Puppet Class: profile::mediawiki::deployment::server

Defined in:
modules/profile/manifests/mediawiki/deployment/server.pp

Overview

Class profile::mediawiki::deployment::server

Sets up scap and the corresponding apache site, and rsync daemon.

filtertags: labs-project-deployment-prep labs-project-devtools labs-project-striker

Parameters:

  • apache_fqdn (Any) (defaults to: hiera('apache_fqdn', $::fqdn))
  • deployment_group (Any) (defaults to: hiera('deployment_group', 'wikidev'))
  • deployment_server (Any) (defaults to: hiera('deployment_server'))
  • main_deployment_server (Any) (defaults to: hiera('scap::deployment_server'))
  • base_path (Any) (defaults to: hiera('base_path', '/srv/deployment'))
  • deployment_hosts (Array[String]) (defaults to: hiera('deployment_hosts', []))
  • rsync_host (Stdlib::Host) (defaults to: lookup('profile::mediawiki::deployment::server::rsync_host'))
  • statsd (String) (defaults to: lookup('statsd'))
  • sources (Hash[String, Struct[{ 'origin' => Optional[String], 'repository' => Optional[String], 'scap_repository' => Optional[String] }]]) (defaults to: hiera('scap::sources'))


6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
# File 'modules/profile/manifests/mediawiki/deployment/server.pp', line 6

class profile::mediawiki::deployment::server(
    $apache_fqdn = hiera('apache_fqdn', $::fqdn),
    $deployment_group = hiera('deployment_group', 'wikidev'),
    $deployment_server = hiera('deployment_server'),
    $main_deployment_server = hiera('scap::deployment_server'),
    $base_path = hiera('base_path', '/srv/deployment'),
    Array[String] $deployment_hosts = hiera('deployment_hosts', []),
    Stdlib::Host $rsync_host = lookup('profile::mediawiki::deployment::server::rsync_host'),
    String $statsd = lookup('statsd'),
    Hash[String, Struct[{
                        'origin'          => Optional[String],
                        'repository'      => Optional[String],
                        'scap_repository' => Optional[String]
    }]] $sources  = hiera('scap::sources'),
) {
    # Class scap gets included via profile::mediawiki::common
    # Also a lot of needed things are called from there.
    require profile::mediawiki::common

    include network::constants
    $deployable_networks = $::network::constants::deployable_networks
    $deployable_networks_ferm = join($deployable_networks, ' ')
    # Install the scap master
    class { 'rsync::server': }

    class { '::scap::master':
        deployment_hosts => $deployment_hosts,
    }

    class { '::scap::scripts':
        rsync_host  => $rsync_host,
        sql_scripts => 'present',
        statsd      => $statsd,
    }

    # Create an instance of scap_source for each of the key specs in hiera.

    Scap::Source {
        base_path => $base_path,
    }

    $sources.each |$repo, $params| {
        scap::source { $repo:
            * => $params
        }
    }

    ## End scap config ###

    class {'::deployment::umask_wikidev': }

    class { '::deployment::deployment_server':
        deployment_group => $deployment_group,
    }

    class {'::httpd': }

    require_package('mysql-client')

    ferm::service { 'rsyncd_scap_master':
        proto  => 'tcp',
        port   => '873',
        srange => '$MW_APPSERVER_NETWORKS',
    }


    # T113351
    ferm::service { 'http_deployment_server':
        desc   => 'HTTP on deployment servers, for serving actual files to deploy',
        proto  => 'tcp',
        port   => '80',
        srange => "(${deployable_networks_ferm})",
    }

    ### End firewall rules

    #T83854
    ::monitoring::icinga::git_merge { 'mediawiki_config':
        dir           => '/srv/mediawiki-staging/',
        user          => 'root',
        remote        => 'readonly',
        remote_branch => 'master',
    }

    # Also make sure that no files have been stolen by root ;-)
    ::monitoring::icinga::bad_directory_owner { '/srv/mediawiki-staging': }

    # A command that group 'deployment' can execute to fix common file permission snafus
    # inside /srv/mediawiki-staging.
    file { '/usr/local/sbin/fix-staging-perms':
        mode   => '0555',
        source => 'puppet:///modules/profile/mediawiki/deployment/fix-staging-perms.sh',
        owner  => 'root',
        group  => 'root',
    }

    file { '/srv/deployment':
        ensure => directory,
        owner  => 'trebuchet',
        group  => $deployment_group,
    }

    httpd::site { 'deployment':
        content => template('role/deployment/apache-vhost.erb'),
        require => File['/srv/deployment'],
    }

    $deploy_ensure = $deployment_server ? {
        $::fqdn => 'absent',
        default => 'present'
    }

    class { '::deployment::rsync':
        deployment_server => $deployment_server,
        cron_ensure       => $deploy_ensure,
        deployment_hosts  => $deployment_hosts,
    }

    motd::script { 'inactive_warning':
        ensure   => $deploy_ensure,
        priority => 1,
        content  => template('role/deployment/inactive.motd.erb'),
    }

    if $deploy_ensure == 'present' {
        # Lock the passive servers, leave untouched the active one.
        file { '/var/lock/scap-global-lock':
            ensure  => 'present',
            owner   => 'root',
            group   => 'root',
            content => "Not the active deployment server, use ${main_deployment_server}",
        }
    }

    # Bacula backups (T125527)
    backup::set { 'srv-deployment': }

    # tig is a ncurses-based git utility which is useful for
    #   determining the state of git repos during deployments.
    # php-readline T126262
    require_package('percona-toolkit', 'tig', 'php-readline')

    # benchmarking tools for sessionstorage testing (T230178)
    require_package('siege', 'wrk', 'lua-cjson')
}