diff --git a/manifests/apache/common.pp b/manifests/apache/common.pp new file mode 100644 index 0000000..f1c5ab2 --- /dev/null +++ b/manifests/apache/common.pp @@ -0,0 +1,4 @@ +class profile::apache::common { + include ::apache + include ::apache::mod::status +} diff --git a/manifests/apache/mod_proxy_fcgi.pp b/manifests/apache/mod_proxy_fcgi.pp index a79bccd..2d2953b 100644 --- a/manifests/apache/mod_proxy_fcgi.pp +++ b/manifests/apache/mod_proxy_fcgi.pp @@ -1,4 +1,5 @@ # Profile for apache mod proxy fcgi class profile::apache::mod_proxy_fcgi { - ::apache::mod {'proxy_fcgi':} + include ::profile::apache::common + ::apache::mod {'proxy_fcgi':} } diff --git a/manifests/apache/rewrite_domains.pp b/manifests/apache/rewrite_domains.pp index be88307..e78e210 100644 --- a/manifests/apache/rewrite_domains.pp +++ b/manifests/apache/rewrite_domains.pp @@ -1,46 +1,46 @@ # Simple apache domain rewriting class profile::apache::rewrite_domains { - include ::apache + include ::profile::apache::common include ::profile::ssl $ssl_protocol = hiera('apache::ssl_protocol') $ssl_honorcipherorder = hiera('apache::ssl_honorcipherorder') $ssl_cipher = hiera('apache::ssl_cipher') $hsts_header = hiera('apache::hsts_header') $rewrite_domains = hiera_hash('apache::rewrite_domains') each($rewrite_domains) |$name, $data| { $ssl_cert_name = $data['ssl_cert_name'] $ssl_cert = $::profile::ssl::certificate_paths[$ssl_cert_name] $ssl_ca = $::profile::ssl::ca_paths[$ssl_cert_name] $ssl_key = $::profile::ssl::private_key_paths[$ssl_cert_name] ::apache::vhost {"${name}_non-ssl": servername => $name, port => '80', docroot => '/var/www', redirect_status => 'permanent', redirect_dest => "https://${name}/", } ::apache::vhost {"${name}_ssl": servername => $name, port => '443', ssl => true, ssl_protocol => $ssl_protocol, ssl_honorcipherorder => $ssl_honorcipherorder, ssl_cipher => $ssl_cipher, ssl_cert => $ssl_cert, ssl_ca => $ssl_ca, ssl_key => $ssl_key, headers => [$hsts_header], docroot => '/var/www', rewrites => [ { rewrite_rule => $data['rewrites'], }, ], } } } diff --git a/manifests/apache/simple_server.pp b/manifests/apache/simple_server.pp index 75734ca..3e52ea1 100644 --- a/manifests/apache/simple_server.pp +++ b/manifests/apache/simple_server.pp @@ -1,3 +1,3 @@ class profile::apache::simple_server { - include ::apache + include ::profile::apache::common } diff --git a/manifests/munin/master.pp b/manifests/munin/master.pp index 9bf00e5..91886a2 100644 --- a/manifests/munin/master.pp +++ b/manifests/munin/master.pp @@ -1,59 +1,59 @@ # Munin master class class profile::munin::master { $master_hostname = hiera('munin::master::hostname') $master_hostname_domain = join(delete_at(split($master_hostname, '[.]'), 0), '.') $master_hostname_target = "${::hostname}.${master_hostname_domain}." class { '::munin::master': extra_config => ["cgiurl_graph http://$master_hostname"], } - include ::apache + include ::profile::apache::common include ::apache::mod::rewrite include ::apache::mod::fcgid apache::vhost { $master_hostname: port => 80, docroot => '/var/www/html', rewrites => [ { comment => 'static resources', rewrite_rule => [ '^/favicon.ico /etc/munin/static/favicon.ico [L]', '^/static/(.*) /etc/munin/static/$1 [L]', ], }, { comment => 'HTML', rewrite_cond => [ '%{REQUEST_URI} .html$ [or]', '%{REQUEST_URI} =/', ], rewrite_rule => [ '^/(.*) /usr/lib/munin/cgi/munin-cgi-html/$1 [L]', ], }, { comment => 'Images', rewrite_rule => [ '^/munin-cgi/munin-cgi-graph/(.*) /usr/lib/munin/cgi/munin-cgi-graph/$1 [L]', '^/(.*) /usr/lib/munin/cgi/munin-cgi-graph/$1 [L]', ], }, ], directories => [ { 'path' => '/usr/lib/munin/cgi', 'options' => '+ExecCGI', 'sethandler' => 'fcgid-script' }, ], } $bind_key = hiera('bind::update_key') @@resource_record { 'munin/CNAME': record => $master_hostname, type => 'CNAME', data => $master_hostname_target, keyfile => "/etc/bind/keys/${bind_key}", } } diff --git a/manifests/munin/stats_export.pp b/manifests/munin/stats_export.pp index 96487af..17d88e8 100644 --- a/manifests/munin/stats_export.pp +++ b/manifests/munin/stats_export.pp @@ -1,84 +1,84 @@ # stats_export master class class profile::munin::stats_export { $vhost_name = hiera('stats_export::vhost::name') $vhost_docroot = hiera('stats_export::vhost::docroot') $vhost_ssl_protocol = hiera('stats_export::vhost::ssl_protocol') $vhost_ssl_honorcipherorder = hiera('stats_export::vhost::ssl_honorcipherorder') $vhost_ssl_cipher = hiera('stats_export::vhost::ssl_cipher') $vhost_hsts_header = hiera('stats_export::vhost::hsts_header') $export_file = "${vhost_docroot}/history_counters.json" $packages = ['python3-click'] package {$packages: ensure => present, } file {'/usr/local/bin/export-rrd': ensure => present, owner => 'root', group => 'root', mode => '0755', source => 'puppet:///modules/profile/munin/stats_export/export-rrd', require => Package[$packages], } cron {'stats_export': ensure => present, user => 'www-data', command => "/usr/local/bin/export-rrd > ${export_file}.tmp && /bin/mv ${export_file}.tmp ${export_file}", hour => fqdn_rand(24, 'stats_export_hour'), minute => fqdn_rand(60, 'stats_export_minute'), month => '*', monthday => '*', weekday => '*', require => [ File['/usr/local/bin/export-rrd'], File[$vhost_docroot], ], } file {$vhost_docroot: ensure => directory, owner => 'www-data', group => 'www-data', mode => '0755', } + include ::profile::apache::common include ::profile::ssl - include ::apache ::apache::vhost {"${vhost_name}_non-ssl": servername => $vhost_name, port => '80', docroot => $vhost_docroot, redirect_status => 'permanent', redirect_dest => "https://${vhost_name}/", } $ssl_cert_name = 'stats_export_softwareheritage_org' $ssl_cert = $::profile::ssl::certificate_paths[$ssl_cert_name] $ssl_ca = $::profile::ssl::ca_paths[$ssl_cert_name] $ssl_key = $::profile::ssl::private_key_paths[$ssl_cert_name] ::apache::vhost {"${vhost_name}_ssl": servername => $vhost_name, port => '443', ssl => true, ssl_protocol => $vhost_ssl_protocol, ssl_honorcipherorder => $vhost_ssl_honorcipherorder, ssl_cipher => $vhost_ssl_cipher, ssl_cert => $ssl_cert, ssl_ca => $ssl_ca, ssl_key => $ssl_key, headers => [$vhost_hsts_header], docroot => $vhost_docroot, require => [ File[$ssl_cert], File[$ssl_ca], File[$ssl_key], ], } } diff --git a/manifests/phabricator.pp b/manifests/phabricator.pp index d5b2840..24b322a 100644 --- a/manifests/phabricator.pp +++ b/manifests/phabricator.pp @@ -1,276 +1,276 @@ # Setup an instance of phabricator class profile::phabricator { $phabricator_basepath = hiera('phabricator::basepath') $phabricator_user = hiera('phabricator::user') $phabricator_vcs_user = hiera('phabricator::vcs_user') $phabricator_db_root_password = hiera('phabricator::mysql::root_password') $phabricator_db_basename = hiera('phabricator::mysql::database_prefix') $phabricator_db_user = hiera('phabricator::mysql::username') $phabricator_db_password = hiera('phabricator::mysql::password') $phabricator_db_max_allowed_packet = hiera('phabricator::mysql::conf::max_allowed_packet') $phabricator_db_sql_mode = hiera('phabricator::mysql::conf::sql_mode') $phabricator_db_ft_stopword_file = hiera('phabricator::mysql::conf::ft_stopword_file') $phabricator_db_ft_min_word_len = hiera('phabricator::mysql::conf::ft_min_word_len') $phabricator_db_ft_boolean_syntax = hiera('phabricator::mysql::conf::ft_boolean_syntax') $phabricator_db_innodb_buffer_pool_size = hiera('phabricator::mysql::conf::innodb_buffer_pool_size') $phabricator_db_innodb_file_per_table = hiera('phabricator::mysql::conf::innodb_file_per_table') $phabricator_db_innodb_flush_method = hiera('phabricator::mysql::conf::innodb_flush_method') $phabricator_db_innodb_log_file_size = hiera('phabricator::mysql::conf::innodb_log_file_size') $phabricator_fpm_listen = hiera('phabricator::php::fpm_listen') $phabricator_max_size = hiera('phabricator::php::max_file_size') $phabricator_opcache_validate_timestamps = hiera('phabricator::php::opcache_validate_timestamps') $phabricator_notification_listen = hiera('phabricator::notification::listen') $phabricator_notification_client_host = hiera('phabricator::notification::client_host') $phabricator_notification_client_port = hiera('phabricator::notification::client_port') $phabricator_vhost_name = hiera('phabricator::vhost::name') $phabricator_vhost_docroot = hiera('phabricator::vhost::docroot') $phabricator_vhost_basic_auth_file = "${phabricator_basepath}/http_auth" $phabricator_vhost_basic_auth_content = hiera('phabricator::vhost::basic_auth_content') $phabricator_vhost_ssl_protocol = hiera('phabricator::vhost::ssl_protocol') $phabricator_vhost_ssl_honorcipherorder = hiera('phabricator::vhost::ssl_honorcipherorder') $phabricator_vhost_ssl_cipher = hiera('phabricator::vhost::ssl_cipher') $phabricator_vhost_hsts_header = hiera('phabricator::vhost::hsts_header') include ::systemd $homedirs = { $phabricator_user => $phabricator_basepath, $phabricator_vcs_user => "${phabricator_basepath}/vcshome", } $homedir_modes = { $phabricator_user => '0644', $phabricator_vcs_user => '0640', } each([$phabricator_user, $phabricator_vcs_user]) |$name| { user {$name: ensure => present, system => true, shell => '/bin/bash', home => $homedirs[$name], } file {$homedirs[$name]: ensure => directory, owner => $name, group => $name, mode => $homedir_modes[$name], } } ::sudo::conf {'phabricator-ssh': ensure => present, content => "${phabricator_vcs_user} ALL=(${phabricator_user}) SETENV: NOPASSWD: /usr/bin/git-upload-pack, /usr/bin/git-receive-pack, /usr/bin/hg", } ::sudo::conf {'phabricator-http': ensure => present, content => "www-data ALL=(${phabricator_user}) SETENV: NOPASSWD: /usr/bin/git-http-backend, /usr/bin/hg", require => File['/usr/bin/git-http-backend'], } file {'/usr/bin/git-http-backend': ensure => link, target => '/usr/lib/git-core/git-http-backend', } $phabricator_ssh_hook = '/usr/bin/phabricator-ssh-hook.sh' $phabricator_ssh_config = '/etc/ssh/ssh_config.phabricator' file {$phabricator_ssh_hook: ensure => present, owner => 'root', group => 'root', mode => '0755', content => template('profile/phabricator/phabricator-ssh-hook.sh.erb'), } file {$phabricator_ssh_config: ensure => present, owner => 'root', group => 'root', mode => '0600', content => template('profile/phabricator/sshd_config.phabricator.erb'), require => File[$phabricator_ssh_hook], } file {'/etc/systemd/system/phabricator-sshd.service': ensure => present, owner => 'root', group => 'root', mode => '0644', content => template('profile/phabricator/phabricator-sshd.service.erb'), notify => Exec['systemd-daemon-reload'], require => File[$phabricator_ssh_config], } service {'phabricator-sshd': ensure => 'running', enable => true, require => [ File['/etc/systemd/system/phabricator-sshd.service'], Exec['systemd-daemon-reload'], ], } include ::mysql::client class {'::mysql::server': root_password => $phabricator_db_root_password, override_options => { mysqld => { max_allowed_packet => $phabricator_db_max_allowed_packet, sql_mode => $phabricator_db_sql_mode, ft_stopword_file => $phabricator_db_ft_stopword_file, ft_min_word_len => $phabricator_db_ft_min_word_len, ft_boolean_syntax => $phabricator_db_ft_boolean_syntax, innodb_buffer_pool_size => $phabricator_db_innodb_buffer_pool_size, innodb_file_per_table => $phabricator_db_innodb_file_per_table, innodb_flush_method => $phabricator_db_innodb_flush_method, innodb_log_file_size => $phabricator_db_innodb_log_file_size, } } } $mysql_username = "${phabricator_db_user}@localhost" $mysql_tables = "${phabricator_db_basename}_%.*" mysql_user {$mysql_username: ensure => present, password_hash => mysql_password($phabricator_db_password), } mysql_grant {"${mysql_username}/${mysql_tables}": user => $mysql_username, table => $mysql_tables, privileges => ['ALL'], require => Mysql_user[$mysql_username], } include ::php::cli include ::php::fpm::daemon ::php::ini {'/etc/php5/cli/php.ini':} ::php::fpm::conf {'phabricator': listen => $phabricator_fpm_listen, user => 'www-data', php_admin_value => { post_max_size => $phabricator_max_size, upload_max_filesize => $phabricator_max_size, 'opcache.validate_timestamps' => $phabricator_opcache_validate_timestamps, }, } ::php::module {[ 'apcu', 'curl', 'gd', 'mailparse', 'mysql', ]: } include ::profile::ssl - include ::apache + include ::profile::apache::common include ::apache::mod::proxy include ::profile::apache::mod_proxy_fcgi ::apache::mod {'proxy_wstunnel':} ::apache::vhost {"${phabricator_vhost_name}_non-ssl": servername => $phabricator_vhost_name, port => '80', docroot => $phabricator_vhost_docroot, redirect_status => 'permanent', redirect_dest => "https://${phabricator_vhost_name}/", } $ssl_cert_name = 'star_softwareheritage_org' $ssl_cert = $::profile::ssl::certificate_paths[$ssl_cert_name] $ssl_ca = $::profile::ssl::ca_paths[$ssl_cert_name] $ssl_key = $::profile::ssl::private_key_paths[$ssl_cert_name] ::apache::vhost {"${phabricator_vhost_name}_ssl": servername => $phabricator_vhost_name, port => '443', ssl => true, ssl_protocol => $phabricator_vhost_ssl_protocol, ssl_honorcipherorder => $phabricator_vhost_ssl_honorcipherorder, ssl_cipher => $phabricator_vhost_ssl_cipher, ssl_cert => $ssl_cert, ssl_ca => $ssl_ca, ssl_key => $ssl_key, headers => [$phabricator_vhost_hsts_header], docroot => $phabricator_vhost_docroot, rewrites => [ { rewrite_rule => '^/rsrc/(.*) - [L,QSA]' }, { rewrite_rule => '^/favicon.ico - [L,QSA]' }, { rewrite_rule => "^/ws/(.*)$ ws://${phabricator_notification_listen}/\$1 [L,P]" }, { rewrite_rule => "^(.*)$ fcgi://${phabricator_fpm_listen}${phabricator_vhost_docroot}/index.php?__path__=\$1 [B,L,P,QSA]" }, ], require => [ File[$ssl_cert], File[$ssl_ca], File[$ssl_key], ], } file {$phabricator_vhost_basic_auth_file: ensure => absent, } # Uses: # $phabricator_basepath # $phabricator_user file {'/etc/systemd/system/phabricator-phd.service': ensure => present, owner => 'root', group => 'root', mode => '0644', content => template('profile/phabricator/phabricator-phd.service.erb'), notify => Exec['systemd-daemon-reload'], } service {'phabricator-phd': ensure => 'running', enable => true, require => [ File['/etc/systemd/system/phabricator-phd.service'], Exec['systemd-daemon-reload'], ], } # Uses: # $phabricator_basepath # $phabricator_user # $phabricator_notification_* file {'/etc/systemd/system/phabricator-aphlict.service': ensure => present, owner => 'root', group => 'root', mode => '0644', content => template('profile/phabricator/phabricator-aphlict.service.erb'), notify => Exec['systemd-daemon-reload'], } service {'phabricator-aphlict': ensure => 'running', enable => true, require => [ File['/etc/systemd/system/phabricator-aphlict.service'], Exec['systemd-daemon-reload'], ], } package {'python-pygments': ensure => installed, } } diff --git a/manifests/swh/deploy/webapp.pp b/manifests/swh/deploy/webapp.pp index 9a5aca7..deed6af 100644 --- a/manifests/swh/deploy/webapp.pp +++ b/manifests/swh/deploy/webapp.pp @@ -1,184 +1,184 @@ # WebApp deployment class profile::swh::deploy::webapp { $conf_directory = hiera('swh::deploy::webapp::conf_directory') $conf_file = hiera('swh::deploy::webapp::conf_file') $user = hiera('swh::deploy::webapp::user') $group = hiera('swh::deploy::webapp::group') $conf_storage_class = hiera('swh::deploy::webapp::conf::storage_class') $conf_storage_args = hiera('swh::deploy::webapp::conf::storage_args') $conf_log_dir = hiera('swh::deploy::webapp::conf::log_dir') $conf_secret_key = hiera('swh::deploy::webapp::conf::secret_key') $uwsgi_listen_address = hiera('swh::deploy::webapp::uwsgi::listen') $uwsgi_protocol = hiera('swh::deploy::webapp::uwsgi::protocol') $uwsgi_workers = hiera('swh::deploy::webapp::uwsgi::workers') $uwsgi_max_requests = hiera('swh::deploy::webapp::uwsgi::max_requests') $uwsgi_max_requests_delta = hiera('swh::deploy::webapp::uwsgi::max_requests_delta') $uwsgi_reload_mercy = hiera('swh::deploy::webapp::uwsgi::reload_mercy') $swh_packages = ['python3-swh.web.ui'] $vhost_name = hiera('swh::deploy::webapp::vhost::name') $vhost_aliases = hiera('swh::deploy::webapp::vhost::aliases') $vhost_docroot = hiera('swh::deploy::webapp::vhost::docroot') $vhost_basic_auth_file = "${conf_directory}/http_auth" $vhost_basic_auth_content = hiera('swh::deploy::webapp::vhost::basic_auth_content') $vhost_ssl_protocol = hiera('swh::deploy::webapp::vhost::ssl_protocol') $vhost_ssl_honorcipherorder = hiera('swh::deploy::webapp::vhost::ssl_honorcipherorder') $vhost_ssl_cipher = hiera('swh::deploy::webapp::vhost::ssl_cipher') $open_endpoints = hiera_array('swh::deploy::webapp::open_endpoints') $endpoint_directories = $open_endpoints.map |$endpoint| { { path => $endpoint, provider => 'location', allow => 'from all', satisfy => 'Any', headers => ['add Access-Control-Allow-Origin "*"'], } } include ::uwsgi package {$swh_packages: ensure => latest, require => Apt::Source['softwareheritage'], notify => [ Service['uwsgi'], Exec['update-static'], ], } file {$conf_directory: ensure => directory, owner => 'root', group => $group, mode => '0755', } file {$conf_log_dir: ensure => directory, owner => 'root', group => $group, mode => '0770', } file {$vhost_docroot: ensure => directory, owner => 'root', group => $group, mode => '0755', } file {$conf_file: ensure => present, owner => 'root', group => $group, mode => '0640', content => template('profile/swh/deploy/webapp/webapp.ini.erb'), notify => Service['uwsgi'], } ::uwsgi::site {'swh-webapp': ensure => enabled, settings => { plugin => 'python3', protocol => $uwsgi_protocol, socket => $uwsgi_listen_address, workers => $uwsgi_workers, max_requests => $uwsgi_max_requests, max_requests_delta => $uwsgi_max_requests_delta, worker_reload_mercy => $uwsgi_reload_mercy, reload_mercy => $uwsgi_reload_mercy, uid => $user, gid => $user, umask => '022', module => 'swh.web.ui.main', callable => 'run_from_webserver', } } exec {'update-static': path => ['/bin', '/usr/bin'], command => "rsync -az --delete /usr/lib/python3/dist-packages/swh/web/ui/static/ ${vhost_docroot}/static/", refreshonly => true, require => [ File[$vhost_docroot], Package[$swh_packages], ], } include ::profile::ssl - include ::apache + include ::profile::apache::common include ::apache::mod::proxy include ::apache::mod::headers ::apache::mod {'proxy_uwsgi':} ::apache::vhost {"${vhost_name}_non-ssl": servername => $vhost_name, serveraliases => $vhost_aliases, port => '80', docroot => $vhost_docroot, redirect_status => 'permanent', redirect_dest => "https://${vhost_name}/", } $ssl_cert_name = 'star_softwareheritage_org' $ssl_cert = $::profile::ssl::certificate_paths[$ssl_cert_name] $ssl_ca = $::profile::ssl::ca_paths[$ssl_cert_name] $ssl_key = $::profile::ssl::private_key_paths[$ssl_cert_name] ::apache::vhost {"${vhost_name}_ssl": servername => $vhost_name, serveraliases => $vhost_aliases, port => '443', ssl => true, ssl_protocol => $vhost_ssl_protocol, ssl_honorcipherorder => $vhost_ssl_honorcipherorder, ssl_cipher => $vhost_ssl_cipher, ssl_cert => $ssl_cert, ssl_ca => $ssl_ca, ssl_key => $ssl_key, docroot => $vhost_docroot, proxy_pass => [ { path => '/static', url => '!', }, { path => '/favicon.ico', url => '!', }, { path => '/', url => "uwsgi://${uwsgi_listen_address}/", }, ], directories => [ { path => '/', provider => 'location', auth_type => 'Basic', auth_name => 'Software Heritage development', auth_user_file => $vhost_basic_auth_file, auth_require => 'valid-user', }, { path => "${vhost_docroot}/static", options => ['-Indexes'], }, ] + $endpoint_directories, require => [ File[$vhost_basic_auth_file], File[$ssl_cert], File[$ssl_ca], File[$ssl_key], Exec['update-static'], ], } file {$vhost_basic_auth_file: ensure => present, owner => 'root', group => 'www-data', mode => '0640', content => $vhost_basic_auth_content, } }