From 0a21fb6c2c52ca5cc2dfdfc41ca0a51c0d81296c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Tue, 13 Mar 2018 13:23:17 +0100 Subject: Start to cleanup the files --- modules/base_installation/manifests/puppet.pp | 2 +- modules/base_installation/manifests/services.pp | 2 +- modules/base_installation/manifests/users.pp | 20 +- modules/profile/manifests/apache.pp | 15 +- modules/role/manifests/cryptoportfolio.pp | 273 ++++++++++----------- .../templates/cryptoportfolio/api_conf.toml.erb | 12 +- .../templates/cryptoportfolio/bot_config.ini.erb | 10 +- .../cryptoportfolio-app.service.erb | 4 +- .../templates/cryptoportfolio/static_conf.env.erb | 6 +- 9 files changed, 170 insertions(+), 174 deletions(-) (limited to 'modules') diff --git a/modules/base_installation/manifests/puppet.pp b/modules/base_installation/manifests/puppet.pp index b3ce492..6f7732d 100644 --- a/modules/base_installation/manifests/puppet.pp +++ b/modules/base_installation/manifests/puppet.pp @@ -67,7 +67,7 @@ class base_installation::puppet ( require => File[$base_installation::puppet_conf_path], } - $ips = lookup("ips") |$key| { {} } + $ips = lookup("ips", { 'default_value' => undef }) file { "$base_installation::puppet_conf_path/host_ldap.info": content => template("base_installation/puppet/host_ldap.info.erb"), require => File[$base_installation::puppet_conf_path], diff --git a/modules/base_installation/manifests/services.pp b/modules/base_installation/manifests/services.pp index c641f4b..d7b4d61 100644 --- a/modules/base_installation/manifests/services.pp +++ b/modules/base_installation/manifests/services.pp @@ -38,7 +38,7 @@ class base_installation::services inherits base_installation { group => "root" } - $ip6 = lookup("ips.v6") |$key| { {} } + $ip6 = lookup("ips.v6", { 'default_value' => undef }) file { '/etc/systemd/network/en-dhcp.network': ensure => "present", path => "/etc/systemd/network/en-dhcp.network", diff --git a/modules/base_installation/manifests/users.pp b/modules/base_installation/manifests/users.pp index 766c0f0..f893c51 100644 --- a/modules/base_installation/manifests/users.pp +++ b/modules/base_installation/manifests/users.pp @@ -26,22 +26,26 @@ class base_installation::users ( ensure => "present", groups => $user[groups], managehome => true, + system => !!$user[system], home => "/home/${user[username]}", - notify => Exec["remove_password"], + notify => Exec["remove_password:${user[username]}:${user[userid]}"], purge_ssh_keys => true } - exec { "remove_password": + exec { "remove_password:${user[username]}:${user[userid]}": command => "/usr/bin/chage -d 0 ${user[username]} && /usr/bin/passwd -d ${user[username]}", + onlyif => "/usr/bin/test -z '${user[password]}'", refreshonly => true } - $user[keys].each |$key| { - ssh_authorized_key { "${user[username]}@${key[host]}": - name => "${user[username]}@${key[host]}", - user => $user[username], - type => $key[key_type], - key => $key[key], + if has_key($user, "keys") { + $user[keys].each |$key| { + ssh_authorized_key { "${user[username]}@${key[host]}": + name => "${user[username]}@${key[host]}", + user => $user[username], + type => $key[key_type], + key => $key[key], + } } } } diff --git a/modules/profile/manifests/apache.pp b/modules/profile/manifests/apache.pp index 8db58da..382633b 100644 --- a/modules/profile/manifests/apache.pp +++ b/modules/profile/manifests/apache.pp @@ -67,13 +67,12 @@ class profile::apache { install_method => "package", package_name => "certbot", package_command => "certbot", - # FIXME - email => 'sites+letsencrypt@mail.immae.eu', + email => lookup('letsencrypt::email'), } - $real_hostname = lookup("base_installation::real_hostname") |$key| { {} } + $real_hostname = lookup("base_installation::real_hostname", { "default_value" => undef }) unless empty($real_hostname) { - if (lookup("ssl::try_letsencrypt_for_real_hostname") |$key| { true }) { + if (lookup("letsencrypt::try_for_real_hostname", { "default_value" => true })) { letsencrypt::certonly { $real_hostname: before => Apache::Vhost["default_ssl"]; default: * => $::profile::apache::letsencrypt_certonly_default; @@ -110,6 +109,14 @@ class profile::apache { } } + lookup("letsencrypt::hosts", { "default_value" => [] }).each |$host| { + if ($host != $real_hostname) { # Done above already + letsencrypt::certonly { $host: ; + default: * => $letsencrypt_certonly_default; + } + } + } + apache::vhost { "redirect_no_ssl": port => '80', error_log => false, diff --git a/modules/role/manifests/cryptoportfolio.pp b/modules/role/manifests/cryptoportfolio.pp index bec247e..8b4a63b 100644 --- a/modules/role/manifests/cryptoportfolio.pp +++ b/modules/role/manifests/cryptoportfolio.pp @@ -1,4 +1,22 @@ -class role::cryptoportfolio { +class role::cryptoportfolio ( + String $user, + String $group, + String $home, + Optional[String] $env = "prod", + Optional[String] $webhook_url = undef, + String $pg_user, + String $pg_user_replication, + String $pg_db, + Optional[String] $pg_hostname = "localhost", + Optional[String] $pg_port = "5432", + Optional[String] $web_host = undef, + Optional[String] $web_port = "", + Optional[Boolean] $web_ssl = true, + Optional[String] $front_version = undef, + Optional[String] $front_sha256 = undef, + Optional[String] $bot_version = undef, + Optional[String] $bot_sha256 = undef, +) { ensure_resource('exec', 'systemctl daemon-reload', { command => '/usr/bin/systemctl daemon-reload', refreshonly => true @@ -11,37 +29,23 @@ class role::cryptoportfolio { include "profile::apache" include "profile::xmr_stak" - $password_seed = lookup("base_installation::puppet_pass_seed") |$key| { {} } - - $cf_pg_user = "cryptoportfolio" - $cf_pg_user_replication = "cryptoportfolio_replication" - $cf_pg_db = "cryptoportfolio" - $cf_pg_password = generate_password(24, $password_seed, "postgres_cryptoportfolio") - $cf_pg_replication_password = generate_password(24, $password_seed, "postgres_cryptoportfolio_replication") - $cf_pg_hostname = "localhost" - $cf_pg_port = "5432" - $cf_pg_host = "${cf_pg_hostname}:${cf_pg_port}" - - $cf_user = "cryptoportfolio" - $cf_group = "cryptoportfolio" - $cf_home = "/opt/cryptoportfolio" - $cf_env = "prod" - $cf_front_app_host = lookup("base_installation::system_hostname") |$key| { "example.com" } - $cf_front_app_port = "" - $cf_front_app_ssl = "true" - $cf_front_app = "${cf_home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio/Front" + $password_seed = lookup("base_installation::puppet_pass_seed") + + $pg_password = generate_password(24, $password_seed, "postgres_cryptoportfolio") + $pg_replication_password = generate_password(24, $password_seed, "postgres_cryptoportfolio_replication") + $pg_host = "${pg_hostname}:${pg_port}" + + $cf_front_app = "${home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio/Front" $cf_front_app_api_workdir = "${cf_front_app}/cmd/app" $cf_front_app_api_bin = "${cf_front_app_api_workdir}/cryptoportfolio-app" - $cf_front_app_api_conf = "${cf_home}/conf.toml" + $cf_front_app_api_conf = "${home}/conf.toml" $cf_front_app_api_secret = generate_password(24, $password_seed, "cryptoportfolio_api_secret") $cf_front_app_static_conf = "${cf_front_app}/cmd/web/env/prod.env" - $cf_bot_app = "${cf_home}/bot" - $cf_bot_app_conf = "${cf_home}/bot_config.ini" - $cf_bot_app_reports = "${cf_home}/bot_reports" - - $cf_webhook_url = lookup("cryptoportfolio::slack_webhook") |$key| { "" } + $cf_bot_app = "${home}/bot" + $cf_bot_app_conf = "${home}/bot_config.ini" + $cf_bot_app_reports = "${home}/bot_reports" file { "/var/lib/postgres/data/certs": ensure => directory, @@ -52,21 +56,21 @@ class role::cryptoportfolio { } file { "/var/lib/postgres/data/certs/cert.pem": - source => "file:///etc/letsencrypt/live/$cf_front_app_host/cert.pem", + source => "file:///etc/letsencrypt/live/$web_host/cert.pem", mode => "0600", links => "follow", owner => $::profile::postgresql::pg_user, group => $::profile::postgresql::pg_user, - require => [Letsencrypt::Certonly[$cf_front_app_host], File["/var/lib/postgres/data/certs"]] + require => [Letsencrypt::Certonly[$web_host], File["/var/lib/postgres/data/certs"]] } file { "/var/lib/postgres/data/certs/privkey.pem": - source => "file:///etc/letsencrypt/live/$cf_front_app_host/privkey.pem", + source => "file:///etc/letsencrypt/live/$web_host/privkey.pem", mode => "0600", links => "follow", owner => $::profile::postgresql::pg_user, group => $::profile::postgresql::pg_user, - require => [Letsencrypt::Certonly[$cf_front_app_host], File["/var/lib/postgres/data/certs"]] + require => [Letsencrypt::Certonly[$web_host], File["/var/lib/postgres/data/certs"]] } postgresql::server::config_entry { "wal_level": @@ -75,52 +79,52 @@ class role::cryptoportfolio { postgresql::server::config_entry { "ssl": value => "on", - require => Letsencrypt::Certonly[$cf_front_app_host], + require => Letsencrypt::Certonly[$web_host], } postgresql::server::config_entry { "ssl_cert_file": value => "/var/lib/postgres/data/certs/cert.pem", - require => Letsencrypt::Certonly[$cf_front_app_host], + require => Letsencrypt::Certonly[$web_host], } postgresql::server::config_entry { "ssl_key_file": value => "/var/lib/postgres/data/certs/privkey.pem", - require => Letsencrypt::Certonly[$cf_front_app_host], + require => Letsencrypt::Certonly[$web_host], } - postgresql::server::db { $cf_pg_db: - user => $cf_pg_user, - password => postgresql_password($cf_pg_user, $cf_pg_password), + postgresql::server::db { $pg_db: + user => $pg_user, + password => postgresql_password($pg_user, $pg_password), } -> - postgresql_psql { "CREATE PUBLICATION ${cf_pg_db}_publication FOR ALL TABLES": - db => $cf_pg_db, - unless => "SELECT 1 FROM pg_catalog.pg_publication WHERE pubname = '${cf_pg_db}_publication'", + postgresql_psql { "CREATE PUBLICATION ${pg_db}_publication FOR ALL TABLES": + db => $pg_db, + unless => "SELECT 1 FROM pg_catalog.pg_publication WHERE pubname = '${pg_db}_publication'", } -> - postgresql::server::role { $cf_pg_user_replication: - db => $cf_pg_db, + postgresql::server::role { $pg_user_replication: + db => $pg_db, replication => true, - password_hash => postgresql_password($cf_pg_user_replication, $cf_pg_replication_password), + password_hash => postgresql_password($pg_user_replication, $pg_replication_password), } -> - postgresql::server::database_grant { $cf_pg_user_replication: - db => $cf_pg_db, + postgresql::server::database_grant { $pg_user_replication: + db => $pg_db, privilege => "CONNECT", - role => $cf_pg_user_replication, + role => $pg_user_replication, } -> - postgresql::server::grant { "all tables in schema:public:$cf_pg_user_replication": - db => $cf_pg_db, - role => $cf_pg_user_replication, + postgresql::server::grant { "all tables in schema:public:$pg_user_replication": + db => $pg_db, + role => $pg_user_replication, privilege => "SELECT", object_type => "ALL TABLES IN SCHEMA", object_name => "public", } -> - postgresql::server::grant { "all sequences in schema:public:$cf_pg_user_replication": - db => $cf_pg_db, - role => $cf_pg_user_replication, + postgresql::server::grant { "all sequences in schema:public:$pg_user_replication": + db => $pg_db, + role => $pg_user_replication, privilege => "SELECT", object_type => "ALL SEQUENCES IN SCHEMA", object_name => "public", @@ -128,16 +132,16 @@ class role::cryptoportfolio { postgresql::server::pg_hba_rule { 'allow localhost TCP access to cryptoportfolio user': type => 'host', - database => $cf_pg_db, - user => $cf_pg_user, + database => $pg_db, + user => $pg_user, address => '127.0.0.1/32', auth_method => 'md5', order => "b0", } postgresql::server::pg_hba_rule { 'allow localhost ip6 TCP access to cryptoportfolio user': type => 'host', - database => $cf_pg_db, - user => $cf_pg_user, + database => $pg_db, + user => $pg_user, address => '::1/128', auth_method => 'md5', order => "b0", @@ -145,83 +149,64 @@ class role::cryptoportfolio { postgresql::server::pg_hba_rule { 'allow TCP access to replication user from immae.eu': type => 'hostssl', - database => $cf_pg_db, - user => $cf_pg_user_replication, + database => $pg_db, + user => $pg_user_replication, address => 'immae.eu', auth_method => 'md5', order => "b0", } - letsencrypt::certonly { $cf_front_app_host: ; - default: * => $::profile::apache::letsencrypt_certonly_default; - } - class { 'apache::mod::headers': } - apache::vhost { $cf_front_app_host: + apache::vhost { $web_host: port => '443', docroot => false, manage_docroot => false, proxy_dest => "http://localhost:8000", request_headers => 'set X-Forwarded-Proto "https"', ssl => true, - ssl_cert => "/etc/letsencrypt/live/$cf_front_app_host/cert.pem", - ssl_key => "/etc/letsencrypt/live/$cf_front_app_host/privkey.pem", - ssl_chain => "/etc/letsencrypt/live/$cf_front_app_host/chain.pem", - require => Letsencrypt::Certonly[$cf_front_app_host], + ssl_cert => "/etc/letsencrypt/live/$web_host/cert.pem", + ssl_key => "/etc/letsencrypt/live/$web_host/privkey.pem", + ssl_chain => "/etc/letsencrypt/live/$web_host/chain.pem", + require => Letsencrypt::Certonly[$web_host], proxy_preserve_host => true; default: * => $::profile::apache::apache_vhost_default; } - user { $cf_user: - name => $cf_user, - ensure => "present", - managehome => true, - home => $cf_home, - system => true, - password => '!!', - } - file { "/usr/local/bin/slack-notify": mode => "0755", source => "puppet:///modules/role/cryptoportfolio/slack-notify.py", } - $front_version = lookup("cryptoportfolio::front_version") |$key| { {} } - $front_sha256 = lookup("cryptoportfolio::front_sha256") |$key| { {} } - - $bot_version = lookup("cryptoportfolio::bot_version") |$key| { {} } - $bot_sha256 = lookup("cryptoportfolio::bot_sha256") |$key| { {} } - unless empty($bot_version) { ensure_packages(["python", "python-pip"]) file { $cf_bot_app: ensure => "directory", mode => "0700", - owner => $cf_user, - group => $cf_group, - require => User[$cf_user], + owner => $user, + group => $group, + require => User["$user:"], } - archive { "${cf_home}/trader_${bot_version}.tar.gz": - path => "${cf_home}/trader_${bot_version}.tar.gz", + archive { "${home}/trader_${bot_version}.tar.gz": + path => "${home}/trader_${bot_version}.tar.gz", source => "https://git.immae.eu/releases/cryptoportfolio/trader/trader_${bot_version}.tar.gz", checksum_type => "sha256", checksum => $bot_sha256, cleanup => false, extract => true, - user => $cf_user, + user => $user, username => $facts["ec2_metadata"]["hostname"], password => generate_password(24, $password_seed, "ldap"), extract_path => $cf_bot_app, - require => [User[$cf_user], File[$cf_bot_app]], + require => [User["$user:"], File[$cf_bot_app]], } ~> exec { "py-cryptoportfolio-dependencies": cwd => $cf_bot_app, - user => $cf_user, - environment => ["HOME=${cf_home}"], + user => $user, + environment => ["HOME=${home}"], command => "/usr/bin/make install", - require => User[$cf_user], + require => User["$user:"], refreshonly => true, before => [ File[$cf_bot_app_conf], @@ -231,53 +216,53 @@ class role::cryptoportfolio { } file { $cf_bot_app_conf: - owner => $cf_user, - group => $cf_group, + owner => $user, + group => $group, mode => "0600", content => template("role/cryptoportfolio/bot_config.ini.erb"), require => [ - User[$cf_user], - Archive["${cf_home}/trader_${bot_version}.tar.gz"], + User["$user:"], + Archive["${home}/trader_${bot_version}.tar.gz"], ], } cron { "py-cryptoportfolio-before": ensure => present, command => "cd $cf_bot_app ; python main.py --config $cf_bot_app_conf --before", - user => "cryptoportfolio", + user => $user, weekday => 7, # Sunday hour => 22, minute => 30, - environment => ["HOME=${cf_home}","PATH=/usr/bin/"], + environment => ["HOME=${home}","PATH=/usr/bin/"], require => [ File[$cf_bot_app_conf], - Archive["${cf_home}/trader_${bot_version}.tar.gz"] + Archive["${home}/trader_${bot_version}.tar.gz"] ], } cron { "py-cryptoportfolio-after": ensure => present, command => "cd $cf_bot_app ; python main.py --config $cf_bot_app_conf --after", - user => "cryptoportfolio", + user => $user, weekday => 1, # Monday hour => 1, minute => 0, - environment => ["HOME=${cf_home}","PATH=/usr/bin/"], + environment => ["HOME=${home}","PATH=/usr/bin/"], require => [ File[$cf_bot_app_conf], - Archive["${cf_home}/trader_${bot_version}.tar.gz"] + Archive["${home}/trader_${bot_version}.tar.gz"] ], } - unless empty($cf_webhook_url) { + unless empty($webhook_url) { exec { "bot-slack-notify": refreshonly => true, environment => [ "P_PROJECT=Trader", - "P_WEBHOOK=${cf_webhook_url}", + "P_WEBHOOK=${webhook_url}", "P_VERSION=${bot_version}", - "P_HOST=${cf_front_app_host}", - "P_HTTPS=${cf_front_app_ssl}", + "P_HOST=${web_host}", + "P_HTTPS=${web_ssl}", ], command => "/usr/local/bin/slack-notify", require => File["/usr/local/bin/slack-notify"], @@ -291,22 +276,22 @@ class role::cryptoportfolio { ensure_packages(["go", "npm", "nodejs", "yarn"]) file { [ - "${cf_home}/go/", - "${cf_home}/go/src", - "${cf_home}/go/src/immae.eu", - "${cf_home}/go/src/immae.eu/Immae", - "${cf_home}/go/src/immae.eu/Immae/Projets", - "${cf_home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies", - "${cf_home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio", + "${home}/go/", + "${home}/go/src", + "${home}/go/src/immae.eu", + "${home}/go/src/immae.eu/Immae", + "${home}/go/src/immae.eu/Immae/Projets", + "${home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies", + "${home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio", $cf_front_app]: ensure => "directory", mode => "0700", - owner => $cf_user, - group => $cf_group, - require => User[$cf_user], + owner => $user, + group => $group, + require => User["$user:"], } - file { "${cf_home}/front": + file { "${home}/front": ensure => "link", target => $cf_front_app, before => File[$cf_front_app], @@ -326,28 +311,28 @@ class role::cryptoportfolio { subscribe => [Exec["go-cryptoportfolio-app"], Exec["web-cryptoportfolio-build"]], require => [ File["/etc/systemd/system/cryptoportfolio-app.service"], - Postgresql::Server::Db[$cf_pg_db] + Postgresql::Server::Db[$pg_db] ], } ~> - exec { "dump $cf_pg_db structure": + exec { "dump $pg_db structure": refreshonly => true, user => $::profile::postgresql::pg_user, group => $::profile::postgresql::pg_user, - command => "/usr/bin/pg_dump --schema-only --clean --no-publications $cf_pg_db > /var/lib/postgres/${cf_pg_db}.schema", + command => "/usr/bin/pg_dump --schema-only --clean --no-publications $pg_db > /var/lib/postgres/${pg_db}.schema", } - archive { "${cf_home}/front_${front_version}.tar.gz": - path => "${cf_home}/front_${front_version}.tar.gz", + archive { "${home}/front_${front_version}.tar.gz": + path => "${home}/front_${front_version}.tar.gz", source => "https://git.immae.eu/releases/cryptoportfolio/front/front_${front_version}.tar.gz", checksum_type => "sha256", checksum => $front_sha256, cleanup => false, extract => true, - user => $cf_user, + user => $user, username => $facts["ec2_metadata"]["hostname"], password => generate_password(24, $password_seed, "ldap"), extract_path => $cf_front_app, - require => [User[$cf_user], File[$cf_front_app]], + require => [User["$user:"], File[$cf_front_app]], notify => [ Exec["web-cryptoportfolio-dependencies"], Exec["go-get-dep"], @@ -356,39 +341,39 @@ class role::cryptoportfolio { # Api file { $cf_front_app_api_conf: - owner => $cf_user, - group => $cf_group, + owner => $user, + group => $group, mode => "0600", content => template("role/cryptoportfolio/api_conf.toml.erb"), before => Exec["go-cryptoportfolio-app"], } exec { "go-get-dep": - user => $cf_user, - environment => ["HOME=${cf_home}"], - creates => "${cf_home}/go/bin/dep", + user => $user, + environment => ["HOME=${home}"], + creates => "${home}/go/bin/dep", command => "/usr/bin/go get -u github.com/golang/dep/cmd/dep", refreshonly => true, } ~> exec { "go-cryptoportfolio-dependencies": cwd => $cf_front_app, - user => $cf_user, - environment => ["HOME=${cf_home}"], - command => "${cf_home}/go/bin/dep ensure", + user => $user, + environment => ["HOME=${home}"], + command => "${home}/go/bin/dep ensure", refreshonly => true, } ~> exec { "go-cryptoportfolio-app": cwd => $cf_front_app_api_workdir, - user => $cf_user, - environment => ["HOME=${cf_home}"], + user => $user, + environment => ["HOME=${home}"], command => "/usr/bin/make build", refreshonly => true, } # Static pages file { $cf_front_app_static_conf: - owner => $cf_user, - group => $cf_group, + owner => $user, + group => $group, mode => "0600", content => template("role/cryptoportfolio/static_conf.env.erb"), before => Exec["web-cryptoportfolio-build"], @@ -396,30 +381,30 @@ class role::cryptoportfolio { exec { "web-cryptoportfolio-dependencies": cwd => "${cf_front_app}/cmd/web", - user => $cf_user, - environment => ["HOME=${cf_home}"], + user => $user, + environment => ["HOME=${home}"], command => "/usr/bin/make install", refreshonly => true, require => [Package["npm"], Package["nodejs"], Package["yarn"]] } ~> exec { "web-cryptoportfolio-build": cwd => "${cf_front_app}/cmd/web", - user => $cf_user, - environment => ["HOME=${cf_home}"], + user => $user, + environment => ["HOME=${home}"], path => ["${cf_front_app}/cmd/web/node_modules/.bin/", "/usr/bin"], - command => "/usr/bin/make static ENV=${cf_env}", + command => "/usr/bin/make static ENV=${env}", refreshonly => true, } - unless empty($cf_webhook_url) { + unless empty($webhook_url) { exec { "front-slack-notify": refreshonly => true, environment => [ "P_PROJECT=Front", - "P_WEBHOOK=${cf_webhook_url}", + "P_WEBHOOK=${webhook_url}", "P_VERSION=${front_version}", - "P_HOST=${cf_front_app_host}", - "P_HTTPS=${cf_front_app_ssl}", + "P_HOST=${web_host}", + "P_HTTPS=${web_ssl}", ], command => "/usr/local/bin/slack-notify", require => File["/usr/local/bin/slack-notify"], diff --git a/modules/role/templates/cryptoportfolio/api_conf.toml.erb b/modules/role/templates/cryptoportfolio/api_conf.toml.erb index 13550c9..7a4b66d 100644 --- a/modules/role/templates/cryptoportfolio/api_conf.toml.erb +++ b/modules/role/templates/cryptoportfolio/api_conf.toml.erb @@ -1,15 +1,15 @@ log_level="info" -mode="<%= @cf_env %>" +mode="<%= @env %>" log_out="stdout" [db] -user="<%= @cf_pg_user %>" -password="<%= @cf_pg_password %>" -database="<%= @cf_pg_db %>" -address="<%= @cf_pg_host %>" +user="<%= @pg_user %>" +password="<%= @pg_password %>" +database="<%= @pg_db %>" +address="<%= @pg_host %>" [api] -domain="<%= @cf_front_app_host %>" +domain="<%= @web_host %>" jwt_secret="<%= @cf_front_app_api_secret %>" [app] diff --git a/modules/role/templates/cryptoportfolio/bot_config.ini.erb b/modules/role/templates/cryptoportfolio/bot_config.ini.erb index 30298eb..b0211a6 100644 --- a/modules/role/templates/cryptoportfolio/bot_config.ini.erb +++ b/modules/role/templates/cryptoportfolio/bot_config.ini.erb @@ -1,9 +1,9 @@ [postgresql] -host = <%= @cf_pg_hostname %> -port = <%= @cf_pg_port %> -user = <%= @cf_pg_user %> -password = <%= @cf_pg_password %> -database = <%= @cf_pg_db %> +host = <%= @pg_hostname %> +port = <%= @pg_port %> +user = <%= @pg_user %> +password = <%= @pg_password %> +database = <%= @pg_db %> [app] report_path = <%= @cf_bot_app_reports %> diff --git a/modules/role/templates/cryptoportfolio/cryptoportfolio-app.service.erb b/modules/role/templates/cryptoportfolio/cryptoportfolio-app.service.erb index a521c0e..ed2b908 100644 --- a/modules/role/templates/cryptoportfolio/cryptoportfolio-app.service.erb +++ b/modules/role/templates/cryptoportfolio/cryptoportfolio-app.service.erb @@ -5,8 +5,8 @@ Description=Cryptoportfolio app Type=simple WorkingDirectory=<%= @cf_front_app_api_workdir %> -User=<%= @cf_user %> -Group=<%= @cf_group %> +User=<%= @user %> +Group=<%= @group %> UMask=007 ExecStart=<%= @cf_front_app_api_bin %> -conf <%= @cf_front_app_api_conf %> diff --git a/modules/role/templates/cryptoportfolio/static_conf.env.erb b/modules/role/templates/cryptoportfolio/static_conf.env.erb index db9759d..314ee14 100644 --- a/modules/role/templates/cryptoportfolio/static_conf.env.erb +++ b/modules/role/templates/cryptoportfolio/static_conf.env.erb @@ -1,4 +1,4 @@ -API_HOST="<%= @cf_front_app_host %>" -API_PORT="<%= @cf_front_app_port %>" -API_HTTPS="<%= @cf_front_app_ssl %>" +API_HOST="<%= @web_host %>" +API_PORT="<%= @web_port %>" +API_HTTPS="<%= @web_ssl %>" -- cgit v1.2.3 From a045b9dc12f71c286d4afcb196705f430b6731f5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Tue, 13 Mar 2018 14:31:07 +0100 Subject: Cleanup xmr_stak profile --- modules/profile/manifests/postgresql.pp | 2 +- modules/profile/manifests/xmr_stak.pp | 11 ++++++----- modules/role/manifests/cryptoportfolio.pp | 4 ++-- 3 files changed, 9 insertions(+), 8 deletions(-) (limited to 'modules') diff --git a/modules/profile/manifests/postgresql.pp b/modules/profile/manifests/postgresql.pp index 1024c66..9d875c9 100644 --- a/modules/profile/manifests/postgresql.pp +++ b/modules/profile/manifests/postgresql.pp @@ -1,5 +1,5 @@ class profile::postgresql { - $password_seed = lookup("base_installation::puppet_pass_seed") |$key| { {} } + $password_seed = lookup("base_installation::puppet_pass_seed") class { '::postgresql::globals': encoding => 'UTF-8', diff --git a/modules/profile/manifests/xmr_stak.pp b/modules/profile/manifests/xmr_stak.pp index e5582eb..c8bbcdd 100644 --- a/modules/profile/manifests/xmr_stak.pp +++ b/modules/profile/manifests/xmr_stak.pp @@ -1,4 +1,8 @@ -class profile::xmr_stak { +class profile::xmr_stak ( + String $mining_pool, + String $wallet, + Optional[String] $password = "x", +) { ensure_resource('exec', 'systemctl daemon-reload', { command => '/usr/bin/systemctl daemon-reload', refreshonly => true @@ -26,10 +30,7 @@ class profile::xmr_stak { notify => Exec["systemctl daemon-reload"] } - $mining_pool = lookup("xmr_stak::mining_pool") |$key| { {} } - $wallet = lookup("xmr_stak::wallet") |$key| { {} } - $password = lookup("xmr_stak::password") |$key| { "x" } - $instance = regsubst($facts["ec2_metadata"]["hostname"], '\.', "_", "G") + $instance = regsubst(lookup("base_installation::ldap_cn"), '\.', "_", "G") file { "/var/lib/xmr_stak/xmr-stak.conf": mode => "0644", diff --git a/modules/role/manifests/cryptoportfolio.pp b/modules/role/manifests/cryptoportfolio.pp index 8b4a63b..5b64787 100644 --- a/modules/role/manifests/cryptoportfolio.pp +++ b/modules/role/manifests/cryptoportfolio.pp @@ -196,7 +196,7 @@ class role::cryptoportfolio ( cleanup => false, extract => true, user => $user, - username => $facts["ec2_metadata"]["hostname"], + username => lookup("base_installation::ldap_cn"), password => generate_password(24, $password_seed, "ldap"), extract_path => $cf_bot_app, require => [User["$user:"], File[$cf_bot_app]], @@ -329,7 +329,7 @@ class role::cryptoportfolio ( cleanup => false, extract => true, user => $user, - username => $facts["ec2_metadata"]["hostname"], + username => lookup("base_installation::ldap_cn"), password => generate_password(24, $password_seed, "ldap"), extract_path => $cf_front_app, require => [User["$user:"], File[$cf_front_app]], -- cgit v1.2.3 From a386ce060c4c49d772bd4d03d6586012a266317e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Tue, 13 Mar 2018 15:00:26 +0100 Subject: Reorder pg_hba rules --- modules/profile/manifests/postgresql.pp | 12 ++++++------ modules/role/manifests/cryptoportfolio.pp | 6 +++--- 2 files changed, 9 insertions(+), 9 deletions(-) (limited to 'modules') diff --git a/modules/profile/manifests/postgresql.pp b/modules/profile/manifests/postgresql.pp index 9d875c9..2cd1bcc 100644 --- a/modules/profile/manifests/postgresql.pp +++ b/modules/profile/manifests/postgresql.pp @@ -32,7 +32,7 @@ class profile::postgresql { database => 'all', user => $pg_user, auth_method => 'ident', - order => "a1", + order => "00-01", } postgresql::server::pg_hba_rule { 'localhost access as postgres user': description => 'Allow localhost access to postgres user', @@ -41,7 +41,7 @@ class profile::postgresql { user => $pg_user, address => "127.0.0.1/32", auth_method => 'md5', - order => "a2", + order => "00-02", } postgresql::server::pg_hba_rule { 'localhost ip6 access as postgres user': description => 'Allow localhost access to postgres user', @@ -50,7 +50,7 @@ class profile::postgresql { user => $pg_user, address => "::1/128", auth_method => 'md5', - order => "a3", + order => "00-03", } postgresql::server::pg_hba_rule { 'deny access to postgresql user': description => 'Deny remote access to postgres user', @@ -59,7 +59,7 @@ class profile::postgresql { user => $pg_user, address => "0.0.0.0/0", auth_method => 'reject', - order => "a4", + order => "00-04", } postgresql::server::pg_hba_rule { 'local access': @@ -68,7 +68,7 @@ class profile::postgresql { database => 'all', user => 'all', auth_method => 'md5', - order => "b1", + order => "10-01", } postgresql::server::pg_hba_rule { 'local access with same name': @@ -77,7 +77,7 @@ class profile::postgresql { database => 'all', user => 'all', auth_method => 'ident', - order => "b2", + order => "10-02", } } diff --git a/modules/role/manifests/cryptoportfolio.pp b/modules/role/manifests/cryptoportfolio.pp index 5b64787..503620b 100644 --- a/modules/role/manifests/cryptoportfolio.pp +++ b/modules/role/manifests/cryptoportfolio.pp @@ -136,7 +136,7 @@ class role::cryptoportfolio ( user => $pg_user, address => '127.0.0.1/32', auth_method => 'md5', - order => "b0", + order => "05-01", } postgresql::server::pg_hba_rule { 'allow localhost ip6 TCP access to cryptoportfolio user': type => 'host', @@ -144,7 +144,7 @@ class role::cryptoportfolio ( user => $pg_user, address => '::1/128', auth_method => 'md5', - order => "b0", + order => "05-01", } postgresql::server::pg_hba_rule { 'allow TCP access to replication user from immae.eu': @@ -153,7 +153,7 @@ class role::cryptoportfolio ( user => $pg_user_replication, address => 'immae.eu', auth_method => 'md5', - order => "b0", + order => "05-01", } class { 'apache::mod::headers': } -- cgit v1.2.3 From 39e05b4ec79c5dc07417a6cb1f0e1b2dcd111a1a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Tue, 13 Mar 2018 20:04:52 +0100 Subject: Move cryptoporfolio module to sub-parts --- modules/role/manifests/cryptoportfolio.pp | 385 +-------------------- modules/role/manifests/cryptoportfolio/apache.pp | 17 + modules/role/manifests/cryptoportfolio/bot.pp | 101 ++++++ modules/role/manifests/cryptoportfolio/front.pp | 158 +++++++++ modules/role/manifests/cryptoportfolio/notify.pp | 6 + .../role/manifests/cryptoportfolio/postgresql.pp | 116 +++++++ 6 files changed, 403 insertions(+), 380 deletions(-) create mode 100644 modules/role/manifests/cryptoportfolio/apache.pp create mode 100644 modules/role/manifests/cryptoportfolio/bot.pp create mode 100644 modules/role/manifests/cryptoportfolio/front.pp create mode 100644 modules/role/manifests/cryptoportfolio/notify.pp create mode 100644 modules/role/manifests/cryptoportfolio/postgresql.pp (limited to 'modules') diff --git a/modules/role/manifests/cryptoportfolio.pp b/modules/role/manifests/cryptoportfolio.pp index 503620b..799e297 100644 --- a/modules/role/manifests/cryptoportfolio.pp +++ b/modules/role/manifests/cryptoportfolio.pp @@ -17,11 +17,6 @@ class role::cryptoportfolio ( Optional[String] $bot_version = undef, Optional[String] $bot_sha256 = undef, ) { - ensure_resource('exec', 'systemctl daemon-reload', { - command => '/usr/bin/systemctl daemon-reload', - refreshonly => true - }) - include "base_installation" include "profile::tools" @@ -29,387 +24,17 @@ class role::cryptoportfolio ( include "profile::apache" include "profile::xmr_stak" - $password_seed = lookup("base_installation::puppet_pass_seed") - - $pg_password = generate_password(24, $password_seed, "postgres_cryptoportfolio") - $pg_replication_password = generate_password(24, $password_seed, "postgres_cryptoportfolio_replication") - $pg_host = "${pg_hostname}:${pg_port}" - - $cf_front_app = "${home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio/Front" - $cf_front_app_api_workdir = "${cf_front_app}/cmd/app" - $cf_front_app_api_bin = "${cf_front_app_api_workdir}/cryptoportfolio-app" - $cf_front_app_api_conf = "${home}/conf.toml" - $cf_front_app_api_secret = generate_password(24, $password_seed, "cryptoportfolio_api_secret") - - $cf_front_app_static_conf = "${cf_front_app}/cmd/web/env/prod.env" - - $cf_bot_app = "${home}/bot" - $cf_bot_app_conf = "${home}/bot_config.ini" - $cf_bot_app_reports = "${home}/bot_reports" - - file { "/var/lib/postgres/data/certs": - ensure => directory, - mode => "0700", - owner => $::profile::postgresql::pg_user, - group => $::profile::postgresql::pg_user, - require => File["/var/lib/postgres"], - } - - file { "/var/lib/postgres/data/certs/cert.pem": - source => "file:///etc/letsencrypt/live/$web_host/cert.pem", - mode => "0600", - links => "follow", - owner => $::profile::postgresql::pg_user, - group => $::profile::postgresql::pg_user, - require => [Letsencrypt::Certonly[$web_host], File["/var/lib/postgres/data/certs"]] - } - - file { "/var/lib/postgres/data/certs/privkey.pem": - source => "file:///etc/letsencrypt/live/$web_host/privkey.pem", - mode => "0600", - links => "follow", - owner => $::profile::postgresql::pg_user, - group => $::profile::postgresql::pg_user, - require => [Letsencrypt::Certonly[$web_host], File["/var/lib/postgres/data/certs"]] - } - - postgresql::server::config_entry { "wal_level": - value => "logical", - } - - postgresql::server::config_entry { "ssl": - value => "on", - require => Letsencrypt::Certonly[$web_host], - } - - postgresql::server::config_entry { "ssl_cert_file": - value => "/var/lib/postgres/data/certs/cert.pem", - require => Letsencrypt::Certonly[$web_host], - } - - postgresql::server::config_entry { "ssl_key_file": - value => "/var/lib/postgres/data/certs/privkey.pem", - require => Letsencrypt::Certonly[$web_host], - } - - postgresql::server::db { $pg_db: - user => $pg_user, - password => postgresql_password($pg_user, $pg_password), - } - -> - postgresql_psql { "CREATE PUBLICATION ${pg_db}_publication FOR ALL TABLES": - db => $pg_db, - unless => "SELECT 1 FROM pg_catalog.pg_publication WHERE pubname = '${pg_db}_publication'", - } - -> - postgresql::server::role { $pg_user_replication: - db => $pg_db, - replication => true, - password_hash => postgresql_password($pg_user_replication, $pg_replication_password), - } - -> - postgresql::server::database_grant { $pg_user_replication: - db => $pg_db, - privilege => "CONNECT", - role => $pg_user_replication, - } - -> - postgresql::server::grant { "all tables in schema:public:$pg_user_replication": - db => $pg_db, - role => $pg_user_replication, - privilege => "SELECT", - object_type => "ALL TABLES IN SCHEMA", - object_name => "public", - } - -> - postgresql::server::grant { "all sequences in schema:public:$pg_user_replication": - db => $pg_db, - role => $pg_user_replication, - privilege => "SELECT", - object_type => "ALL SEQUENCES IN SCHEMA", - object_name => "public", - } - - postgresql::server::pg_hba_rule { 'allow localhost TCP access to cryptoportfolio user': - type => 'host', - database => $pg_db, - user => $pg_user, - address => '127.0.0.1/32', - auth_method => 'md5', - order => "05-01", - } - postgresql::server::pg_hba_rule { 'allow localhost ip6 TCP access to cryptoportfolio user': - type => 'host', - database => $pg_db, - user => $pg_user, - address => '::1/128', - auth_method => 'md5', - order => "05-01", - } + contain "role::cryptoportfolio::postgresql" + contain "role::cryptoportfolio::apache" - postgresql::server::pg_hba_rule { 'allow TCP access to replication user from immae.eu': - type => 'hostssl', - database => $pg_db, - user => $pg_user_replication, - address => 'immae.eu', - auth_method => 'md5', - order => "05-01", - } - - class { 'apache::mod::headers': } - apache::vhost { $web_host: - port => '443', - docroot => false, - manage_docroot => false, - proxy_dest => "http://localhost:8000", - request_headers => 'set X-Forwarded-Proto "https"', - ssl => true, - ssl_cert => "/etc/letsencrypt/live/$web_host/cert.pem", - ssl_key => "/etc/letsencrypt/live/$web_host/privkey.pem", - ssl_chain => "/etc/letsencrypt/live/$web_host/chain.pem", - require => Letsencrypt::Certonly[$web_host], - proxy_preserve_host => true; - default: * => $::profile::apache::apache_vhost_default; - } - - file { "/usr/local/bin/slack-notify": - mode => "0755", - source => "puppet:///modules/role/cryptoportfolio/slack-notify.py", - } + contain "role::cryptoportfolio::notify" unless empty($bot_version) { - ensure_packages(["python", "python-pip"]) - - file { $cf_bot_app: - ensure => "directory", - mode => "0700", - owner => $user, - group => $group, - require => User["$user:"], - } - - archive { "${home}/trader_${bot_version}.tar.gz": - path => "${home}/trader_${bot_version}.tar.gz", - source => "https://git.immae.eu/releases/cryptoportfolio/trader/trader_${bot_version}.tar.gz", - checksum_type => "sha256", - checksum => $bot_sha256, - cleanup => false, - extract => true, - user => $user, - username => lookup("base_installation::ldap_cn"), - password => generate_password(24, $password_seed, "ldap"), - extract_path => $cf_bot_app, - require => [User["$user:"], File[$cf_bot_app]], - } ~> - exec { "py-cryptoportfolio-dependencies": - cwd => $cf_bot_app, - user => $user, - environment => ["HOME=${home}"], - command => "/usr/bin/make install", - require => User["$user:"], - refreshonly => true, - before => [ - File[$cf_bot_app_conf], - Cron["py-cryptoportfolio-before"], - Cron["py-cryptoportfolio-after"], - ] - } - - file { $cf_bot_app_conf: - owner => $user, - group => $group, - mode => "0600", - content => template("role/cryptoportfolio/bot_config.ini.erb"), - require => [ - User["$user:"], - Archive["${home}/trader_${bot_version}.tar.gz"], - ], - } - - cron { "py-cryptoportfolio-before": - ensure => present, - command => "cd $cf_bot_app ; python main.py --config $cf_bot_app_conf --before", - user => $user, - weekday => 7, # Sunday - hour => 22, - minute => 30, - environment => ["HOME=${home}","PATH=/usr/bin/"], - require => [ - File[$cf_bot_app_conf], - Archive["${home}/trader_${bot_version}.tar.gz"] - ], - } - - cron { "py-cryptoportfolio-after": - ensure => present, - command => "cd $cf_bot_app ; python main.py --config $cf_bot_app_conf --after", - user => $user, - weekday => 1, # Monday - hour => 1, - minute => 0, - environment => ["HOME=${home}","PATH=/usr/bin/"], - require => [ - File[$cf_bot_app_conf], - Archive["${home}/trader_${bot_version}.tar.gz"] - ], - } - - unless empty($webhook_url) { - exec { "bot-slack-notify": - refreshonly => true, - environment => [ - "P_PROJECT=Trader", - "P_WEBHOOK=${webhook_url}", - "P_VERSION=${bot_version}", - "P_HOST=${web_host}", - "P_HTTPS=${web_ssl}", - ], - command => "/usr/local/bin/slack-notify", - require => File["/usr/local/bin/slack-notify"], - subscribe => Exec["py-cryptoportfolio-dependencies"], - } - } + contain "role::cryptoportfolio::bot" } # FIXME: restore backup unless empty($front_version) { - ensure_packages(["go", "npm", "nodejs", "yarn"]) - - file { [ - "${home}/go/", - "${home}/go/src", - "${home}/go/src/immae.eu", - "${home}/go/src/immae.eu/Immae", - "${home}/go/src/immae.eu/Immae/Projets", - "${home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies", - "${home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio", - $cf_front_app]: - ensure => "directory", - mode => "0700", - owner => $user, - group => $group, - require => User["$user:"], - } - - file { "${home}/front": - ensure => "link", - target => $cf_front_app, - before => File[$cf_front_app], - } - - file { "/etc/systemd/system/cryptoportfolio-app.service": - mode => "0644", - owner => "root", - group => "root", - content => template("role/cryptoportfolio/cryptoportfolio-app.service.erb"), - notify => Exec["systemctl daemon-reload"], - } - - service { 'cryptoportfolio-app': - enable => true, - ensure => "running", - subscribe => [Exec["go-cryptoportfolio-app"], Exec["web-cryptoportfolio-build"]], - require => [ - File["/etc/systemd/system/cryptoportfolio-app.service"], - Postgresql::Server::Db[$pg_db] - ], - } ~> - exec { "dump $pg_db structure": - refreshonly => true, - user => $::profile::postgresql::pg_user, - group => $::profile::postgresql::pg_user, - command => "/usr/bin/pg_dump --schema-only --clean --no-publications $pg_db > /var/lib/postgres/${pg_db}.schema", - } - - archive { "${home}/front_${front_version}.tar.gz": - path => "${home}/front_${front_version}.tar.gz", - source => "https://git.immae.eu/releases/cryptoportfolio/front/front_${front_version}.tar.gz", - checksum_type => "sha256", - checksum => $front_sha256, - cleanup => false, - extract => true, - user => $user, - username => lookup("base_installation::ldap_cn"), - password => generate_password(24, $password_seed, "ldap"), - extract_path => $cf_front_app, - require => [User["$user:"], File[$cf_front_app]], - notify => [ - Exec["web-cryptoportfolio-dependencies"], - Exec["go-get-dep"], - ] - } - - # Api - file { $cf_front_app_api_conf: - owner => $user, - group => $group, - mode => "0600", - content => template("role/cryptoportfolio/api_conf.toml.erb"), - before => Exec["go-cryptoportfolio-app"], - } - - exec { "go-get-dep": - user => $user, - environment => ["HOME=${home}"], - creates => "${home}/go/bin/dep", - command => "/usr/bin/go get -u github.com/golang/dep/cmd/dep", - refreshonly => true, - } ~> - exec { "go-cryptoportfolio-dependencies": - cwd => $cf_front_app, - user => $user, - environment => ["HOME=${home}"], - command => "${home}/go/bin/dep ensure", - refreshonly => true, - } ~> - exec { "go-cryptoportfolio-app": - cwd => $cf_front_app_api_workdir, - user => $user, - environment => ["HOME=${home}"], - command => "/usr/bin/make build", - refreshonly => true, - } - - # Static pages - file { $cf_front_app_static_conf: - owner => $user, - group => $group, - mode => "0600", - content => template("role/cryptoportfolio/static_conf.env.erb"), - before => Exec["web-cryptoportfolio-build"], - } - - exec { "web-cryptoportfolio-dependencies": - cwd => "${cf_front_app}/cmd/web", - user => $user, - environment => ["HOME=${home}"], - command => "/usr/bin/make install", - refreshonly => true, - require => [Package["npm"], Package["nodejs"], Package["yarn"]] - } ~> - exec { "web-cryptoportfolio-build": - cwd => "${cf_front_app}/cmd/web", - user => $user, - environment => ["HOME=${home}"], - path => ["${cf_front_app}/cmd/web/node_modules/.bin/", "/usr/bin"], - command => "/usr/bin/make static ENV=${env}", - refreshonly => true, - } - - unless empty($webhook_url) { - exec { "front-slack-notify": - refreshonly => true, - environment => [ - "P_PROJECT=Front", - "P_WEBHOOK=${webhook_url}", - "P_VERSION=${front_version}", - "P_HOST=${web_host}", - "P_HTTPS=${web_ssl}", - ], - command => "/usr/local/bin/slack-notify", - require => File["/usr/local/bin/slack-notify"], - subscribe => [Exec["go-cryptoportfolio-app"], Exec["web-cryptoportfolio-build"]], - } - } + contain "role::cryptoportfolio::front" } } diff --git a/modules/role/manifests/cryptoportfolio/apache.pp b/modules/role/manifests/cryptoportfolio/apache.pp new file mode 100644 index 0000000..62d5447 --- /dev/null +++ b/modules/role/manifests/cryptoportfolio/apache.pp @@ -0,0 +1,17 @@ +class role::cryptoportfolio::apache inherits role::cryptoportfolio { + class { 'apache::mod::headers': } + apache::vhost { $web_host: + port => '443', + docroot => false, + manage_docroot => false, + proxy_dest => "http://localhost:8000", + request_headers => 'set X-Forwarded-Proto "https"', + ssl => true, + ssl_cert => "/etc/letsencrypt/live/$web_host/cert.pem", + ssl_key => "/etc/letsencrypt/live/$web_host/privkey.pem", + ssl_chain => "/etc/letsencrypt/live/$web_host/chain.pem", + require => Letsencrypt::Certonly[$web_host], + proxy_preserve_host => true; + default: * => $::profile::apache::apache_vhost_default; + } +} diff --git a/modules/role/manifests/cryptoportfolio/bot.pp b/modules/role/manifests/cryptoportfolio/bot.pp new file mode 100644 index 0000000..a15c779 --- /dev/null +++ b/modules/role/manifests/cryptoportfolio/bot.pp @@ -0,0 +1,101 @@ +class role::cryptoportfolio::bot inherits role::cryptoportfolio { + $password_seed = lookup("base_installation::puppet_pass_seed") + + $cf_bot_app = "${home}/bot" + $cf_bot_app_conf = "${home}/bot_config.ini" + $cf_bot_app_reports = "${home}/bot_reports" + + ensure_packages(["python", "python-pip"]) + + file { $cf_bot_app: + ensure => "directory", + mode => "0700", + owner => $user, + group => $group, + require => User["$user:"], + } + + archive { "${home}/trader_${bot_version}.tar.gz": + path => "${home}/trader_${bot_version}.tar.gz", + source => "https://git.immae.eu/releases/cryptoportfolio/trader/trader_${bot_version}.tar.gz", + checksum_type => "sha256", + checksum => $bot_sha256, + cleanup => false, + extract => true, + user => $user, + username => lookup("base_installation::ldap_cn"), + password => generate_password(24, $password_seed, "ldap"), + extract_path => $cf_bot_app, + require => [User["$user:"], File[$cf_bot_app]], + } ~> + exec { "py-cryptoportfolio-dependencies": + cwd => $cf_bot_app, + user => $user, + environment => ["HOME=${home}"], + command => "/usr/bin/make install", + require => User["$user:"], + refreshonly => true, + before => [ + File[$cf_bot_app_conf], + Cron["py-cryptoportfolio-before"], + Cron["py-cryptoportfolio-after"], + ] + } + + $pg_password = generate_password(24, $password_seed, "postgres_cryptoportfolio") + file { $cf_bot_app_conf: + owner => $user, + group => $group, + mode => "0600", + content => template("role/cryptoportfolio/bot_config.ini.erb"), + require => [ + User["$user:"], + Archive["${home}/trader_${bot_version}.tar.gz"], + ], + } + + cron { "py-cryptoportfolio-before": + ensure => present, + command => "cd $cf_bot_app ; python main.py --config $cf_bot_app_conf --before", + user => $user, + weekday => 7, # Sunday + hour => 22, + minute => 30, + environment => ["HOME=${home}","PATH=/usr/bin/"], + require => [ + File[$cf_bot_app_conf], + Archive["${home}/trader_${bot_version}.tar.gz"] + ], + } + + cron { "py-cryptoportfolio-after": + ensure => present, + command => "cd $cf_bot_app ; python main.py --config $cf_bot_app_conf --after", + user => $user, + weekday => 1, # Monday + hour => 1, + minute => 0, + environment => ["HOME=${home}","PATH=/usr/bin/"], + require => [ + File[$cf_bot_app_conf], + Archive["${home}/trader_${bot_version}.tar.gz"] + ], + } + + unless empty($webhook_url) { + exec { "bot-slack-notify": + refreshonly => true, + environment => [ + "P_PROJECT=Trader", + "P_WEBHOOK=${webhook_url}", + "P_VERSION=${bot_version}", + "P_HOST=${web_host}", + "P_HTTPS=${web_ssl}", + ], + command => "/usr/local/bin/slack-notify", + require => File["/usr/local/bin/slack-notify"], + subscribe => Exec["py-cryptoportfolio-dependencies"], + } + } +} + diff --git a/modules/role/manifests/cryptoportfolio/front.pp b/modules/role/manifests/cryptoportfolio/front.pp new file mode 100644 index 0000000..280ef8b --- /dev/null +++ b/modules/role/manifests/cryptoportfolio/front.pp @@ -0,0 +1,158 @@ +class role::cryptoportfolio::front inherits role::cryptoportfolio { + ensure_resource('exec', 'systemctl daemon-reload', { + command => '/usr/bin/systemctl daemon-reload', + refreshonly => true + }) + + $password_seed = lookup("base_installation::puppet_pass_seed") + + $cf_front_app = "${home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio/Front" + $cf_front_app_api_workdir = "${cf_front_app}/cmd/app" + $cf_front_app_api_bin = "${cf_front_app_api_workdir}/cryptoportfolio-app" + $cf_front_app_api_conf = "${home}/conf.toml" + $cf_front_app_api_secret = generate_password(24, $password_seed, "cryptoportfolio_api_secret") + + $cf_front_app_static_conf = "${cf_front_app}/cmd/web/env/prod.env" + + ensure_packages(["go", "npm", "nodejs", "yarn"]) + + file { [ + "${home}/go/", + "${home}/go/src", + "${home}/go/src/immae.eu", + "${home}/go/src/immae.eu/Immae", + "${home}/go/src/immae.eu/Immae/Projets", + "${home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies", + "${home}/go/src/immae.eu/Immae/Projets/Cryptomonnaies/Cryptoportfolio", + $cf_front_app]: + ensure => "directory", + mode => "0700", + owner => $user, + group => $group, + require => User["$user:"], + } + + file { "${home}/front": + ensure => "link", + target => $cf_front_app, + before => File[$cf_front_app], + } + + file { "/etc/systemd/system/cryptoportfolio-app.service": + mode => "0644", + owner => "root", + group => "root", + content => template("role/cryptoportfolio/cryptoportfolio-app.service.erb"), + notify => Exec["systemctl daemon-reload"], + } + + service { 'cryptoportfolio-app': + enable => true, + ensure => "running", + subscribe => [File[$cf_front_app_api_conf], Exec["go-cryptoportfolio-app"], Exec["web-cryptoportfolio-build"]], + require => [ + File["/etc/systemd/system/cryptoportfolio-app.service"], + Postgresql::Server::Db[$pg_db] + ], + } ~> + exec { "dump $pg_db structure": + refreshonly => true, + user => $::profile::postgresql::pg_user, + group => $::profile::postgresql::pg_user, + command => "/usr/bin/pg_dump --schema-only --clean --no-publications $pg_db > /var/lib/postgres/${pg_db}.schema", + } + + archive { "${home}/front_${front_version}.tar.gz": + path => "${home}/front_${front_version}.tar.gz", + source => "https://git.immae.eu/releases/cryptoportfolio/front/front_${front_version}.tar.gz", + checksum_type => "sha256", + checksum => $front_sha256, + cleanup => false, + extract => true, + user => $user, + username => lookup("base_installation::ldap_cn"), + password => generate_password(24, $password_seed, "ldap"), + extract_path => $cf_front_app, + require => [User["$user:"], File[$cf_front_app]], + notify => [ + Exec["web-cryptoportfolio-dependencies"], + Exec["go-get-dep"], + ] + } + + # Api + $pg_password = generate_password(24, $password_seed, "postgres_cryptoportfolio") + $pg_host = "${pg_hostname}:${pg_port}" + file { $cf_front_app_api_conf: + owner => $user, + group => $group, + mode => "0600", + content => template("role/cryptoportfolio/api_conf.toml.erb"), + before => Exec["go-cryptoportfolio-app"], + } + + exec { "go-get-dep": + user => $user, + environment => ["HOME=${home}"], + creates => "${home}/go/bin/dep", + command => "/usr/bin/go get -u github.com/golang/dep/cmd/dep", + refreshonly => true, + } ~> + exec { "go-cryptoportfolio-dependencies": + cwd => $cf_front_app, + user => $user, + environment => ["HOME=${home}"], + command => "${home}/go/bin/dep ensure", + refreshonly => true, + } ~> + exec { "go-cryptoportfolio-app": + cwd => $cf_front_app_api_workdir, + user => $user, + environment => ["HOME=${home}"], + command => "/usr/bin/make build", + refreshonly => true, + } + + # Static pages + file { $cf_front_app_static_conf: + owner => $user, + group => $group, + mode => "0600", + content => template("role/cryptoportfolio/static_conf.env.erb"), + before => Exec["web-cryptoportfolio-build"], + } + + exec { "web-cryptoportfolio-dependencies": + cwd => "${cf_front_app}/cmd/web", + user => $user, + environment => ["HOME=${home}"], + command => "/usr/bin/make install", + refreshonly => true, + require => [Package["npm"], Package["nodejs"], Package["yarn"]] + } ~> + exec { "web-cryptoportfolio-build": + cwd => "${cf_front_app}/cmd/web", + user => $user, + environment => ["HOME=${home}"], + path => ["${cf_front_app}/cmd/web/node_modules/.bin/", "/usr/bin"], + command => "/usr/bin/make static ENV=${env}", + refreshonly => true, + } + + unless empty($webhook_url) { + exec { "front-slack-notify": + refreshonly => true, + environment => [ + "P_PROJECT=Front", + "P_WEBHOOK=${webhook_url}", + "P_VERSION=${front_version}", + "P_HOST=${web_host}", + "P_HTTPS=${web_ssl}", + ], + command => "/usr/local/bin/slack-notify", + require => File["/usr/local/bin/slack-notify"], + subscribe => [Exec["go-cryptoportfolio-app"], Exec["web-cryptoportfolio-build"]], + } + } + +} diff --git a/modules/role/manifests/cryptoportfolio/notify.pp b/modules/role/manifests/cryptoportfolio/notify.pp new file mode 100644 index 0000000..218312c --- /dev/null +++ b/modules/role/manifests/cryptoportfolio/notify.pp @@ -0,0 +1,6 @@ +class role::cryptoportfolio::notify inherits role::cryptoportfolio { + file { "/usr/local/bin/slack-notify": + mode => "0755", + source => "puppet:///modules/role/cryptoportfolio/slack-notify.py", + } +} diff --git a/modules/role/manifests/cryptoportfolio/postgresql.pp b/modules/role/manifests/cryptoportfolio/postgresql.pp new file mode 100644 index 0000000..cc4d2a9 --- /dev/null +++ b/modules/role/manifests/cryptoportfolio/postgresql.pp @@ -0,0 +1,116 @@ +class role::cryptoportfolio::postgresql inherits role::cryptoportfolio { + $password_seed = lookup("base_installation::puppet_pass_seed") + + $pg_password = generate_password(24, $password_seed, "postgres_cryptoportfolio") + $pg_replication_password = generate_password(24, $password_seed, "postgres_cryptoportfolio_replication") + + file { "/var/lib/postgres/data/certs": + ensure => directory, + mode => "0700", + owner => $::profile::postgresql::pg_user, + group => $::profile::postgresql::pg_user, + require => File["/var/lib/postgres"], + } + + file { "/var/lib/postgres/data/certs/cert.pem": + source => "file:///etc/letsencrypt/live/$web_host/cert.pem", + mode => "0600", + links => "follow", + owner => $::profile::postgresql::pg_user, + group => $::profile::postgresql::pg_user, + require => [Letsencrypt::Certonly[$web_host], File["/var/lib/postgres/data/certs"]] + } + + file { "/var/lib/postgres/data/certs/privkey.pem": + source => "file:///etc/letsencrypt/live/$web_host/privkey.pem", + mode => "0600", + links => "follow", + owner => $::profile::postgresql::pg_user, + group => $::profile::postgresql::pg_user, + require => [Letsencrypt::Certonly[$web_host], File["/var/lib/postgres/data/certs"]] + } + + postgresql::server::config_entry { "wal_level": + value => "logical", + } + + postgresql::server::config_entry { "ssl": + value => "on", + require => Letsencrypt::Certonly[$web_host], + } + + postgresql::server::config_entry { "ssl_cert_file": + value => "/var/lib/postgres/data/certs/cert.pem", + require => Letsencrypt::Certonly[$web_host], + } + + postgresql::server::config_entry { "ssl_key_file": + value => "/var/lib/postgres/data/certs/privkey.pem", + require => Letsencrypt::Certonly[$web_host], + } + + postgresql::server::db { $pg_db: + user => $pg_user, + password => postgresql_password($pg_user, $pg_password), + } + -> + postgresql_psql { "CREATE PUBLICATION ${pg_db}_publication FOR ALL TABLES": + db => $pg_db, + unless => "SELECT 1 FROM pg_catalog.pg_publication WHERE pubname = '${pg_db}_publication'", + } + -> + postgresql::server::role { $pg_user_replication: + db => $pg_db, + replication => true, + password_hash => postgresql_password($pg_user_replication, $pg_replication_password), + } + -> + postgresql::server::database_grant { $pg_user_replication: + db => $pg_db, + privilege => "CONNECT", + role => $pg_user_replication, + } + -> + postgresql::server::grant { "all tables in schema:public:$pg_user_replication": + db => $pg_db, + role => $pg_user_replication, + privilege => "SELECT", + object_type => "ALL TABLES IN SCHEMA", + object_name => "public", + } + -> + postgresql::server::grant { "all sequences in schema:public:$pg_user_replication": + db => $pg_db, + role => $pg_user_replication, + privilege => "SELECT", + object_type => "ALL SEQUENCES IN SCHEMA", + object_name => "public", + } + + postgresql::server::pg_hba_rule { 'allow localhost TCP access to cryptoportfolio user': + type => 'host', + database => $pg_db, + user => $pg_user, + address => '127.0.0.1/32', + auth_method => 'md5', + order => "05-01", + } + postgresql::server::pg_hba_rule { 'allow localhost ip6 TCP access to cryptoportfolio user': + type => 'host', + database => $pg_db, + user => $pg_user, + address => '::1/128', + auth_method => 'md5', + order => "05-01", + } + + postgresql::server::pg_hba_rule { 'allow TCP access to replication user from immae.eu': + type => 'hostssl', + database => $pg_db, + user => $pg_user_replication, + address => 'immae.eu', + auth_method => 'md5', + order => "05-01", + } + +} -- cgit v1.2.3 From c15f2234474ff8a8266e26856702b3c561050667 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Fri, 16 Mar 2018 00:22:38 +0100 Subject: Move scripts to separate chunks --- modules/base_installation/templates/puppet/host_ldap.info.erb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'modules') diff --git a/modules/base_installation/templates/puppet/host_ldap.info.erb b/modules/base_installation/templates/puppet/host_ldap.info.erb index a71c6f3..9c79d3c 100644 --- a/modules/base_installation/templates/puppet/host_ldap.info.erb +++ b/modules/base_installation/templates/puppet/host_ldap.info.erb @@ -1,4 +1,4 @@ -#### Please add this node to LDAP: +#### Please add this node to LDAP: ldapadd -D "cn=root,<%= @ldap_base %>" -W << 'EOF' dn: <%= @ldap_dn %> cn: <%= @ldap_cn %> @@ -14,12 +14,13 @@ objectclass: ipHost environment: <%= @environment %> userpassword: {SSHA}<%= Base64.encode64(Digest::SHA1.digest(@ldap_password+@ssha_ldap_seed)+@ssha_ldap_seed).chomp! %> EOF -#### Or modify an existing entry: +#### Or modify an existing entry: ldapmodify -D "cn=root,<%= @ldap_base %>" -W << 'EOF' dn: <%= @ldap_dn %> changetype: modify replace: userPassword userpassword: {SSHA}<%= Base64.encode64(Digest::SHA1.digest(@ldap_password+@ssha_ldap_seed)+@ssha_ldap_seed).chomp! %> +- replace: environment environment: <%= @environment %> <%- unless @ips.empty? -%> -- cgit v1.2.3 From 62fe8998b5497864d51ed0fe909a0ff60cc1520b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Fri, 16 Mar 2018 20:37:40 +0100 Subject: Make cpu limit for xmr stak parameter --- modules/profile/files/xmr_stak/xmr-stak.service | 15 --------------- modules/profile/manifests/xmr_stak.pp | 3 ++- modules/profile/templates/xmr_stak/xmr-stak.service.erb | 16 ++++++++++++++++ 3 files changed, 18 insertions(+), 16 deletions(-) delete mode 100644 modules/profile/files/xmr_stak/xmr-stak.service create mode 100644 modules/profile/templates/xmr_stak/xmr-stak.service.erb (limited to 'modules') diff --git a/modules/profile/files/xmr_stak/xmr-stak.service b/modules/profile/files/xmr_stak/xmr-stak.service deleted file mode 100644 index 93ee383..0000000 --- a/modules/profile/files/xmr_stak/xmr-stak.service +++ /dev/null @@ -1,15 +0,0 @@ -[Unit] -Description=XMR Miner -After=network.target - -[Service] -WorkingDirectory=/var/lib/xmr_stak - -Type=simple -User=xmr_stak -Group=xmr_stak -ExecStart=/usr/bin/cpulimit --limit 90 /usr/bin/xmr-stak -c /var/lib/xmr_stak/xmr-stak.conf -Nice=19 - -[Install] -WantedBy=multi-user.target diff --git a/modules/profile/manifests/xmr_stak.pp b/modules/profile/manifests/xmr_stak.pp index c8bbcdd..ccb6baa 100644 --- a/modules/profile/manifests/xmr_stak.pp +++ b/modules/profile/manifests/xmr_stak.pp @@ -1,6 +1,7 @@ class profile::xmr_stak ( String $mining_pool, String $wallet, + Optional[String] $cpulimit = "50", Optional[String] $password = "x", ) { ensure_resource('exec', 'systemctl daemon-reload', { @@ -25,7 +26,7 @@ class profile::xmr_stak ( mode => "0644", owner => "root", group => "root", - source => "puppet:///modules/profile/xmr_stak/xmr-stak.service", + content => template("profile/xmr_stak/xmr-stak.service.erb"), require => User["xmr_stak"], notify => Exec["systemctl daemon-reload"] } diff --git a/modules/profile/templates/xmr_stak/xmr-stak.service.erb b/modules/profile/templates/xmr_stak/xmr-stak.service.erb new file mode 100644 index 0000000..d63103b --- /dev/null +++ b/modules/profile/templates/xmr_stak/xmr-stak.service.erb @@ -0,0 +1,16 @@ +[Unit] +Description=XMR Miner +After=network.target + +[Service] +WorkingDirectory=/var/lib/xmr_stak + +Type=simple +User=xmr_stak +Group=xmr_stak +ExecStart=/usr/bin/cpulimit --limit <%= @cpulimit %> /usr/bin/xmr-stak -c /var/lib/xmr_stak/xmr-stak.conf +Nice=19 + +[Install] +WantedBy=multi-user.target + -- cgit v1.2.3 From c443842eae41fb28d5608acfd303106e5f24798a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Sat, 17 Mar 2018 10:48:34 +0100 Subject: Add cron to update pacman keys --- modules/base_installation/manifests/cronie.pp | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'modules') diff --git a/modules/base_installation/manifests/cronie.pp b/modules/base_installation/manifests/cronie.pp index 72f2d8f..e8d5dfd 100644 --- a/modules/base_installation/manifests/cronie.pp +++ b/modules/base_installation/manifests/cronie.pp @@ -29,5 +29,12 @@ class base_installation::cronie inherits base_installation { user => root, special => "reboot" } + cron { 'pacman_keys': + ensure => present, + command => "pacman-key --populate archlinux", + user => root, + minute => "0", + hour => "1", + } } } -- cgit v1.2.3 From e8493916ff6e957c752df1cfc1789844c426d987 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Mon, 19 Mar 2018 16:02:30 +0100 Subject: Add ldap backend for hiera lookup --- .../lib/puppet/functions/ldap_data.rb | 46 ++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 modules/base_installation/lib/puppet/functions/ldap_data.rb (limited to 'modules') diff --git a/modules/base_installation/lib/puppet/functions/ldap_data.rb b/modules/base_installation/lib/puppet/functions/ldap_data.rb new file mode 100644 index 0000000..ff8d779 --- /dev/null +++ b/modules/base_installation/lib/puppet/functions/ldap_data.rb @@ -0,0 +1,46 @@ +require 'json' + +Puppet::Functions.create_function(:ldap_data) do + dispatch :ldap_data do + param 'Hash', :options + param 'Puppet::LookupContext', :context + end + + def ldap_data(options, context) + begin + require 'ldap' + require 'puppet/util/ldap/connection' + rescue + context.not_found + return + end + + if !context.cache_has_key("ldap_lookup") + begin + conn = Puppet::Util::Ldap::Connection.instance + conn.start + connection = conn.connection + rescue ::LDAP::ResultError => e + raise Puppet::ParseError, ("ldapquery(): LDAP ResultError - #{e.message}") + end + + host = Facter.value('ec2_metadata')["hostname"] + base = Puppet[:ldapbase] + scope = ::LDAP::LDAP_SCOPE_SUBTREE + filter = "(objectclass=*)" + + data = {} + connection.search(base, scope, filter) do |entry| + data_ = entry.to_hash + jsons = data_["immaePuppetJson"] || [] + jsons.each do |json| + data.merge!(JSON.parse(json)) + end + end + + context.cache("ldap_lookup", data) + end + + context.cached_value("ldap_lookup") + end +end -- cgit v1.2.3 From 97103ded8390d10ea3468615c654e89d07c0a921 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Mon, 19 Mar 2018 16:00:01 +0100 Subject: Filter ldapvar to contain only puppetClient information --- modules/base_installation/lib/facter/ldapvar.rb | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) (limited to 'modules') diff --git a/modules/base_installation/lib/facter/ldapvar.rb b/modules/base_installation/lib/facter/ldapvar.rb index 3ee6623..08d58e4 100644 --- a/modules/base_installation/lib/facter/ldapvar.rb +++ b/modules/base_installation/lib/facter/ldapvar.rb @@ -27,16 +27,18 @@ begin connection.search(base, scope, filter) do |entry| data_ = entry.to_hash - data_['vars'] = (data_[Puppet[:ldapstackedattrs]] || []) - .map { |var| var.split("=", 2) } - .group_by { |(key, value)| key } - .map { |key, value| [key, value.map(&:last)] } - .to_h + if data_["objectClass"].any? { |class_| class_ == "puppetClient" } + data_['vars'] = (data_[Puppet[:ldapstackedattrs]] || []) + .map { |var| var.split("=", 2) } + .group_by { |(key, value)| key } + .map { |key, value| [key, value.map(&:last)] } + .to_h - data[:other] << data_ + data[:other] << data_ - if data_["cn"].any? { |cn| cn == host } - data[:self] = data_ + if data_["cn"].any? { |cn| cn == host } + data[:self] = data_ + end end end -- cgit v1.2.3 From 82caf31189f11a9bca4836260e8ee8ba954690f2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Sat, 17 Mar 2018 11:00:48 +0100 Subject: Add mail profile --- modules/profile/manifests/mail.pp | 14 ++++++++++++++ modules/profile/templates/mail/ssmtp.conf.erb | 14 ++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 modules/profile/manifests/mail.pp create mode 100644 modules/profile/templates/mail/ssmtp.conf.erb (limited to 'modules') diff --git a/modules/profile/manifests/mail.pp b/modules/profile/manifests/mail.pp new file mode 100644 index 0000000..cc47b77 --- /dev/null +++ b/modules/profile/manifests/mail.pp @@ -0,0 +1,14 @@ +class profile::mail ( + String $mailhub, + Optional[Integer] $mailhub_port = 25, +) { + ensure_packages(["s-nail", "ssmtp"]) + + $hostname = lookup("base_installation::real_hostname") + + file { "/etc/ssmtp/ssmtp.conf": + ensure => "present", + content => template("profile/mail/ssmtp.conf.erb"), + } +} + diff --git a/modules/profile/templates/mail/ssmtp.conf.erb b/modules/profile/templates/mail/ssmtp.conf.erb new file mode 100644 index 0000000..e7a0410 --- /dev/null +++ b/modules/profile/templates/mail/ssmtp.conf.erb @@ -0,0 +1,14 @@ +# +# /etc/ssmtp.conf -- a config file for sSMTP sendmail. +# +# The person who gets all mail for userids < 1000 +# Make this empty to disable rewriting. +root=postmaster +# The place where the mail goes. The actual machine name is required +# no MX records are consulted. Commonly mailhosts are named mail.domain.com +# The example will fit if you are in domain.com and you mailhub is so named. +mailhub=<%= @mailhub %>:<%= @mailhub_port %> +# Where will the mail seem to come from? +#rewriteDomain=y +# The full hostname +hostname=<%= @hostname %> -- cgit v1.2.3 From cfa8eb925ff0115d5d4b2298f7d9a054b869fa75 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Sat, 17 Mar 2018 12:46:37 +0100 Subject: Add puppet_apply script with lockfile --- .../files/cronie/puppet-post-merge | 4 ++-- .../base_installation/files/scripts/puppet_apply | 23 ++++++++++++++++++++++ .../files/scripts/puppet_reset_and_apply | 2 +- modules/base_installation/manifests/cronie.pp | 4 ++-- modules/base_installation/manifests/puppet.pp | 6 ++++++ 5 files changed, 34 insertions(+), 5 deletions(-) create mode 100644 modules/base_installation/files/scripts/puppet_apply (limited to 'modules') diff --git a/modules/base_installation/files/cronie/puppet-post-merge b/modules/base_installation/files/cronie/puppet-post-merge index ac5e3ff..f5c21a7 100644 --- a/modules/base_installation/files/cronie/puppet-post-merge +++ b/modules/base_installation/files/cronie/puppet-post-merge @@ -1,7 +1,7 @@ #!/bin/bash -## Run Puppet locally using puppet apply +## Run Puppet locally using puppet_apply git submodule update --init -/usr/bin/puppet apply `pwd`/manifests/site.pp +/usr/local/sbin/puppet_apply `pwd`/manifests/site.pp ## Log status of the Puppet run if [ $? -eq 0 ] diff --git a/modules/base_installation/files/scripts/puppet_apply b/modules/base_installation/files/scripts/puppet_apply new file mode 100644 index 0000000..69673cc --- /dev/null +++ b/modules/base_installation/files/scripts/puppet_apply @@ -0,0 +1,23 @@ +#!/bin/bash + +lockfile=/var/run/puppet-apply.lock +path=`dirname $0` +path=`cd $path/..; pwd` + +if [ $(id -u) -gt 0 ]; then + echo "You must be root to run this script." >&2 + exit 2 +fi + +if (set -o noclobber; echo "$$" > "$lockfile") 2> /dev/null; then + trap 'rm -f "$lockfile"; exit $?' INT TERM EXIT + + puppet apply "$@" + + rm -f "$lockfile" + trap - INT TERM EXIT +else + echo "Failed to acquire lockfile: $lockfile." >&2 + echo "Held by $(cat $lockfile 2>/dev/null)" >&2 + exit 1 +fi diff --git a/modules/base_installation/files/scripts/puppet_reset_and_apply b/modules/base_installation/files/scripts/puppet_reset_and_apply index 6743044..0350e6e 100644 --- a/modules/base_installation/files/scripts/puppet_reset_and_apply +++ b/modules/base_installation/files/scripts/puppet_reset_and_apply @@ -11,4 +11,4 @@ fi git reset --hard origin/$branch git submodule update --init -puppet apply --test manifests/site.pp +puppet_apply --test manifests/site.pp diff --git a/modules/base_installation/manifests/cronie.pp b/modules/base_installation/manifests/cronie.pp index e8d5dfd..e8f3e20 100644 --- a/modules/base_installation/manifests/cronie.pp +++ b/modules/base_installation/manifests/cronie.pp @@ -19,13 +19,13 @@ class base_installation::cronie inherits base_installation { } cron { 'puppet-apply': ensure => present, - command => "cd $base_installation::puppet_code_path ; puppet apply $base_installation::puppet_code_path/manifests/site.pp", + command => "cd $base_installation::puppet_code_path ; puppet_apply $base_installation::puppet_code_path/manifests/site.pp", user => root, minute => '*/20' } cron { 'puppet-apply-reboot': ensure => present, - command => "cd $base_installation::puppet_code_path ; puppet apply $base_installation::puppet_code_path/manifests/site.pp", + command => "cd $base_installation::puppet_code_path ; puppet_apply $base_installation::puppet_code_path/manifests/site.pp", user => root, special => "reboot" } diff --git a/modules/base_installation/manifests/puppet.pp b/modules/base_installation/manifests/puppet.pp index 6f7732d..0cb43bc 100644 --- a/modules/base_installation/manifests/puppet.pp +++ b/modules/base_installation/manifests/puppet.pp @@ -39,6 +39,12 @@ class base_installation::puppet ( source => "puppet:///modules/base_installation/scripts/report_print.rb" } + file { '/usr/local/sbin/puppet_apply': + mode => "0755", + ensure => present, + source => "puppet:///modules/base_installation/scripts/puppet_apply", + } + unless empty(find_file($password_seed)) { $ldap_password = generate_password(24, $password_seed, "ldap") $ssha_ldap_seed = generate_password(5, $password_seed, "ldap_seed") -- cgit v1.2.3 From d87a489f9585d10f0a185beb59ae16a10f27a7bd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Fri, 16 Mar 2018 20:40:27 +0100 Subject: Add backup role --- modules/profile/manifests/known_hosts.pp | 11 ++ modules/role/manifests/backup.pp | 122 +++++++++++++++++++++ .../templates/backup/backup_dirname_head.sh.erb | 27 +++++ .../templates/backup/backup_dirname_part.sh.erb | 26 +++++ .../templates/backup/backup_dirname_tail.sh.erb | 4 + modules/role/templates/backup/backup_head.sh.erb | 20 ++++ .../role/templates/backup/backup_immae_eu.sh.erb | 79 +++++++++++++ modules/role/templates/backup/backup_tail.sh.erb | 0 .../templates/backup/ssh_host_changed.info.erb | 4 + .../role/templates/backup/ssh_key_changed.info.erb | 5 + modules/ssh_keygen | 1 + 11 files changed, 299 insertions(+) create mode 100644 modules/profile/manifests/known_hosts.pp create mode 100644 modules/role/manifests/backup.pp create mode 100644 modules/role/templates/backup/backup_dirname_head.sh.erb create mode 100644 modules/role/templates/backup/backup_dirname_part.sh.erb create mode 100644 modules/role/templates/backup/backup_dirname_tail.sh.erb create mode 100644 modules/role/templates/backup/backup_head.sh.erb create mode 100644 modules/role/templates/backup/backup_immae_eu.sh.erb create mode 100644 modules/role/templates/backup/backup_tail.sh.erb create mode 100644 modules/role/templates/backup/ssh_host_changed.info.erb create mode 100644 modules/role/templates/backup/ssh_key_changed.info.erb create mode 160000 modules/ssh_keygen (limited to 'modules') diff --git a/modules/profile/manifests/known_hosts.pp b/modules/profile/manifests/known_hosts.pp new file mode 100644 index 0000000..ed9ec8e --- /dev/null +++ b/modules/profile/manifests/known_hosts.pp @@ -0,0 +1,11 @@ +class profile::known_hosts ( + Optional[Array] $hosts = [] +) { + $hosts.each |$host| { + sshkey { $host["name"]: + ensure => "present", + key => $host["key"], + type => $host["type"], + } + } +} diff --git a/modules/role/manifests/backup.pp b/modules/role/manifests/backup.pp new file mode 100644 index 0000000..edfd5e0 --- /dev/null +++ b/modules/role/manifests/backup.pp @@ -0,0 +1,122 @@ +class role::backup ( + String $user, + String $group, + String $mailto, + Optional[Array] $backups = [], + Optional[String] $mountpoint = "/backup1", + Optional[String] $backup_script = "/usr/local/bin/backup.sh", +) { + include "base_installation" + + include "profile::mail" + include "profile::tools" + include "profile::xmr_stak" + include "profile::known_hosts" + + ssh_keygen { $user: + notify => Notify_refresh["notify-backup-sshkey-change"] + } + + $hosts = $backups.map |$backup| { $backup["host"] } + + notify_refresh { "notify-backup-sshkey-change": + message => template("role/backup/ssh_key_changed.info.erb"), + refreshonly => true + } + + $hosts.each |$host| { + notify_refresh { "notify-backup-sshhost-$host-changed": + message => template("role/backup/ssh_host_changed.info.erb"), + refreshonly => true, + subscribe => Sshkey[$host], + } + } + + concat { $backup_script: + ensure => "present", + ensure_newline => true, + mode => "0755", + } + + cron { "backup": + ensure => present, + command => $backup_script, + user => $user, + minute => 25, + hour => 3, + require => Concat[$backup_script], + } + + concat::fragment { "backup_head": + target => $backup_script, + content => template("role/backup/backup_head.sh.erb"), + order => "01-50", + } + + concat::fragment { "backup_tail": + target => $backup_script, + content => template("role/backup/backup_tail.sh.erb"), + order => "99-50", + } + + $backups.each |$infos| { + $dirname = $infos["name"] + $login = $infos["login"] + $host = $infos["host"] + $dest = "$login@$host" + $base = "$mountpoint/$dirname" + $nbr = $infos["nbr"] + $order_dirname = $infos["order"] + + file { $base: + ensure => "directory", + owner => $user, + group => $group, + require => Mount[$mountpoint], + } -> + file { "$base/older": + ensure => "directory", + owner => $user, + group => $group, + } -> + file { "$base/rsync_output": + ensure => "directory", + owner => $user, + group => $group, + } + + concat::fragment { "backup_${dirname}_head": + target => $backup_script, + content => template("role/backup/backup_dirname_head.sh.erb"), + order => "$order_dirname-01", + } + + concat::fragment { "backup_${dirname}_tail": + target => $backup_script, + content => template("role/backup/backup_dirname_tail.sh.erb"), + order => "$order_dirname-99", + } + + $infos["parts"].each |$part| { + $local_folder = $part["local_folder"] + $remote_folder = $part["remote_folder"] + $exclude_from = $part["exclude_from"] + $files_from = $part["files_from"] + $args = $part["args"] + $order_part = $part["order"] + + file { "$base/$local_folder": + ensure => "directory", + owner => $user, + group => $group, + require => File[$base], + } + + concat::fragment { "backup_${dirname}_${local_folder}": + target => $backup_script, + content => template("role/backup/backup_dirname_part.sh.erb"), + order => "$order_dirname-$order_part", + } + } + } +} diff --git a/modules/role/templates/backup/backup_dirname_head.sh.erb b/modules/role/templates/backup/backup_dirname_head.sh.erb new file mode 100644 index 0000000..e20cfd3 --- /dev/null +++ b/modules/role/templates/backup/backup_dirname_head.sh.erb @@ -0,0 +1,27 @@ +##### <%= @dirname %> ##### +DEST="<%= @dest %>" +BASE="<%= @base %>" +OLD_BAK_BASE=$BASE/older/j +BAK_BASE=${OLD_BAK_BASE}0 +RSYNC_OUTPUT=$BASE/rsync_output +NBR=<%= @nbr %> + +if ! ssh \ + -o PreferredAuthentications=publickey \ + -o StrictHostKeyChecking=yes \ + -o ClearAllForwardings=yes \ + $DEST backup; then + echo "Fichier de verrouillage backup sur $DEST ou impossible de se connecter" >&2 + skip=$DEST +fi + +rm -rf ${OLD_BAK_BASE}${NBR} +for j in `seq -w $(($NBR-1)) -1 0`; do + [ ! -d ${OLD_BAK_BASE}$j ] && continue + mv ${OLD_BAK_BASE}$j ${OLD_BAK_BASE}$(($j+1)) +done +mkdir $BAK_BASE +mv $RSYNC_OUTPUT $BAK_BASE +mkdir $RSYNC_OUTPUT + +if [ "$skip" != "$DEST" ]; then diff --git a/modules/role/templates/backup/backup_dirname_part.sh.erb b/modules/role/templates/backup/backup_dirname_part.sh.erb new file mode 100644 index 0000000..ec662c4 --- /dev/null +++ b/modules/role/templates/backup/backup_dirname_part.sh.erb @@ -0,0 +1,26 @@ +### <%= @dirname %> <%= @local_folder %> ### +LOCAL="<%= @local_folder %>" +REMOTE="<%= @remote_folder %>" + +cd $BASE/$LOCAL +cat > $EXCL_FROM < +EOF +cat > $FILES_FROM < +EOF + +OUT=$RSYNC_OUTPUT/$LOCAL +rsync -XAavbrz --fake-super -e ssh --numeric-ids --delete \ + --backup-dir=$BAK_BASE/$LOCAL \ +<%- unless @args.empty? -%> + <%= @args %>\ +<% end -%> +<%- unless @exclude_from.empty? -%> + --exclude-from=$EXCL_FROM \ +<% end -%> +<%- unless @files_from.empty? -%> + --files-from=$FILES_FROM \ +<% end -%> + $DEST:$REMOTE . > $OUT || true +### End <%= @dirname %> <%= @local_folder %> ### diff --git a/modules/role/templates/backup/backup_dirname_tail.sh.erb b/modules/role/templates/backup/backup_dirname_tail.sh.erb new file mode 100644 index 0000000..6b16c9d --- /dev/null +++ b/modules/role/templates/backup/backup_dirname_tail.sh.erb @@ -0,0 +1,4 @@ + + ssh $DEST sh -c "date > .last_backup" +fi # [ "$skip" != "$DEST" ] +##### End <%= @dirname %> ##### diff --git a/modules/role/templates/backup/backup_head.sh.erb b/modules/role/templates/backup/backup_head.sh.erb new file mode 100644 index 0000000..be9f5bf --- /dev/null +++ b/modules/role/templates/backup/backup_head.sh.erb @@ -0,0 +1,20 @@ +#!/bin/bash +MAILTO="<%= @mailto %>" + +EXCL_FROM=`mktemp` +FILES_FROM=`mktemp` +TMP_STDERR=`mktemp` + +on_exit() { + if [ -s "$TMP_STDERR" ]; then + cat "$TMP_STDERR" | mail -Ssendwait -s "save_distant rsync error" "$MAILTO" + fi + rm -f $TMP_STDERR $EXCL_FROM $FILES_FROM +} + +trap "on_exit" EXIT + +exec 2> "$TMP_STDERR" +exec < /dev/null + +set -e diff --git a/modules/role/templates/backup/backup_immae_eu.sh.erb b/modules/role/templates/backup/backup_immae_eu.sh.erb new file mode 100644 index 0000000..4fab30e --- /dev/null +++ b/modules/role/templates/backup/backup_immae_eu.sh.erb @@ -0,0 +1,79 @@ +#!/bin/bash +DEST="<%= @dest %>" +MAILTO="<%= @mailto %>" +BASE="<%= @base %>" +OLD_BAK_BASE=$BASE/older/j +BAK_BASE=${OLD_BAK_BASE}0 +RSYNC_OUTPUT=$BASE/rsync_output +NBR=7 + +TMP=`mktemp` +TMP_STDERR=`mktemp` + +trap "rm -f $TMP $TMP_STDERR" EXIT + +exec 2> "$TMP_STDERR" + +set -e +if ! `ssh -o ClearAllForwardings=yes $DEST backup`; then + echo "Fichier de verrouillage backup sur $DEST" + exit 1 +fi + +rm -rf ${OLD_BAK_BASE}${NBR} +for j in `seq -w $(($NBR-1)) -1 0`; do + [ ! -d ${OLD_BAK_BASE}$j ] && continue + mv ${OLD_BAK_BASE}$j ${OLD_BAK_BASE}$(($j+1)) +done +mkdir $BAK_BASE +mv $RSYNC_OUTPUT $BAK_BASE +mkdir $RSYNC_OUTPUT + +############## +NAME="home" +FOLDER="/home/immae" + +cd $BASE/$NAME +cat > $TMP < $OUT || true + +############## +NAME="system" +FOLDER="/" + +cd $BASE/$NAME +cat > $TMP < $OUT || true + +############## +ssh $DEST sh -c "date > .last_backup" + +if [ -s "$TMP_STDERR" ]; then + cat "$TMP_STDERR" | mail -Ssendwait -s "save_distant rsync error" "$MAILTO" +fi diff --git a/modules/role/templates/backup/backup_tail.sh.erb b/modules/role/templates/backup/backup_tail.sh.erb new file mode 100644 index 0000000..e69de29 diff --git a/modules/role/templates/backup/ssh_host_changed.info.erb b/modules/role/templates/backup/ssh_host_changed.info.erb new file mode 100644 index 0000000..ebf202e --- /dev/null +++ b/modules/role/templates/backup/ssh_host_changed.info.erb @@ -0,0 +1,4 @@ +Host <%= @host %> added, please send <%= @user %> key if necessary. +<%- if File.exist?("/home/#{@user}/.ssh/id_rsa.pub") %> + <%= File.read("/home/#{@user}/.ssh/id_rsa.pub") %> +<% end -%> diff --git a/modules/role/templates/backup/ssh_key_changed.info.erb b/modules/role/templates/backup/ssh_key_changed.info.erb new file mode 100644 index 0000000..43fd2ec --- /dev/null +++ b/modules/role/templates/backup/ssh_key_changed.info.erb @@ -0,0 +1,5 @@ +ssh key of <%= @user %> changed, +please update hosts: +<%- @hosts.each do |host| %> + - <%= host %> +<% end -%> diff --git a/modules/ssh_keygen b/modules/ssh_keygen new file mode 160000 index 0000000..ca53363 --- /dev/null +++ b/modules/ssh_keygen @@ -0,0 +1 @@ +Subproject commit ca53363249b58af96f90cb810c7c51dda8ba803b -- cgit v1.2.3 From a55a5e4aa468d550fcdf5bbeafe42dea13773e37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Mon, 19 Mar 2018 16:39:02 +0100 Subject: Fix load error for puppet --- modules/base_installation/lib/puppet/functions/ldap_data.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'modules') diff --git a/modules/base_installation/lib/puppet/functions/ldap_data.rb b/modules/base_installation/lib/puppet/functions/ldap_data.rb index ff8d779..0c92d89 100644 --- a/modules/base_installation/lib/puppet/functions/ldap_data.rb +++ b/modules/base_installation/lib/puppet/functions/ldap_data.rb @@ -10,7 +10,7 @@ Puppet::Functions.create_function(:ldap_data) do begin require 'ldap' require 'puppet/util/ldap/connection' - rescue + rescue LoadError context.not_found return end -- cgit v1.2.3 From f25ad097f24e0d39d5dd9ac2cef39760e671e08f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Mon, 19 Mar 2018 17:13:37 +0100 Subject: =?UTF-8?q?Don=E2=80=99t=20mount=20unavailables=20mounts?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- modules/base_installation/manifests/fstab.pp | 18 ------------------ modules/base_installation/manifests/init.pp | 2 -- modules/base_installation/manifests/params.pp | 1 - modules/profile/manifests/fstab.pp | 18 ++++++++++++++++++ modules/role/manifests/backup.pp | 1 + 5 files changed, 19 insertions(+), 21 deletions(-) delete mode 100644 modules/base_installation/manifests/fstab.pp create mode 100644 modules/profile/manifests/fstab.pp (limited to 'modules') diff --git a/modules/base_installation/manifests/fstab.pp b/modules/base_installation/manifests/fstab.pp deleted file mode 100644 index f012e76..0000000 --- a/modules/base_installation/manifests/fstab.pp +++ /dev/null @@ -1,18 +0,0 @@ -class base_installation::fstab ( - $mounts = $base_installation::mounts -) inherits base_installation { - $mounts.each |$mount| { - unless empty($mount) { - $infos = split($mount, ';') - - file { $infos[0]: - ensure => directory, - } -> - mount { $infos[0]: - ensure => mounted, - device => "UUID=${infos[1]}", - fstype => $infos[2] - } - } - } -} diff --git a/modules/base_installation/manifests/init.pp b/modules/base_installation/manifests/init.pp index cb1cdda..998f8ff 100644 --- a/modules/base_installation/manifests/init.pp +++ b/modules/base_installation/manifests/init.pp @@ -6,7 +6,6 @@ class base_installation ( Optional[String] $ldap_dn = $base_installation::params::ldap_dn, Optional[String] $ldap_server = $base_installation::params::ldap_server, Optional[String] $ldap_uri = $base_installation::params::ldap_uri, - Optional[Array[String]] $mounts = $base_installation::params::mounts, Optional[String] $puppet_code_path = $base_installation::params::puppet_code_path, Optional[String] $puppet_conf_path = $base_installation::params::puppet_conf_path, Optional[String] $puppet_pass_seed = $base_installation::params::puppet_pass_seed, @@ -31,5 +30,4 @@ class base_installation ( contain ::base_installation::users contain ::base_installation::package_managers contain ::base_installation::puppet - contain ::base_installation::fstab } diff --git a/modules/base_installation/manifests/params.pp b/modules/base_installation/manifests/params.pp index 2a9fe6a..5ade838 100644 --- a/modules/base_installation/manifests/params.pp +++ b/modules/base_installation/manifests/params.pp @@ -10,7 +10,6 @@ class base_installation::params { $ldap_cert_path = "/etc/ssl/certs/ca-certificates.crt" $ldap_uri = "ldaps://ldap.example.com" $ldap_server = "ldap.example.com" - $mounts = [] $real_hostname = "example.com" $system_hostname = "example.com" $system_locales = ["en_US.UTF-8"] diff --git a/modules/profile/manifests/fstab.pp b/modules/profile/manifests/fstab.pp new file mode 100644 index 0000000..5f2e58e --- /dev/null +++ b/modules/profile/manifests/fstab.pp @@ -0,0 +1,18 @@ +class profile::fstab ( + Optional[Array] $mounts = [] +) { + $mounts.each |$mount| { + unless empty($mount) { + $infos = split($mount, ';') + + file { $infos[0]: + ensure => directory, + } -> + mount { $infos[0]: + ensure => mounted, + device => "UUID=${infos[1]}", + fstype => $infos[2] + } + } + } +} diff --git a/modules/role/manifests/backup.pp b/modules/role/manifests/backup.pp index edfd5e0..d7ba486 100644 --- a/modules/role/manifests/backup.pp +++ b/modules/role/manifests/backup.pp @@ -8,6 +8,7 @@ class role::backup ( ) { include "base_installation" + include "profile::fstab" include "profile::mail" include "profile::tools" include "profile::xmr_stak" -- cgit v1.2.3 From b45f55437f8239acf5576f4f5282b68eb933db32 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Mon, 19 Mar 2018 18:44:43 +0100 Subject: Other fixes --- modules/base_installation/manifests/cronie.pp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'modules') diff --git a/modules/base_installation/manifests/cronie.pp b/modules/base_installation/manifests/cronie.pp index e8f3e20..2235470 100644 --- a/modules/base_installation/manifests/cronie.pp +++ b/modules/base_installation/manifests/cronie.pp @@ -19,13 +19,13 @@ class base_installation::cronie inherits base_installation { } cron { 'puppet-apply': ensure => present, - command => "cd $base_installation::puppet_code_path ; puppet_apply $base_installation::puppet_code_path/manifests/site.pp", + command => "cd $base_installation::puppet_code_path ; /usr/local/sbin/puppet_apply $base_installation::puppet_code_path/manifests/site.pp", user => root, minute => '*/20' } cron { 'puppet-apply-reboot': ensure => present, - command => "cd $base_installation::puppet_code_path ; puppet_apply $base_installation::puppet_code_path/manifests/site.pp", + command => "cd $base_installation::puppet_code_path ; /usr/local/sbin/puppet_apply $base_installation::puppet_code_path/manifests/site.pp", user => root, special => "reboot" } -- cgit v1.2.3 From 4772e48cc9e2e6ed39776b007cbf0d5514f4c7b9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Mon, 19 Mar 2018 19:06:22 +0100 Subject: Populate keyring at install --- modules/pacman | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'modules') diff --git a/modules/pacman b/modules/pacman index 8db3b97..5668cfa 160000 --- a/modules/pacman +++ b/modules/pacman @@ -1 +1 @@ -Subproject commit 8db3b97081230d5d89f8f1467eec05bf19b03f3c +Subproject commit 5668cfa6dff56d5965ab2143fd0aeb322518d9c8 -- cgit v1.2.3 From f7d7967b445e59a46b3c2546c10eb9cc48ea42a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Mon, 19 Mar 2018 20:32:45 +0100 Subject: Add missing package for backup --- modules/role/manifests/backup.pp | 2 ++ 1 file changed, 2 insertions(+) (limited to 'modules') diff --git a/modules/role/manifests/backup.pp b/modules/role/manifests/backup.pp index d7ba486..7a0c275 100644 --- a/modules/role/manifests/backup.pp +++ b/modules/role/manifests/backup.pp @@ -14,6 +14,8 @@ class role::backup ( include "profile::xmr_stak" include "profile::known_hosts" + ensure_packages(["rsync"]) + ssh_keygen { $user: notify => Notify_refresh["notify-backup-sshkey-change"] } -- cgit v1.2.3