'apache::mod::headers': }
 158   apache::vhost { $cf_front_app_host:
 159     port                => '443',
 160     docroot             => false,
 161     manage_docroot      => false,
 162     proxy_dest          => "http://localhost:8000",
 163     request_headers     => 'set X-Forwarded-Proto "https"',
 164     ssl                 => true,
 165     ssl_cert            => "/etc/letsencrypt/live/$cf_front_app_host/cert.pem",
 166     ssl_key             => "/etc/letsencrypt/live/$cf_front_app_host/privkey.pem",
 167     ssl_chain           => "/etc/letsencrypt/live/$cf_front_app_host/chain.pem",
 168     require             => Letsencrypt::Certonly[$cf_front_app_host],
 169     proxy_preserve_host => true;
 170     default: *          => $::profile::apache::apache_vhost_default;
 171   }
 172
 173   user { $cf_user:
 174     name       => $cf_user,
 175     ensure     => "present",
 176     managehome => true,
 177     home       => $cf_home,
 178     system     => true,
 179     password   => '!!',
 180   }
 181
 182   $front_version = lookup("cryptoportfolio::front_version") |$key| { {} }
 183   $front_sha256 = lookup("cryptoportfolio::front_sha256") |$key| { {} }
 184
 185   $bot_version = lookup("cryptoportfolio::bot_version") |$key| { {} }
 186   $bot_sha256 = lookup("cryptoportfolio::bot_sha256") |$key| { {} }
 187
 188   unless empty($bot_version) {
 189     ensure_packages(["python", "python-pip"])
 190
 191     file { $cf_bot_app:
 192       ensure  => "directory",
 193       mode    => "0700",
 194       owner   => $cf_user,
 195       group   => $cf_group,
 196       require => User[$cf_user],
 197     }
 198
 199     archive { "${cf_home}/${bot_version}.tar.gz":
 200       path          => "${cf_home}/${bot_version}.tar.gz",
 201       source        => "https://git.immae.eu/releases/cryptoportfolio/trader/trader_${bot_version}.tar.gz",
 202       checksum_type => "sha256",
 203       checksum      => $bot_sha256,
 204       cleanup       => false,
 205       extract       => true,
 206       user          => "cryptoportfolio",
 207       username      => $facts["ec2_metadata"]["hostname"],
 208       password      => generate_password(24, $password_seed, "ldap"),
 209       extract_path  => $cf_bot_app,
 210       require       => [User[$cf_user], File[$cf_bot_app]],
 211     } ~>
 212     exec { "py-cryptoportfolio-dependencies":
 213       cwd         => $cf_bot_app,
 214       user        => $cf_user,
 215       environment => ["HOME=${cf_home}"],
 216       command     => "/usr/bin/make install",
 217       require     => User[$cf_user],
 218       refreshonly => true,
 219       before      => [
 220         File[$cf_bot_app_conf],
 221         Cron["py-cryptoportfolio-before"],
 222         Cron["py-cryptoportfolio-after"],
 223       ]
 224     }
 225
 226     file { $cf_bot_app_conf:
 227       owner   => $cf_user,
 228       group   => $cf_group,
 229       mode    => "0600",
 230       content => template("role/cryptoportfolio/bot_config.ini.erb")
 231     }
 232
 233     cron { "py-cryptoportfolio-before":
 234       ensure      => present,
 235       command     => "cd $cf_bot_app ; python main.py --config $cf_bot_app_conf --before",
 236       user        => "cryptoportfolio",
 237       weekday     => 7, # Sunday
 238       hour        => 22,
 239       minute      => 30,
 240       environment => ["HOME=${cf_home}","PATH=/usr/bin/"],
 241       require     => [
 242         File[$cf_bot_app_conf],
 243         Archive["${cf_home}/${bot_version}.tar.gz"]
 244       ],
 245     }
 246
 247     cron { "py-cryptoportfolio-after":
 248       ensure      => present,
 249       command     => "cd $cf_bot_app ; python main.py --config $cf_bot_app_conf --after",
 250       user        => "cryptoportfolio",
 251       weekday     => 1, # Monday
 252       hour        => 1,
 253       environment => ["HOME=${cf_home}","PATH=/usr/bin/"],
 254       require     => [
 255         File[$cf_bot_app_conf],
 256         Archive["${cf_home}/${bot_version}.tar.gz"]
 257       ],
 258     }
 259   }
 260
 261   unless empty($front_version) {
 262     ensure_packages(["go", "npm", "nodejs", "yarn"])
 263
 264     file { [
 265         "${cf_home}/go/",
 266         "${cf_home}/go/src",
 267         "${cf_home}/go/src/immae.eu",
 268         "${cf_home}/go/src/immae.eu/Immae",
 269         "${cf_home}/go/src/immae.eu/Immae/Projets",
 270         "${cf_home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies",
 271         "${cf_home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio",
 272         $cf_front_app]:
 273       ensure  => "directory",
 274       mode    => "0700",
 275       owner   => $cf_user,
 276       group   => $cf_group,
 277       require => User[$cf_user],
 278     }
 279
 280     archive { "${cf_home}/${front_version}.tar.gz":
 281       path          => "${cf_home}/${front_version}.tar.gz",
 282       source        => "https://git.immae.eu/releases/cryptoportfolio/front/front_${front_version}.tar.gz",
 283       checksum_type => "sha256",
 284       checksum      => $front_sha256,
 285       cleanup       => false,
 286       extract       => true,
 287       user          => "cryptoportfolio",
 288       username      => $facts["ec2_metadata"]["hostname"],
 289       password      => generate_password(24, $password_seed, "ldap"),
 290       extract_path  => $cf_front_app,
 291       require       => [User[$cf_user], File[$cf_front_app]],
 292     }
 293
 294     file { "${cf_home}/front":
 295       ensure  => "link",
 296       target  => $cf_front_app,
 297       before => File[$cf_front_app],
 298     } ~>
 299     exec { "remove old ${cf_front_app} directory":
 300       refreshonly => true,
 301       user        => $cf_user,
 302       command     => "/usr/bin/rm -rf ${cf_front_app}",
 303       before      => File[$cf_front_app],
 304     }
 305
 306     exec { "go-get-dep":
 307       user        => $cf_user,
 308       environment => ["HOME=${cf_home}"],
 309       creates     => "${cf_home}/go/bin/dep",
 310       command     => "/usr/bin/go get -u github.com/golang/dep/cmd/dep",
 311       require     => User[$cf_user],
 312     }
 313
 314     exec { "go-cryptoportfolio-dependencies":
 315       cwd         => $cf_front_app,
 316       user        => $cf_user,
 317       environment => ["HOME=${cf_home}"],
 318       creates     => "${cf_front_app}/vendor",
 319       command     => "${cf_home}/go/bin/dep ensure",
 320       require     => [Exec["go-get-dep"], Archive["${cf_home}/${front_version}.tar.gz"]],
 321     }
 322
 323     exec { "go-cryptoportfolio-app":
 324       cwd         => $cf_front_app_api_workdir,
 325       user        => $cf_user,
 326       environment => ["HOME=${cf_home}"],
 327       creates     => $cf_front_app_api_bin,
 328       command     => "/usr/bin/make build",
 329       require     => Exec["go-cryptoportfolio-dependencies"],
 330     }
 331
 332     file { "/etc/systemd/system/cryptoportfolio-app.service":
 333       mode    => "0644",
 334       owner   => "root",
 335       group   => "root",
 336       content => template("role/cryptoportfolio/cryptoportfolio-app.service.erb"),
 337       notify  => Exec["systemctl daemon-reload"],
 338     }
 339
 340     service { 'cryptoportfolio-app':
 341       enable    => true,
 342       ensure    => "running",
 343       subscribe => [Exec["go-cryptoportfolio-app"], Exec["web-cryptoportfolio-build"]],
 344       require   => [
 345         File["/etc/systemd/system/cryptoportfolio-app.service"],
 346         Postgresql::Server::Db[$cf_pg_db]
 347       ],
 348     } ~>
 349     exec { "dump $cf_pg_db structure":
 350       refreshonly => true,
 351       user        => $::profile::postgresql::pg_user,
 352       group       => $::profile::postgresql::pg_user,
 353       command     => "/usr/bin/pg_dump --schema-only --clean --no-publications $cf_pg_db > /var/lib/postgres/${cf_pg_db}.schema",
 354     }
 355
 356     file { $cf_front_app_api_conf:
 357       owner   => $cf_user,
 358       group   => $cf_group,
 359       mode    => "0600",
 360       content => template("role/cryptoportfolio/api_conf.toml.erb"),
 361     }
 362
 363     file { $cf_front_app_static_conf:
 364       owner   => $cf_user,
 365       group   => $cf_group,
 366       mode    => "0600",
 367       content => template("role/cryptoportfolio/static_conf.env.erb"),
 368       notify  => Exec["remove build ${cf_front_app}/cmd/web/build/"],
 369     }
 370
 371     exec { "web-cryptoportfolio-dependencies":
 372       cwd         => "${cf_front_app}/cmd/web",
 373       environment => ["HOME=${cf_home}"],
 374       command     => "/usr/bin/make install",
 375       creates     => "${cf_front_app}/cmd/web/node_modules",
 376       notify      => Exec["remove build ${cf_front_app}/cmd/web/build/"],
 377       require     => [Package["npm"], Package["nodejs"], Package["yarn"]]
 378     }
 379
 380     exec { "remove build ${cf_front_app}/cmd/web/build/":
 381       command     => "/usr/bin/rm -rf '${cf_front_app}/cmd/web/build/'",
 382       refreshonly => true,
 383       before      => Exec["web-cryptoportfolio-build"]
 384     }
 385
 386     exec { "web-cryptoportfolio-build":
 387       cwd         => "${cf_front_app}/cmd/web",
 388       environment => ["HOME=${cf_home}"],
 389       path        => ["${cf_front_app}/cmd/web/node_modules/.bin/", "/usr/bin"],
 390       command     => "/usr/bin/make static ENV=${cf_env}",
 391       creates     => "${cf_front_app}/cmd/web/build/static",
 392       require     => [File[$cf_front_app_static_conf], Exec["web-cryptoportfolio-dependencies"]]
 393     }
 394   }
 395 }