Puppet Class: profile::mediawiki::common

Defined in:
modules/profile/manifests/mediawiki/common.pp

Overview

Parameters:

  • logstash_host (Any) (defaults to: hiera('logstash_host'))
  • logstash_syslog_port (Any) (defaults to: hiera('logstash_syslog_port'))
  • log_aggregator (Any) (defaults to: hiera('udp2log_aggregator'))
  • php_version (Any) (defaults to: lookup('profile::mediawiki::php::php_version', {'default_value' => undef}))
  • php_restarts (Any) (defaults to: lookup('profile::mediawiki::php::restarts::ensure', {'default_value' => undef}))


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
# File 'modules/profile/manifests/mediawiki/common.pp', line 1

class profile::mediawiki::common(
    $logstash_host = hiera('logstash_host'),
    $logstash_syslog_port = hiera('logstash_syslog_port'),
    $log_aggregator = hiera('udp2log_aggregator'),
    $php_version = lookup('profile::mediawiki::php::php_version', {'default_value' => undef}),
    $php_restarts = lookup('profile::mediawiki::php::restarts::ensure', {'default_value' => undef})
){

    # GeoIP is needed for MW
    class { '::geoip': }

    # Enable systemd coredump on all servers running mediawiki
    # Whether php7 will produce coredumps is configurable through
    # rlimit_core in php.ini. Coredumps will be found under
    # /var/lib/systemd/coredump
    class { '::systemd::coredump':
        ensure => present,
    }

    # Configure cgroups used by MediaWiki
    class { '::mediawiki::cgroup': }
    # Install all basic support packages for MediaWiki
    class { '::mediawiki::packages': }
    # Install the users needed for MediaWiki
    if $php_restarts {
        class { '::mediawiki::users':
            web              => 'www-data',
            extra_privileges => [
              "ALL = (root) NOPASSWD: /usr/local/sbin/check-and-restart-php php${php_version}-fpm *",
            ]
        }
    } else {
        class { '::mediawiki::users':
            web => 'www-data'
        }
    }
    # Install scap
    include ::profile::mediawiki::scap_client
    # Monitor mediawiki versions (T242023)
    include ::profile::mediawiki::monitor_versions

    class { '::mediawiki::syslog':
        log_aggregator => $log_aggregator,
    }

    include ::profile::rsyslog::udp_localhost_compat
    include ::profile::mediawiki::php

    # furl is a cURL-like command-line tool for making FastCGI requests.
    # See `furl --help` for documentation and usage.

    file { '/usr/local/bin/furl':
        source => 'puppet:///modules/mediawiki/furl',
        owner  => 'root',
        group  => 'root',
        mode   => '0555',
    }


    file { '/usr/local/bin/mediawiki-firejail-convert':
        source => 'puppet:///modules/mediawiki/mediawiki-firejail-convert.py',
        owner  => 'root',
        group  => 'root',
        mode   => '0555',
    }

    file { '/etc/firejail/mediawiki-converters.profile':
        source => 'puppet:///modules/mediawiki/mediawiki-converters.profile',
        owner  => 'root',
        group  => 'root',
        mode   => '0644',
    }

    file { '/usr/local/bin/mediawiki-firejail-ghostscript':
        source => 'puppet:///modules/mediawiki/mediawiki-firejail-ghostscript.py',
        owner  => 'root',
        group  => 'root',
        mode   => '0555',
    }

    # /var/log/mediawiki contains log files for the MediaWiki jobrunner
    # and for various periodic jobs that are managed by cron.
    file { '/var/log/mediawiki':
        ensure => directory,
        owner  => $::mediawiki::users::web,
        group  => 'wikidev',
        mode   => '0644',
    }

    # Script to use for decommissioning a machine and move it to role::system::spare
    file { '/root/decommission_appserver':
        ensure => present,
        owner  => 'root',
        group  => 'root',
        mode   => '0500',
        source => 'puppet:///modules/mediawiki/decommission_appserver.sh',
    }


    # TODO: move to profile::mediawiki::webserver ?
    ferm::service{ 'ssh_pybal':
        proto  => 'tcp',
        port   => '22',
        srange => '$PRODUCTION_NETWORKS',
        desc   => 'Allow incoming SSH for pybal health checks',
    }

    # Allow sockets in TIME_WAIT state to be re-used.
    # This helps prevent exhaustion of ephemeral port or conntrack sessions.
    # See <http://vincent.bernat.im/en/blog/2014-tcp-time-wait-state-linux.html>
    sysctl::parameters { 'tcp_tw_reuse':
        values => { 'net.ipv4.tcp_tw_reuse' => 1 },
    }

    monitoring::service { 'mediawiki-installation DSH group':
        description    => 'mediawiki-installation DSH group',
        check_command  => 'check_dsh_groups!mediawiki-installation',
        check_interval => 60,
        notes_url      => 'https://wikitech.wikimedia.org/wiki/Monitoring/check_dsh_groups',
    }

}