diff options
author | Ismaël Bouya <ismael.bouya@normalesup.org> | 2018-06-27 14:14:24 +0200 |
---|---|---|
committer | Ismaël Bouya <ismael.bouya@normalesup.org> | 2018-06-27 14:14:24 +0200 |
commit | e122c6b1ca829844247fbe43f63c74f3f589554f (patch) | |
tree | 1d70c8ae571e25cafe5ad481f3748be3588e0cd6 | |
parent | c93847dc9d2f9dea6ed09ce5f0cca479131de86d (diff) | |
parent | f1d583bfdaf881116e5f9ca9e050307e7acdc28e (diff) | |
download | Puppet-e122c6b1ca829844247fbe43f63c74f3f589554f.tar.gz Puppet-e122c6b1ca829844247fbe43f63c74f3f589554f.tar.zst Puppet-e122c6b1ca829844247fbe43f63c74f3f589554f.zip |
Merge branch 'dev'
-rw-r--r-- | .gitmodules | 3 | ||||
-rw-r--r-- | environments/global/roles/etherpad.yaml | 3 | ||||
m--------- | external_modules/patch | 0 | ||||
-rw-r--r-- | modules/base_installation/files/scripts/puppet_reset_and_apply | 3 | ||||
-rw-r--r-- | modules/base_installation/lib/puppet/parser/functions/find_host.rb | 18 | ||||
-rw-r--r-- | modules/base_installation/templates/puppet/host_ldap.info.erb | 1 | ||||
-rw-r--r-- | modules/profile/files/postgresql_master/pam_postgresql | 3 | ||||
-rw-r--r-- | modules/profile/manifests/postgresql_master.pp | 121 | ||||
-rw-r--r-- | modules/profile/templates/postgresql_master/pam_ldap_postgresql.conf.erb | 6 | ||||
-rw-r--r-- | modules/role/files/etherpad/libreoffice_patch.diff | 11 | ||||
-rw-r--r-- | modules/role/manifests/backup.pp | 8 | ||||
-rw-r--r-- | modules/role/manifests/backup/postgresql.pp | 117 | ||||
-rw-r--r-- | modules/role/manifests/etherpad.pp | 108 | ||||
-rw-r--r-- | modules/role/templates/backup/pam_ldap_pgbouncer.conf.erb | 2 | ||||
-rw-r--r-- | modules/role/templates/backup/postgresql.conf.erb | 9 | ||||
-rw-r--r-- | modules/role/templates/etherpad/settings.json.erb | 93 | ||||
-rw-r--r-- | python/reboot_ovh_cloud_instance.py | 3 |
17 files changed, 496 insertions, 13 deletions
diff --git a/.gitmodules b/.gitmodules index 0f21622..d68cf4e 100644 --- a/.gitmodules +++ b/.gitmodules | |||
@@ -64,3 +64,6 @@ | |||
64 | [submodule "external_modules/slack"] | 64 | [submodule "external_modules/slack"] |
65 | path = external_modules/slack | 65 | path = external_modules/slack |
66 | url = git://git.immae.eu/github/cegeka/puppet-slack | 66 | url = git://git.immae.eu/github/cegeka/puppet-slack |
67 | [submodule "external_modules/patch"] | ||
68 | path = external_modules/patch | ||
69 | url = git://git.immae.eu/github/tohuwabohu/puppet-patch.git | ||
diff --git a/environments/global/roles/etherpad.yaml b/environments/global/roles/etherpad.yaml new file mode 100644 index 0000000..f8781e1 --- /dev/null +++ b/environments/global/roles/etherpad.yaml | |||
@@ -0,0 +1,3 @@ | |||
1 | --- | ||
2 | classes: | ||
3 | role::etherpad: ~ | ||
diff --git a/external_modules/patch b/external_modules/patch new file mode 160000 | |||
Subproject fed3814e759347d72b919ebeb1b6837c5d13373 | |||
diff --git a/modules/base_installation/files/scripts/puppet_reset_and_apply b/modules/base_installation/files/scripts/puppet_reset_and_apply index 0350e6e..7ec7053 100644 --- a/modules/base_installation/files/scripts/puppet_reset_and_apply +++ b/modules/base_installation/files/scripts/puppet_reset_and_apply | |||
@@ -6,9 +6,10 @@ git fetch origin | |||
6 | branch="master" | 6 | branch="master" |
7 | if [ -n "$1" ]; then | 7 | if [ -n "$1" ]; then |
8 | branch="$1" | 8 | branch="$1" |
9 | shift | ||
9 | fi | 10 | fi |
10 | 11 | ||
11 | git reset --hard origin/$branch | 12 | git reset --hard origin/$branch |
12 | 13 | ||
13 | git submodule update --init | 14 | git submodule update --init |
14 | puppet_apply --test manifests/site.pp | 15 | puppet_apply "$@" --test manifests/site.pp |
diff --git a/modules/base_installation/lib/puppet/parser/functions/find_host.rb b/modules/base_installation/lib/puppet/parser/functions/find_host.rb new file mode 100644 index 0000000..79aae5c --- /dev/null +++ b/modules/base_installation/lib/puppet/parser/functions/find_host.rb | |||
@@ -0,0 +1,18 @@ | |||
1 | module Puppet::Parser::Functions | ||
2 | newfunction(:find_host, :type => :rvalue, :doc => <<-EOS | ||
3 | This function searches through the hosts to find the one with matching cn | ||
4 | EOS | ||
5 | ) do |arguments| | ||
6 | |||
7 | if (arguments.size != 2) then | ||
8 | raise(Puppet::ParseError, "grep(): Wrong number of arguments given #{arguments.size} for 2") | ||
9 | end | ||
10 | |||
11 | hosts = arguments[0] | ||
12 | cn = arguments[1] | ||
13 | |||
14 | hosts.find { |host| host["cn"].any? { |cn_| cn_ == cn } } | ||
15 | end | ||
16 | end | ||
17 | |||
18 | # vim: set ts=2 sw=2 et : | ||
diff --git a/modules/base_installation/templates/puppet/host_ldap.info.erb b/modules/base_installation/templates/puppet/host_ldap.info.erb index 9c79d3c..7afdf2d 100644 --- a/modules/base_installation/templates/puppet/host_ldap.info.erb +++ b/modules/base_installation/templates/puppet/host_ldap.info.erb | |||
@@ -12,6 +12,7 @@ objectclass: ipHost | |||
12 | <% unless @ips["v6"].nil? -%>ipHostNumber: <%= @ips["v6"]["ipAddress"] %>/<%= @ips["v6"]["mask"] %><%- end %> | 12 | <% unless @ips["v6"].nil? -%>ipHostNumber: <%= @ips["v6"]["ipAddress"] %>/<%= @ips["v6"]["mask"] %><%- end %> |
13 | <%- end -%> | 13 | <%- end -%> |
14 | environment: <%= @environment %> | 14 | environment: <%= @environment %> |
15 | puppetVar: real_hostname=<%= @real_hostname %> | ||
15 | userpassword: {SSHA}<%= Base64.encode64(Digest::SHA1.digest(@ldap_password+@ssha_ldap_seed)+@ssha_ldap_seed).chomp! %> | 16 | userpassword: {SSHA}<%= Base64.encode64(Digest::SHA1.digest(@ldap_password+@ssha_ldap_seed)+@ssha_ldap_seed).chomp! %> |
16 | EOF | 17 | EOF |
17 | [0;35m#### Or modify an existing entry:[0m | 18 | [0;35m#### Or modify an existing entry:[0m |
diff --git a/modules/profile/files/postgresql_master/pam_postgresql b/modules/profile/files/postgresql_master/pam_postgresql new file mode 100644 index 0000000..70a90ae --- /dev/null +++ b/modules/profile/files/postgresql_master/pam_postgresql | |||
@@ -0,0 +1,3 @@ | |||
1 | auth required pam_ldap.so config=/etc/pam_ldap.d/postgresql.conf | ||
2 | account required pam_ldap.so config=/etc/pam_ldap.d/postgresql.conf | ||
3 | |||
diff --git a/modules/profile/manifests/postgresql_master.pp b/modules/profile/manifests/postgresql_master.pp new file mode 100644 index 0000000..067345a --- /dev/null +++ b/modules/profile/manifests/postgresql_master.pp | |||
@@ -0,0 +1,121 @@ | |||
1 | define profile::postgresql_master ( | ||
2 | $letsencrypt_host = undef, | ||
3 | $backup_hosts = [], | ||
4 | ) { | ||
5 | $password_seed = lookup("base_installation::puppet_pass_seed") | ||
6 | |||
7 | ensure_resource("file", "/var/lib/postgres/data/certs", { | ||
8 | ensure => directory, | ||
9 | mode => "0700", | ||
10 | owner => $::profile::postgresql::pg_user, | ||
11 | group => $::profile::postgresql::pg_user, | ||
12 | require => File["/var/lib/postgres"], | ||
13 | }) | ||
14 | |||
15 | ensure_resource("file", "/var/lib/postgres/data/certs/cert.pem", { | ||
16 | source => "file:///etc/letsencrypt/live/$letsencrypt_host/cert.pem", | ||
17 | mode => "0600", | ||
18 | links => "follow", | ||
19 | owner => $::profile::postgresql::pg_user, | ||
20 | group => $::profile::postgresql::pg_user, | ||
21 | require => [Letsencrypt::Certonly[$letsencrypt_host], File["/var/lib/postgres/data/certs"]] | ||
22 | }) | ||
23 | |||
24 | ensure_resource("file", "/var/lib/postgres/data/certs/privkey.pem", { | ||
25 | source => "file:///etc/letsencrypt/live/$letsencrypt_host/privkey.pem", | ||
26 | mode => "0600", | ||
27 | links => "follow", | ||
28 | owner => $::profile::postgresql::pg_user, | ||
29 | group => $::profile::postgresql::pg_user, | ||
30 | require => [Letsencrypt::Certonly[$letsencrypt_host], File["/var/lib/postgres/data/certs"]] | ||
31 | }) | ||
32 | |||
33 | ensure_resource("postgresql::server::config_entry", "wal_level", { | ||
34 | value => "logical", | ||
35 | }) | ||
36 | |||
37 | ensure_resource("postgresql::server::config_entry", "ssl", { | ||
38 | value => "on", | ||
39 | require => Letsencrypt::Certonly[$letsencrypt_host], | ||
40 | }) | ||
41 | |||
42 | ensure_resource("postgresql::server::config_entry", "ssl_cert_file", { | ||
43 | value => "/var/lib/postgres/data/certs/cert.pem", | ||
44 | require => Letsencrypt::Certonly[$letsencrypt_host], | ||
45 | }) | ||
46 | |||
47 | ensure_resource("postgresql::server::config_entry", "ssl_key_file", { | ||
48 | value => "/var/lib/postgres/data/certs/privkey.pem", | ||
49 | require => Letsencrypt::Certonly[$letsencrypt_host], | ||
50 | }) | ||
51 | |||
52 | $backup_hosts.each |$backup_host| { | ||
53 | ensure_packages(["pam_ldap"]) | ||
54 | |||
55 | $host = find_host($facts["ldapvar"]["other"], $backup_host) | ||
56 | unless empty($host) { | ||
57 | $host["ipHostNumber"].each |$ip| { | ||
58 | $infos = split($ip, "/") | ||
59 | $ipaddress = $infos[0] | ||
60 | if (length($infos) == 1 and $ipaddress =~ /:/) { | ||
61 | $mask = "128" | ||
62 | } elsif (length($infos) == 1) { | ||
63 | $mask = "32" | ||
64 | } else { | ||
65 | $mask = $infos[1] | ||
66 | } | ||
67 | |||
68 | postgresql::server::pg_hba_rule { "allow TCP access to replication user from backup for replication from $ipaddress/$mask": | ||
69 | type => 'hostssl', | ||
70 | database => 'replication', | ||
71 | user => $backup_host, | ||
72 | address => "$ipaddress/$mask", | ||
73 | auth_method => 'pam', | ||
74 | order => "06-01", | ||
75 | } | ||
76 | } | ||
77 | |||
78 | postgresql::server::role { $backup_host: | ||
79 | replication => true, | ||
80 | } | ||
81 | |||
82 | postgresql_replication_slot { regsubst($backup_host, '-', "_", "G"): | ||
83 | ensure => present | ||
84 | } | ||
85 | } | ||
86 | } | ||
87 | |||
88 | $ldap_server = lookup("base_installation::ldap_server") | ||
89 | $ldap_base = lookup("base_installation::ldap_base") | ||
90 | $ldap_dn = lookup("base_installation::ldap_dn") | ||
91 | $ldap_cn = lookup("base_installation::ldap_cn") | ||
92 | $ldap_password = generate_password(24, $password_seed, "ldap") | ||
93 | $ldap_attribute = "cn" | ||
94 | |||
95 | # This is to be replicated to the backup | ||
96 | postgresql::server::role { $ldap_cn: | ||
97 | replication => true, | ||
98 | } | ||
99 | |||
100 | file { "/etc/pam_ldap.d": | ||
101 | ensure => directory, | ||
102 | mode => "0755", | ||
103 | owner => "root", | ||
104 | group => "root", | ||
105 | } -> | ||
106 | file { "/etc/pam_ldap.d/postgresql.conf": | ||
107 | ensure => "present", | ||
108 | mode => "0600", | ||
109 | owner => $::profile::postgresql::pg_user, | ||
110 | group => "root", | ||
111 | content => template("profile/postgresql_master/pam_ldap_postgresql.conf.erb"), | ||
112 | } -> | ||
113 | file { "/etc/pam.d/postgresql": | ||
114 | ensure => "present", | ||
115 | mode => "0644", | ||
116 | owner => "root", | ||
117 | group => "root", | ||
118 | source => "puppet:///modules/profile/postgresql_master/pam_postgresql" | ||
119 | } | ||
120 | |||
121 | } | ||
diff --git a/modules/profile/templates/postgresql_master/pam_ldap_postgresql.conf.erb b/modules/profile/templates/postgresql_master/pam_ldap_postgresql.conf.erb new file mode 100644 index 0000000..f3d9674 --- /dev/null +++ b/modules/profile/templates/postgresql_master/pam_ldap_postgresql.conf.erb | |||
@@ -0,0 +1,6 @@ | |||
1 | host <%= @ldap_server %> | ||
2 | |||
3 | base <%= @ldap_base %> | ||
4 | binddn <%= @ldap_dn %> | ||
5 | bindpw <%= @ldap_password %> | ||
6 | pam_login_attribute <%= @ldap_attribute %> | ||
diff --git a/modules/role/files/etherpad/libreoffice_patch.diff b/modules/role/files/etherpad/libreoffice_patch.diff new file mode 100644 index 0000000..dbfdf1a --- /dev/null +++ b/modules/role/files/etherpad/libreoffice_patch.diff | |||
@@ -0,0 +1,11 @@ | |||
1 | --- a/LibreOffice.js 2018-06-18 09:54:15.087161212 +0200 | ||
2 | +++ b/LibreOffice.js 2018-06-18 10:33:27.534055021 +0200 | ||
3 | @@ -63,6 +63,7 @@ | ||
4 | '--invisible', | ||
5 | '--nologo', | ||
6 | '--nolockcheck', | ||
7 | + '-env:UserInstallation=file:///tmp/', | ||
8 | '--convert-to', task.type, | ||
9 | task.srcFile, | ||
10 | '--outdir', tmpDir | ||
11 | |||
diff --git a/modules/role/manifests/backup.pp b/modules/role/manifests/backup.pp index b35c542..51b689d 100644 --- a/modules/role/manifests/backup.pp +++ b/modules/role/manifests/backup.pp | |||
@@ -17,6 +17,14 @@ class role::backup ( | |||
17 | 17 | ||
18 | include "role::backup::postgresql" | 18 | include "role::backup::postgresql" |
19 | 19 | ||
20 | ensure_packages(["python", "python-pip"]) | ||
21 | package { "pylog2rotate": | ||
22 | source => "git+https://github.com/avian2/pylog2rotate", | ||
23 | ensure => present, | ||
24 | provider => "pip3", | ||
25 | require => Package["python-pip"], | ||
26 | } | ||
27 | |||
20 | ensure_packages(["rsync"]) | 28 | ensure_packages(["rsync"]) |
21 | 29 | ||
22 | ssh_keygen { $user: | 30 | ssh_keygen { $user: |
diff --git a/modules/role/manifests/backup/postgresql.pp b/modules/role/manifests/backup/postgresql.pp index e635611..ee62a00 100644 --- a/modules/role/manifests/backup/postgresql.pp +++ b/modules/role/manifests/backup/postgresql.pp | |||
@@ -13,7 +13,7 @@ class role::backup::postgresql inherits role::backup { | |||
13 | $ldap_server = lookup("base_installation::ldap_server") | 13 | $ldap_server = lookup("base_installation::ldap_server") |
14 | $ldap_base = lookup("base_installation::ldap_base") | 14 | $ldap_base = lookup("base_installation::ldap_base") |
15 | $ldap_dn = lookup("base_installation::ldap_dn") | 15 | $ldap_dn = lookup("base_installation::ldap_dn") |
16 | $ldap_attribute = "uid" | 16 | $pgbouncer_ldap_attribute = "uid" |
17 | 17 | ||
18 | $pg_slot = regsubst($ldap_cn, '-', "_", "G") | 18 | $pg_slot = regsubst($ldap_cn, '-', "_", "G") |
19 | 19 | ||
@@ -71,18 +71,13 @@ class role::backup::postgresql inherits role::backup { | |||
71 | ], | 71 | ], |
72 | } | 72 | } |
73 | 73 | ||
74 | file { "/etc/pam_ldap.d": | ||
75 | ensure => directory, | ||
76 | mode => "0755", | ||
77 | owner => "root", | ||
78 | group => "root", | ||
79 | } -> | ||
80 | file { "/etc/pam_ldap.d/pgbouncer.conf": | 74 | file { "/etc/pam_ldap.d/pgbouncer.conf": |
81 | ensure => "present", | 75 | ensure => "present", |
82 | mode => "0600", | 76 | mode => "0600", |
83 | owner => $pg_user, | 77 | owner => $pg_user, |
84 | group => "root", | 78 | group => "root", |
85 | content => template("role/backup/pam_ldap_pgbouncer.conf.erb"), | 79 | content => template("role/backup/pam_ldap_pgbouncer.conf.erb"), |
80 | require => File["/etc/pam_ldap.d"], | ||
86 | } -> | 81 | } -> |
87 | file { "/etc/pam.d/pgbouncer": | 82 | file { "/etc/pam.d/pgbouncer": |
88 | ensure => "present", | 83 | ensure => "present", |
@@ -94,17 +89,107 @@ class role::backup::postgresql inherits role::backup { | |||
94 | } | 89 | } |
95 | } | 90 | } |
96 | 91 | ||
97 | $pg_backup_hosts.each |$pg_backup_host, $pg_infos| { | 92 | $ldap_attribute = "cn" |
93 | |||
94 | file { "/etc/pam_ldap.d": | ||
95 | ensure => directory, | ||
96 | mode => "0755", | ||
97 | owner => "root", | ||
98 | group => "root", | ||
99 | } -> | ||
100 | file { "/etc/pam_ldap.d/postgresql.conf": | ||
101 | ensure => "present", | ||
102 | mode => "0600", | ||
103 | owner => $pg_user, | ||
104 | group => "root", | ||
105 | content => template("profile/postgresql_master/pam_ldap_postgresql.conf.erb"), | ||
106 | } -> | ||
107 | file { "/etc/pam.d/postgresql": | ||
108 | ensure => "present", | ||
109 | mode => "0644", | ||
110 | owner => "root", | ||
111 | group => "root", | ||
112 | source => "puppet:///modules/profile/postgresql_master/pam_postgresql" | ||
113 | } | ||
114 | |||
115 | $pg_backup_hosts.each |$backup_host_cn, $pg_infos| { | ||
116 | $host = find_host($facts["ldapvar"]["other"], $backup_host_cn) | ||
117 | if empty($host) { | ||
118 | $pg_backup_host = $backup_host_cn | ||
119 | } elsif has_key($host["vars"], "host") { | ||
120 | $pg_backup_host = $host["vars"]["host"][0] | ||
121 | } else { | ||
122 | $pg_backup_host = $host["vars"]["real_hostname"][0] | ||
123 | } | ||
124 | |||
98 | $pg_path = "$mountpoint/$pg_backup_host/postgresql" | 125 | $pg_path = "$mountpoint/$pg_backup_host/postgresql" |
99 | $pg_backup_path = "$mountpoint/$pg_backup_host/postgresql_backup" | 126 | $pg_backup_path = "$mountpoint/$pg_backup_host/postgresql_backup" |
100 | $pg_host = "$pg_backup_host" | 127 | $pg_host = "$pg_backup_host" |
101 | $pg_port = $pg_infos["dbport"] | 128 | $pg_port = $pg_infos["dbport"] |
102 | 129 | ||
130 | if has_key($host["vars"], "postgresql_backup_port") { | ||
131 | $pg_listen_port = $host["vars"]["postgresql_backup_port"][0] | ||
132 | file { "$pg_path/certs": | ||
133 | ensure => directory, | ||
134 | mode => "0700", | ||
135 | owner => $pg_user, | ||
136 | group => $pg_group, | ||
137 | } -> | ||
138 | ssl::self_signed_certificate { $backup_host_cn: | ||
139 | common_name => $backup_host_cn, | ||
140 | country => "FR", | ||
141 | days => "3650", | ||
142 | organization => "Immae", | ||
143 | owner => $pg_user, | ||
144 | group => $pg_group, | ||
145 | directory => "$pg_path/certs", | ||
146 | before => File["$pg_path/postgresql.conf"], | ||
147 | } | ||
148 | $ssl_key = "$pg_path/certs/$backup_host_cn.key" | ||
149 | $ssl_cert = "$pg_path/certs/$backup_host_cn.crt" | ||
150 | } else { | ||
151 | $pg_listen_port = undef | ||
152 | $ssl_key = undef | ||
153 | $ssl_cert = undef | ||
154 | } | ||
155 | |||
156 | |||
157 | unless empty($host) { | ||
158 | $host["ipHostNumber"].each |$ip| { | ||
159 | $infos = split($ip, "/") | ||
160 | $ipaddress = $infos[0] | ||
161 | if (length($infos) == 1 and $ipaddress =~ /:/) { | ||
162 | $mask = "128" | ||
163 | } elsif (length($infos) == 1) { | ||
164 | $mask = "32" | ||
165 | } else { | ||
166 | $mask = $infos[1] | ||
167 | } | ||
168 | |||
169 | postgresql::server::pg_hba_rule { "allow TCP access for initial replication from $ipaddress/$mask": | ||
170 | type => 'hostssl', | ||
171 | database => 'replication', | ||
172 | user => $backup_host_cn, | ||
173 | address => "$ipaddress/$mask", | ||
174 | auth_method => 'pam', | ||
175 | order => "06-01", | ||
176 | target => "$pg_path/pg_hba.conf", | ||
177 | postgresql_version => "10", | ||
178 | } | ||
179 | } | ||
180 | } | ||
181 | |||
103 | if !empty($ldap_filter) and ($pg_infos["pgbouncer"]) { | 182 | if !empty($ldap_filter) and ($pg_infos["pgbouncer"]) { |
183 | if empty($pg_listen_port) { | ||
184 | $pg_listen_port_key = "" | ||
185 | } else { | ||
186 | $pg_listen_port_key = "port=$pg_listen_port" | ||
187 | } | ||
188 | |||
104 | concat::fragment { "pgbouncer_$pg_backup_host": | 189 | concat::fragment { "pgbouncer_$pg_backup_host": |
105 | target => "/etc/pgbouncer/pgbouncer.ini", | 190 | target => "/etc/pgbouncer/pgbouncer.ini", |
106 | order => 02, | 191 | order => 02, |
107 | content => "${pg_infos[pgbouncer_dbname]} = host=$mountpoint/$pg_backup_host/postgresql user=${pg_infos[dbuser]} dbname=${pg_infos[dbname]}", | 192 | content => "${pg_infos[pgbouncer_dbname]} = host=$mountpoint/$pg_backup_host/postgresql $pg_listen_port_key user=${pg_infos[dbuser]} dbname=${pg_infos[dbname]}", |
108 | } | 193 | } |
109 | 194 | ||
110 | postgresql::server::pg_hba_rule { "$pg_backup_host - local access as ${pg_infos[dbuser]} user": | 195 | postgresql::server::pg_hba_rule { "$pg_backup_host - local access as ${pg_infos[dbuser]} user": |
@@ -153,12 +238,19 @@ class role::backup::postgresql inherits role::backup { | |||
153 | description => "Backup the database", | 238 | description => "Backup the database", |
154 | }, | 239 | }, |
155 | { | 240 | { |
156 | command => "/usr/bin/rm -f $(ls -1 $pg_backup_path/*.sql | sort -r | sed -e '1,16d')", | 241 | command => "/usr/bin/rm -f $(ls -1 $pg_backup_path/*.sql | grep -v 'T22:' | sort -r | sed -e '1,12d')", |
157 | user => $pg_user, | 242 | user => $pg_user, |
158 | hour => 3, | 243 | hour => 3, |
159 | minute => 0, | 244 | minute => 0, |
160 | description => "Cleanup the database backups", | 245 | description => "Cleanup the database backups", |
161 | }, | 246 | }, |
247 | { | ||
248 | command => "cd $pg_backup_path ; /usr/bin/rm -f $(ls -1 *T22*.sql | log2rotate --skip 7 --fuzz 7 --delete --format='%Y-%m-%dT%H:%M:%S+02:00.sql')", | ||
249 | user => $pg_user, | ||
250 | hour => 3, | ||
251 | minute => 1, | ||
252 | description => "Cleanup the database backups exponentially", | ||
253 | }, | ||
162 | ] | 254 | ] |
163 | } | 255 | } |
164 | 256 | ||
@@ -277,6 +369,11 @@ class role::backup::postgresql inherits role::backup { | |||
277 | Concat["$pg_path/pg_hba.conf"], | 369 | Concat["$pg_path/pg_hba.conf"], |
278 | Concat["$pg_path/recovery.conf"], | 370 | Concat["$pg_path/recovery.conf"], |
279 | File["$pg_path/postgresql.conf"], | 371 | File["$pg_path/postgresql.conf"], |
372 | ], | ||
373 | subscribe => [ | ||
374 | Concat["$pg_path/pg_hba.conf"], | ||
375 | Concat["$pg_path/recovery.conf"], | ||
376 | File["$pg_path/postgresql.conf"], | ||
280 | ] | 377 | ] |
281 | } | 378 | } |
282 | } | 379 | } |
diff --git a/modules/role/manifests/etherpad.pp b/modules/role/manifests/etherpad.pp new file mode 100644 index 0000000..109da96 --- /dev/null +++ b/modules/role/manifests/etherpad.pp | |||
@@ -0,0 +1,108 @@ | |||
1 | class role::etherpad ( | ||
2 | ) { | ||
3 | $password_seed = lookup("base_installation::puppet_pass_seed") | ||
4 | $web_host = lookup("base_installation::real_hostname") | ||
5 | $web_listen = "0.0.0.0" | ||
6 | $web_port = 18000 | ||
7 | $pg_db = "etherpad-lite" | ||
8 | $pg_user = "etherpad-lite" | ||
9 | $pg_password = generate_password(24, $password_seed, "postgres_etherpad") | ||
10 | |||
11 | $ldap_server = lookup("base_installation::ldap_server") | ||
12 | $ldap_base = lookup("base_installation::ldap_base") | ||
13 | $ldap_dn = lookup("base_installation::ldap_dn") | ||
14 | $ldap_account_pattern = "(&(memberOf=cn=users,cn=etherpad,ou=services,dc=immae,dc=eu)(uid={{username}}))" | ||
15 | $ldap_group_pattern = "(memberOf=cn=groups,cn=etherpad,ou=services,dc=immae,dc=eu)" | ||
16 | $ldap_password = generate_password(24, $password_seed, "ldap") | ||
17 | |||
18 | |||
19 | include "base_installation" | ||
20 | |||
21 | include "profile::tools" | ||
22 | include "profile::postgresql" | ||
23 | include "profile::apache" | ||
24 | |||
25 | ensure_packages(["npm"]) | ||
26 | ensure_packages(["abiword"]) | ||
27 | ensure_packages(["libreoffice-fresh", "libreoffice-fresh-fr", "java-runtime-common", "jre8-openjdk"]) | ||
28 | ensure_packages(["tidy"]) | ||
29 | aur::package { "etherpad-lite": } | ||
30 | -> patch::file { "/usr/share/etherpad-lite/src/node/utils/LibreOffice.js": | ||
31 | diff_source => "puppet:///modules/role/etherpad/libreoffice_patch.diff", | ||
32 | } | ||
33 | -> file { "/etc/etherpad-lite/settings.json": | ||
34 | ensure => present, | ||
35 | owner => "etherpad-lite", | ||
36 | group => "etherpad-lite", | ||
37 | notify => Service["etherpad-lite"], | ||
38 | content => template("role/etherpad/settings.json.erb"), | ||
39 | } | ||
40 | |||
41 | $modules = [ | ||
42 | "ep_aa_file_menu_toolbar", | ||
43 | "ep_adminpads", | ||
44 | "ep_align", | ||
45 | "ep_bookmark", | ||
46 | "ep_clear_formatting", | ||
47 | "ep_colors", | ||
48 | "ep_copy_paste_select_all", | ||
49 | "ep_cursortrace", | ||
50 | "ep_embedmedia", | ||
51 | "ep_font_family", | ||
52 | "ep_font_size", | ||
53 | "ep_headings2", | ||
54 | "ep_ldapauth", | ||
55 | "ep_line_height", | ||
56 | "ep_markdown", | ||
57 | "ep_previewimages", | ||
58 | "ep_ruler", | ||
59 | "ep_scrollto", | ||
60 | "ep_set_title_on_pad", | ||
61 | "ep_subscript_and_superscript", | ||
62 | "ep_timesliderdiff" | ||
63 | ] | ||
64 | |||
65 | $modules.each |$module| { | ||
66 | exec { "npm_install_$module": | ||
67 | command => "/usr/bin/npm install $module", | ||
68 | unless => "/usr/bin/test -d /usr/share/etherpad-lite/node_modules/$module", | ||
69 | cwd => "/usr/share/etherpad-lite/", | ||
70 | environment => "HOME=/root", | ||
71 | require => Aur::Package["etherpad-lite"], | ||
72 | before => Service["etherpad-lite"], | ||
73 | notify => Service["etherpad-lite"], | ||
74 | } | ||
75 | -> | ||
76 | file { "/usr/share/etherpad-lite/node_modules/$module/.ep_initialized": | ||
77 | ensure => present, | ||
78 | mode => "0644", | ||
79 | before => Service["etherpad-lite"], | ||
80 | } | ||
81 | } | ||
82 | |||
83 | service { "etherpad-lite": | ||
84 | enable => true, | ||
85 | ensure => "running", | ||
86 | require => Aur::Package["etherpad-lite"], | ||
87 | subscribe => Aur::Package["etherpad-lite"], | ||
88 | } | ||
89 | |||
90 | profile::postgresql_master { "postgresql master for etherpad": | ||
91 | letsencrypt_host => $web_host, | ||
92 | backup_hosts => ["backup-1"], | ||
93 | } | ||
94 | |||
95 | postgresql::server::db { $pg_db: | ||
96 | user => $pg_user, | ||
97 | password => postgresql_password($pg_user, $pg_password), | ||
98 | } | ||
99 | |||
100 | postgresql::server::pg_hba_rule { "allow local access to $pg_user user": | ||
101 | type => 'local', | ||
102 | database => $pg_db, | ||
103 | user => $pg_user, | ||
104 | auth_method => 'ident', | ||
105 | order => "05-01", | ||
106 | } | ||
107 | |||
108 | } | ||
diff --git a/modules/role/templates/backup/pam_ldap_pgbouncer.conf.erb b/modules/role/templates/backup/pam_ldap_pgbouncer.conf.erb index 12fa9bb..384a418 100644 --- a/modules/role/templates/backup/pam_ldap_pgbouncer.conf.erb +++ b/modules/role/templates/backup/pam_ldap_pgbouncer.conf.erb | |||
@@ -3,5 +3,5 @@ host <%= @ldap_server %> | |||
3 | base <%= @ldap_base %> | 3 | base <%= @ldap_base %> |
4 | binddn <%= @ldap_dn %> | 4 | binddn <%= @ldap_dn %> |
5 | bindpw <%= @ldap_password %> | 5 | bindpw <%= @ldap_password %> |
6 | pam_login_attribute <%= @ldap_attribute %> | 6 | pam_login_attribute <%= @pgbouncer_ldap_attribute %> |
7 | pam_filter <%= @ldap_filter %> | 7 | pam_filter <%= @ldap_filter %> |
diff --git a/modules/role/templates/backup/postgresql.conf.erb b/modules/role/templates/backup/postgresql.conf.erb index 860089b..8741507 100644 --- a/modules/role/templates/backup/postgresql.conf.erb +++ b/modules/role/templates/backup/postgresql.conf.erb | |||
@@ -1,5 +1,12 @@ | |||
1 | <%- if !@pg_listen_port.nil? -%> | ||
2 | listen_addresses= '*' | ||
3 | port = <%= @pg_listen_port %> | ||
4 | ssl = on | ||
5 | ssl_key_file = '<%= @ssl_key %>' | ||
6 | ssl_cert_file = '<%= @ssl_cert %>' | ||
7 | <%- else -%> | ||
1 | listen_addresses= '' | 8 | listen_addresses= '' |
9 | <%- end %> | ||
2 | unix_socket_directories = '<%= @pg_path %>' | 10 | unix_socket_directories = '<%= @pg_path %>' |
3 | data_directory = '<%= @pg_path %>' | 11 | data_directory = '<%= @pg_path %>' |
4 | wal_level = logical | 12 | wal_level = logical |
5 | |||
diff --git a/modules/role/templates/etherpad/settings.json.erb b/modules/role/templates/etherpad/settings.json.erb new file mode 100644 index 0000000..dfd69c1 --- /dev/null +++ b/modules/role/templates/etherpad/settings.json.erb | |||
@@ -0,0 +1,93 @@ | |||
1 | { | ||
2 | "title": "Etherpad", | ||
3 | "favicon": "favicon.ico", | ||
4 | |||
5 | "ip": "<%= @web_listen %>", | ||
6 | "port" : <%= @web_port %>, | ||
7 | "showSettingsInAdminPage" : false, | ||
8 | "dbType" : "postgres", | ||
9 | "dbSettings" : { | ||
10 | "user" : "<%= @pg_user %>", | ||
11 | "host" : "/run/postgresql", | ||
12 | "password": "", | ||
13 | "database": "<%= @pg_db %>", | ||
14 | "charset" : "utf8mb4" | ||
15 | }, | ||
16 | |||
17 | "defaultPadText" : "Welcome to Etherpad!\n\nThis pad text is synchronized as you type, so that everyone viewing this page sees the same text. This allows you to collaborate seamlessly on documents!\n\nGet involved with Etherpad at http:\/\/etherpad.org\n", | ||
18 | "padOptions": { | ||
19 | "noColors": false, | ||
20 | "showControls": true, | ||
21 | "showChat": true, | ||
22 | "showLineNumbers": true, | ||
23 | "useMonospaceFont": false, | ||
24 | "userName": false, | ||
25 | "userColor": false, | ||
26 | "rtl": false, | ||
27 | "alwaysShowChat": false, | ||
28 | "chatAndUsers": false, | ||
29 | "lang": "en-gb" | ||
30 | }, | ||
31 | |||
32 | "suppressErrorsInPadText" : false, | ||
33 | "requireSession" : false, | ||
34 | "editOnly" : false, | ||
35 | "sessionNoPassword" : false, | ||
36 | "minify" : true, | ||
37 | "maxAge" : 21600, | ||
38 | "abiword" : "/usr/bin/abiword", | ||
39 | "soffice" : "/usr/bin/soffice", | ||
40 | "tidyHtml" : "/usr/bin/tidy", | ||
41 | "allowUnknownFileEnds" : true, | ||
42 | "requireAuthentication" : false, | ||
43 | "requireAuthorization" : false, | ||
44 | "trustProxy" : false, | ||
45 | "disableIPlogging" : false, | ||
46 | "automaticReconnectionTimeout" : 0, | ||
47 | "scrollWhenFocusLineIsOutOfViewport": { | ||
48 | "percentage": { | ||
49 | "editionAboveViewport": 0, | ||
50 | "editionBelowViewport": 0 | ||
51 | }, | ||
52 | "duration": 0, | ||
53 | "scrollWhenCaretIsInTheLastLineOfViewport": false, | ||
54 | "percentageToScrollWhenUserPressesArrowUp": 0 | ||
55 | }, | ||
56 | "users": { | ||
57 | "ldapauth": { | ||
58 | "url": "ldaps://<%= @ldap_server %>", | ||
59 | "accountBase": "<%= @ldap_base %>", | ||
60 | "accountPattern": "<%= @ldap_account_pattern %>", | ||
61 | "displayNameAttribute": "cn", | ||
62 | "searchDN": "<%= @ldap_dn %>", | ||
63 | "searchPWD": "<%= @ldap_password %>", | ||
64 | "groupSearchBase": "<%= @ldap_base %>", | ||
65 | "groupAttribute": "member", | ||
66 | "groupAttributeIsDN": true, | ||
67 | "searchScope": "sub", | ||
68 | "groupSearch": "<%= @ldap_group_pattern %>", | ||
69 | "anonymousReadonly": false | ||
70 | } | ||
71 | }, | ||
72 | "socketTransportProtocols" : ["xhr-polling", "jsonp-polling", "htmlfile"], | ||
73 | "loadTest": false, | ||
74 | "indentationOnNewLine": false, | ||
75 | "toolbar": { | ||
76 | "left": [ | ||
77 | ["bold", "italic", "underline", "strikethrough"], | ||
78 | ["orderedlist", "unorderedlist", "indent", "outdent"], | ||
79 | ["undo", "redo"], | ||
80 | ["clearauthorship"] | ||
81 | ], | ||
82 | "right": [ | ||
83 | ["importexport", "timeslider", "savedrevision"], | ||
84 | ["settings", "embed"], | ||
85 | ["showusers"] | ||
86 | ], | ||
87 | "timeslider": [ | ||
88 | ["timeslider_export", "timeslider_returnToPad"] | ||
89 | ] | ||
90 | }, | ||
91 | "loglevel": "INFO", | ||
92 | "logconfig" : { "appenders": [ { "type": "console" } ] } | ||
93 | } | ||
diff --git a/python/reboot_ovh_cloud_instance.py b/python/reboot_ovh_cloud_instance.py index bd70e0b..1e88c89 100644 --- a/python/reboot_ovh_cloud_instance.py +++ b/python/reboot_ovh_cloud_instance.py | |||
@@ -25,6 +25,9 @@ if netboot_mode is not None: | |||
25 | result = client.post("/cloud/project/{}/instance/{}/rescueMode".format(project, | 25 | result = client.post("/cloud/project/{}/instance/{}/rescueMode".format(project, |
26 | instance["id"]), imageId=instance["imageId"], rescue=(netboot_mode == "rescue")) | 26 | instance["id"]), imageId=instance["imageId"], rescue=(netboot_mode == "rescue")) |
27 | print(result) | 27 | print(result) |
28 | else: | ||
29 | result = client.post("/cloud/project/{}/instance/{}/reboot".format(project, instance["id"]), type="soft") | ||
30 | print(result) | ||
28 | 31 | ||
29 | # reboot normal: | 32 | # reboot normal: |
30 | #result = client.post("/cloud/project/{}/instance/{}/reboot".format(project, instance["id"]), type="soft") | 33 | #result = client.post("/cloud/project/{}/instance/{}/reboot".format(project, instance["id"]), type="soft") |