Defined Type: service::uwsgi

Defined in:

modules/service/manifests/uwsgi.pp

Overview

sudo_rules

An array of string representing sudo rules in the sudoers format that you want the service to have. Default: empty array

contact_groups

Contact groups for alerting. Default: hiera('contactgroups', 'admins') - use 'contactgroups' hiera

variable with a fallback to 'admins' if 'contactgroups' isn't set.

add_logging_config

Boolean. Inject logging configuration into the generated uwsgi config file that will route logs to the Logstash ingest host defined in service::configuration::logstash_host and optionally local files if $local_logging is true. Default: true

core_limit

This setting adds the LimitCore functionality of the uwsgi's systemd unit. Useful when segfaults are happening regularly and a more detailed report is needed. Values: 'unlimited', 'nG' (n is a number of Gigabytes), or '0' for no core. Default: '0'

Examples

service::uwsgi { 'myservice':
    port   => 8520,
    config => {
       'wsgi-file' => "/path/to/wsgi_file"
       chdir       => "path_to_dir",
       venv        => "path_to_virtualenv",
       param1 => 'val1',
       param2 => $myvar
    },
}

Parameters:

• port (Any)
• config (Any) (defaults to: undef)
• no_workers (Any) (defaults to: $::processorcount)
• healthcheck_url (Any) (defaults to: '/_info')
• has_spec (Any) (defaults to: false)
• repo (Any) (defaults to: "${title}/deploy")
• firejail (Any) (defaults to: true)
• icinga_check (Any) (defaults to: true)
• local_logging (Any) (defaults to: true)
• deployment_user (Any) (defaults to: 'deploy-service')
• deployment_manage_user (Any) (defaults to: true)
• deployment (Any) (defaults to: 'scap3')
• sudo_rules (Any) (defaults to: [])
• contact_groups (Any) (defaults to: hiera('contactgroups', 'admins'))
• add_logging_config (Any) (defaults to: true)
• core_limit (Any) (defaults to: '0')

# File 'modules/service/manifests/uwsgi.pp', line 92

define service::uwsgi(
    $port,
    $config                 = undef,
    $no_workers             = $::processorcount,
    $healthcheck_url        = '/_info',
    $has_spec               = false,
    $repo                   = "${title}/deploy",
    $firejail               = true,
    $icinga_check           = true,
    $local_logging          = true,
    $deployment_user        = 'deploy-service',
    $deployment_manage_user = true,
    $deployment             = 'scap3',
    $sudo_rules             = [],
    $contact_groups         = hiera('contactgroups', 'admins'),
    $add_logging_config     = true,
    $core_limit             = '0',
) {
    if $deployment == 'scap3' {
        scap::target { $repo:
            service_name => $title,
            deploy_user  => $deployment_user,
            before       => Uwsgi::App[$title],
            manage_user  => $deployment_manage_user,
            sudo_rules   => $sudo_rules,
        }
    }

    # Import all common configuration
    include service::configuration

    # we do not allow empty names
    unless $title and size($title) > 0 {
        fail('No name for this resource given!')
    }

    # sanity check since a default port cannot be assigned
    unless $port {
        fail('Service port must be specified!')
    }
    validate_numeric($port)

    # the local log file name
    $local_logdir = "${service::configuration::log_dir}/${title}"
    $local_logfile = "${local_logdir}/main.log"

    if $add_logging_config {
      if $local_logging {
          ensure_resource('file', '/srv/log', {'ensure' => 'directory' })
          file { $local_logdir:
              ensure => directory,
              owner  => 'www-data',
              group  => 'root',
              mode   => '0755',
              before => Uwsgi::App[$title],
          }
          logrotate::conf { $title:
              ensure  => present,
              content => template('service/logrotate.uwsgi.erb'),
          }
          $log_config_local = {
              log-route => ['local .*', 'logstash .*'],
              logger    => [
                  "local file:${local_logfile}",
                  "logstash socket:${service::configuration::logstash_host}:11514",
              ]
          }
      } else {
          $log_config_local = {
              log-route => ['logstash .*'],
              logger    => [
                  "logstash socket:${service::configuration::logstash_host}:11514",
              ]
          }
      }
      $log_config_shared = {
          log-encoder => [
              # lint:ignore:single_quote_string_with_variables
              # Add a timestamps to local log messages
              'format:local [${strftime:%%Y-%%m-%%dT%%H:%%M:%%S}] ${msgnl}',

              # Encode messages to the logstash logger as json datagrams.
              # msgpack would be nicer, but the jessie uwsgi package doesn't
              # include the msgpack formatter.
              join([
                  'json:logstash {"@timestamp":"${strftime:%%Y-%%m-%%dT%%H:%%M:%%S}","type":"',
                  $title,
                  '","logger_name":"uwsgi","host":"%h","level":"INFO","message":"${msg}"}'], '')
              #lint:endignore
          ],
      }
      $logging_config = deep_merge($log_config_shared, $log_config_local)
    } else {
      # Use the default log routing of uwsgi which will emit events to
      # stdout/stderr with no special formatting. journald will add
      # timestamps.
      $logging_config = {}
    }

    if !defined(File["/etc/${title}"]) {
        file { "/etc/${title}":
            ensure => directory,
            owner  => 'root',
            group  => 'root',
            mode   => '0755',
        }
    }

    $base_config = {
        plugins     => 'python, python3, logfile, logsocket',
        master      => true,
        http-socket => "0.0.0.0:${port}",
        processes   => $no_workers,
        die-on-term => true,
    }
    $complete_config = deep_merge($base_config, $logging_config, $config)

    # TODO: firejail for containment. Not used yet, but the idea is to add it
    require_package('firejail')

    uwsgi::app { $title:
        core_limit => $core_limit,
        settings   => {
            uwsgi => $complete_config,
        }
    }

    if $icinga_check {
        if $has_spec {
            # Advanced monitoring
            include service::monitoring

            $monitor_url = "http://${::ipaddress}:${port}${healthcheck_url}"
            nrpe::monitor_service{ "endpoints_${title}":
                description   => "${title} endpoints health",
                nrpe_command  => "/usr/bin/service-checker-swagger -t 5 ${::ipaddress} ${monitor_url}",
                contact_group => $contact_groups,
            }
            # we also support smart-releases
            # TODO: Enable has_autorestart
            service::deployment_script { $name:
                monitor_url     => $monitor_url,
            }
        } else {
            # Basic monitoring
            monitoring::service { $title:
                description   => $title,
                check_command => "check_http_port_url!${port}!${healthcheck_url}",
                contact_group => $contact_groups,
                notes_url     => "https://wikitech.wikimedia.org/wiki/Services/Monitoring/${title}",
            }
        }
    }
}