bebox 0.0.1

data/lib/templates/puppet/step-1/modules/users/manifests/init.pp

@@ -0,0 +1,15 @@
+class users {
+
+  $hiera_users = hiera("user_accounts")
+  each($hiera_users) |$value| {
+    $name = $value[name]
+    $email = $value[email]
+    $uid = $value[uid]
+    $key = $value[key]
+    users::user { $name:
+      uid => $uid,
+      email => $email,
+      key => $key,
+    }
+  }
+}

data/lib/templates/puppet/step-1/modules/users/manifests/user.pp

@@ -0,0 +1,49 @@
+
+define users::user($email, $uid, $key)  {
+  $username = $title
+
+  $groups = ["root", "sudo"]
+
+  user { $username:
+    ensure     => present,
+    comment    => "${email}",
+    home       => "/home/${username}",
+    shell      => "/bin/bash",
+    groups     => $groups,
+    membership => "inclusive",
+    uid        => $uid,
+    managehome => true,
+    # Generated from openssl passwd -1 in the server
+    password   => '$1$XBHr9b2v$vBpq1zI2wXljP3209xR/d.'
+  }
+
+  group { $username:
+    gid     => $uid,
+    require => User[$username],
+  }
+
+  file { "/home/${username}/":
+    ensure  => directory,
+    owner   => $username,
+    group   => $username,
+    mode    => 0644,
+    require => [ User[$username], Group[$username] ]
+  }
+
+  file { "/home/${username}/.ssh":
+    ensure  => directory,
+    owner   => $username,
+    group   => $username,
+    mode    => 0600,
+    require => File["/home/${username}/"],
+  }
+
+  file { "/home/${username}/.ssh/authorized_keys":
+    ensure  => present,
+    owner   => $username,
+    group   => $username,
+    mode    => 0600,
+    require => File["/home/${username}/.ssh"],
+    content => $key,
+  }
+}

data/lib/templates/puppet/step-2/Puppetfile.erb

@@ -0,0 +1,5 @@
+forge "https://forgeapi.puppetlabs.com"
+
+<% profile_modules.each do |puppet_module| %>
+<%="#{puppet_module}\n"%>
+<% end %>

data/lib/templates/puppet/step-2/hiera/data/common.yaml.erb

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/lib/templates/puppet/step-2/hiera/data/environment.yaml.erb

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/lib/templates/puppet/step-2/hiera/data/node.yaml.erb

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/lib/templates/puppet/step-2/hiera/hiera.yaml.erb

@@ -0,0 +1,11 @@
+# Important note: This file is empty.
+# /etc/puppet/hiera.yml is used by default.
+# deploy_user and deploy_environment is set in the puppet apply command executed by capistrano
+:backends: yaml
+:yaml:
+  :datadir: %{::deploy_to}/current/steps/<%=step_dir%>/hiera/data
+:hierarchy:
+  - %{::fqdn}
+  - %{::deploy_environment}
+  - common
+:logger: console

data/lib/templates/puppet/step-2/manifests/node.erb

@@ -0,0 +1,3 @@
+node <%= node.hostname %> {
+
+}

data/lib/templates/puppet/step-2/manifests/site.pp.erb

@@ -0,0 +1,10 @@
+# This file associates nodes with roles
+# Example:
+# node node0.server1.test {
+#   include roles::role_1
+# }
+# The roles and profiles pattern recommends to associate one node with
+# one and only one role.
+# The role can be set to the node manually or through the
+# 'bebox node set_role' command.
+

data/lib/templates/puppet/step-3/Puppetfile.erb

@@ -0,0 +1,5 @@
+forge "https://forgeapi.puppetlabs.com"
+
+<% profile_modules.each do |puppet_module| %>
+<%="#{puppet_module}\n"%>
+<% end %>

data/lib/templates/puppet/step-3/hiera/data/common.yaml.erb

@@ -0,0 +1,99 @@
+fail2ban:
+  bantime:   60
+  maxretry:  3
+  mailto: 'root@localhost'
+ssh::server:
+  password_authentication: 'no'
+  pubkey_authentication: 'yes'
+  permit_root_login: 'no'
+sysctl:
+  # IP Spoofing protection
+  'net.ipv4.conf.all.rp_filter':
+    value: '1'
+  'net.ipv4.conf.default.rp_filter':
+    value: '1'
+  # Ignore ICMP broadcast requests
+  'net.ipv4.icmp_echo_ignore_broadcasts':
+    value: '1'
+  # Disable source packet routing
+  'net.ipv4.conf.all.accept_source_route':
+    value: '0'
+  'net.ipv6.conf.all.accept_source_route':
+    value: '0'
+  'net.ipv4.conf.default.accept_source_route':
+    value: '0'
+  'net.ipv6.conf.default.accept_source_route':
+    value: '0'
+  # Ignore send redirects
+  'net.ipv4.conf.all.send_redirects':
+    value: '0'
+  'net.ipv4.conf.default.send_redirects':
+    value: '0'
+  # Block SYN attacks
+  'net.ipv4.tcp_syncookies':
+    value: '1'
+  'net.ipv4.tcp_max_syn_backlog':
+    value: '2048'
+  'net.ipv4.tcp_synack_retries':
+    value: '2'
+  'net.ipv4.tcp_syn_retries':
+    value: '5'
+  # Log Martians
+  'net.ipv4.conf.all.log_martians':
+    value: '1'
+  'net.ipv4.icmp_ignore_bogus_error_responses':
+    value: '1'
+  # Ignore ICMP redirects
+  'net.ipv4.conf.all.accept_redirects':
+    value: '0'
+  'net.ipv6.conf.all.accept_redirects':
+    value: '0'
+  'net.ipv4.conf.default.accept_redirects':
+    value: '0'
+  'net.ipv6.conf.default.accept_redirects':
+    value: '0'
+  # Ignore Directed pings
+  'net.ipv4.icmp_echo_ignore_all':
+    value: '1'
+iptables::allow_icmp: 'yes'
+iptables::allow_localhost: 'yes'
+iptables::log_failures: 'yes'
+iptables::ports:
+  22:
+    tcp: 'allow'
+  80:
+    tcp: 'allow'
+  23:
+    tcp: 'drop'
+    udp: 'drop'
+firewall:
+  '001 accept all icmp requests':
+    proto: 'icmp'
+    action: 'accept'
+  '002 allow loopback':
+    iniface: 'lo'
+    chain: 'INPUT'
+    action: 'accept'
+  '000 INPUT allow related and established':
+    state: ['RELATED', 'ESTABLISHED']
+    action: 'accept'
+    proto: 'all'
+  '100 allow ssh':
+    state: ['NEW']
+    dport: '22'
+    proto: 'tcp'
+    action: 'accept'
+  '100 allow httpd:80':
+    state: ['NEW']
+    dport: '80'
+    proto: 'tcp'
+    action: 'accept'
+  '998 deny all other requests':
+    action: 'reject'
+    proto: 'all'
+    reject: 'icmp-host-prohibited'
+  '999 deny all other requests':
+    chain: 'FORWARD'
+    action: 'reject'
+    proto: 'all'
+    reject: 'icmp-host-prohibited'

data/lib/templates/puppet/step-3/hiera/data/environment.yaml.erb

@@ -0,0 +1,99 @@
+fail2ban:
+  bantime:   60
+  maxretry:  3
+  mailto: 'root@localhost'
+ssh::server:
+  password_authentication: 'no'
+  pubkey_authentication: 'yes'
+  permit_root_login: 'no'
+sysctl:
+  # IP Spoofing protection
+  'net.ipv4.conf.all.rp_filter':
+    value: '1'
+  'net.ipv4.conf.default.rp_filter':
+    value: '1'
+  # Ignore ICMP broadcast requests
+  'net.ipv4.icmp_echo_ignore_broadcasts':
+    value: '1'
+  # Disable source packet routing
+  'net.ipv4.conf.all.accept_source_route':
+    value: '0'
+  'net.ipv6.conf.all.accept_source_route':
+    value: '0'
+  'net.ipv4.conf.default.accept_source_route':
+    value: '0'
+  'net.ipv6.conf.default.accept_source_route':
+    value: '0'
+  # Ignore send redirects
+  'net.ipv4.conf.all.send_redirects':
+    value: '0'
+  'net.ipv4.conf.default.send_redirects':
+    value: '0'
+  # Block SYN attacks
+  'net.ipv4.tcp_syncookies':
+    value: '1'
+  'net.ipv4.tcp_max_syn_backlog':
+    value: '2048'
+  'net.ipv4.tcp_synack_retries':
+    value: '2'
+  'net.ipv4.tcp_syn_retries':
+    value: '5'
+  # Log Martians
+  'net.ipv4.conf.all.log_martians':
+    value: '1'
+  'net.ipv4.icmp_ignore_bogus_error_responses':
+    value: '1'
+  # Ignore ICMP redirects
+  'net.ipv4.conf.all.accept_redirects':
+    value: '0'
+  'net.ipv6.conf.all.accept_redirects':
+    value: '0'
+  'net.ipv4.conf.default.accept_redirects':
+    value: '0'
+  'net.ipv6.conf.default.accept_redirects':
+    value: '0'
+  # Ignore Directed pings
+  'net.ipv4.icmp_echo_ignore_all':
+    value: '1'
+iptables::allow_icmp: 'yes'
+iptables::allow_localhost: 'yes'
+iptables::log_failures: 'yes'
+iptables::ports:
+  22:
+    tcp: 'allow'
+  80:
+    tcp: 'allow'
+  23:
+    tcp: 'drop'
+    udp: 'drop'
+firewall:
+  '001 accept all icmp requests':
+    proto: 'icmp'
+    action: 'accept'
+  '002 allow loopback':
+    iniface: 'lo'
+    chain: 'INPUT'
+    action: 'accept'
+  '000 INPUT allow related and established':
+    state: ['RELATED', 'ESTABLISHED']
+    action: 'accept'
+    proto: 'all'
+  '100 allow ssh':
+    state: ['NEW']
+    dport: '22'
+    proto: 'tcp'
+    action: 'accept'
+  '100 allow httpd:80':
+    state: ['NEW']
+    dport: '80'
+    proto: 'tcp'
+    action: 'accept'
+  '998 deny all other requests':
+    action: 'reject'
+    proto: 'all'
+    reject: 'icmp-host-prohibited'
+  '999 deny all other requests':
+    chain: 'FORWARD'
+    action: 'reject'
+    proto: 'all'
+    reject: 'icmp-host-prohibited'

data/lib/templates/puppet/step-3/hiera/data/node.yaml.erb

@@ -0,0 +1,99 @@
+fail2ban:
+  bantime:   60
+  maxretry:  3
+  mailto: 'root@localhost'
+ssh::server:
+  password_authentication: 'no'
+  pubkey_authentication: 'yes'
+  permit_root_login: 'no'
+sysctl:
+  # IP Spoofing protection
+  'net.ipv4.conf.all.rp_filter':
+    value: '1'
+  'net.ipv4.conf.default.rp_filter':
+    value: '1'
+  # Ignore ICMP broadcast requests
+  'net.ipv4.icmp_echo_ignore_broadcasts':
+    value: '1'
+  # Disable source packet routing
+  'net.ipv4.conf.all.accept_source_route':
+    value: '0'
+  'net.ipv6.conf.all.accept_source_route':
+    value: '0'
+  'net.ipv4.conf.default.accept_source_route':
+    value: '0'
+  'net.ipv6.conf.default.accept_source_route':
+    value: '0'
+  # Ignore send redirects
+  'net.ipv4.conf.all.send_redirects':
+    value: '0'
+  'net.ipv4.conf.default.send_redirects':
+    value: '0'
+  # Block SYN attacks
+  'net.ipv4.tcp_syncookies':
+    value: '1'
+  'net.ipv4.tcp_max_syn_backlog':
+    value: '2048'
+  'net.ipv4.tcp_synack_retries':
+    value: '2'
+  'net.ipv4.tcp_syn_retries':
+    value: '5'
+  # Log Martians
+  'net.ipv4.conf.all.log_martians':
+    value: '1'
+  'net.ipv4.icmp_ignore_bogus_error_responses':
+    value: '1'
+  # Ignore ICMP redirects
+  'net.ipv4.conf.all.accept_redirects':
+    value: '0'
+  'net.ipv6.conf.all.accept_redirects':
+    value: '0'
+  'net.ipv4.conf.default.accept_redirects':
+    value: '0'
+  'net.ipv6.conf.default.accept_redirects':
+    value: '0'
+  # Ignore Directed pings
+  'net.ipv4.icmp_echo_ignore_all':
+    value: '1'
+iptables::allow_icmp: 'yes'
+iptables::allow_localhost: 'yes'
+iptables::log_failures: 'yes'
+iptables::ports:
+  22:
+    tcp: 'allow'
+  80:
+    tcp: 'allow'
+  23:
+    tcp: 'drop'
+    udp: 'drop'
+firewall:
+  '001 accept all icmp requests':
+    proto: 'icmp'
+    action: 'accept'
+  '002 allow loopback':
+    iniface: 'lo'
+    chain: 'INPUT'
+    action: 'accept'
+  '000 INPUT allow related and established':
+    state: ['RELATED', 'ESTABLISHED']
+    action: 'accept'
+    proto: 'all'
+  '100 allow ssh':
+    state: ['NEW']
+    dport: '22'
+    proto: 'tcp'
+    action: 'accept'
+  '100 allow httpd:80':
+    state: ['NEW']
+    dport: '80'
+    proto: 'tcp'
+    action: 'accept'
+  '998 deny all other requests':
+    action: 'reject'
+    proto: 'all'
+    reject: 'icmp-host-prohibited'
+  '999 deny all other requests':
+    chain: 'FORWARD'
+    action: 'reject'
+    proto: 'all'
+    reject: 'icmp-host-prohibited'

data/lib/templates/puppet/step-3/hiera/hiera.yaml.erb

@@ -0,0 +1,11 @@
+# Important note: This file is empty.
+# /etc/puppet/hiera.yml is used by default.
+# deploy_user and deploy_environment is set in the puppet apply command executed by capistrano
+:backends: yaml
+:yaml:
+  :datadir: %{::deploy_to}/current/steps/<%=step_dir%>/hiera/data
+:hierarchy:
+  - %{::fqdn}
+  - %{::deploy_environment}
+  - common
+:logger: console

data/lib/templates/puppet/step-3/manifests/node.erb

@@ -0,0 +1,5 @@
+node <%= node.hostname %> {
+
+  include roles::security
+
+}

data/lib/templates/puppet/step-3/manifests/site.pp.erb

@@ -0,0 +1,15 @@
+# This file associates nodes with roles
+# Example:
+# node node0.server1.test {
+#   include roles::role_1
+# }
+# The roles and profiles pattern recommends to associate one node with
+# one and only one role.
+# The role can be set to the node manually or through the
+# 'bebox node set_role' command.
+
+<% nodes.each do |node| %>
+node <%= node.hostname %> {
+  include roles::security
+}
+<% end %>

data/spec/environment_spec.rb

@@ -0,0 +1,82 @@
+require 'spec_helper'
+require_relative '../spec/factories/environment.rb'
+
+describe 'Test 02: Bebox::Environment' do
+
+  describe 'Environment management' do
+
+    subject { build(:environment) }
+
+    it 'should list the current environments' do
+      current_environments = %w{vagrant staging production}
+      environments = Bebox::Environment.list(subject.project_root)
+      expect(environments).to include(*current_environments)
+    end
+
+    context 'environment creation' do
+
+      it 'should create checkpoints' do
+        expected_directories = [subject.name, 'nodes', 'prepared_nodes',
+          'steps', 'step-0', 'step-1', 'step-2', 'step-3']
+        subject.create_checkpoints
+        directories = []
+        directories << Dir["#{subject.project_root}/.checkpoints/environments/#{subject.name}/"].map { |f| File.basename(f) }
+        directories << Dir["#{subject.project_root}/.checkpoints/environments/#{subject.name}/*/"].map { |f| File.basename(f) }
+        directories << Dir["#{subject.project_root}/.checkpoints/environments/#{subject.name}/*/*/"].map { |f| File.basename(f) }
+        expect(directories.flatten).to include(*expected_directories)
+      end
+
+      it 'should generate capistrano base' do
+        subject.create_capistrano_base
+        expect(Dir.exist?("#{subject.project_root}/config/keys/environments/#{subject.name}")).to be (true)
+      end
+
+      it 'should generate deploy file' do
+        subject.generate_deploy_file
+        deploy_content = File.read("#{subject.project_root}/config/deploy/#{subject.name}.rb").gsub(/\s+/, ' ').strip
+        deploy_output_content = File.read("spec/fixtures/config/deploy/environment.test").gsub(/\s+/, ' ').strip
+        expect(deploy_content).to eq(deploy_output_content)
+      end
+
+      it 'should generate hiera data file' do
+        subject.generate_hiera_template
+        Bebox::PROVISION_STEPS.each do |step|
+          content = File.read("spec/fixtures/puppet/steps/#{step}/hiera/data/#{subject.name}.yaml.test")
+          output = File.read("#{subject.project_root}/puppet/steps/#{Bebox::Provision.step_name(step)}/hiera/data/#{subject.name}.yaml")
+          expect(output).to eq(content)
+        end
+      end
+    end
+
+    context 'environment deletion' do
+
+      it 'should remove checkpoints' do
+        environment_directories = [subject.name, 'nodes', 'prepared_nodes',
+          'steps', 'step-0', 'step-1', 'step-2', 'step-3']
+        subject.remove_checkpoints
+        directories = []
+        directories << Dir["#{subject.project_root}/.checkpoints/environments/#{subject.name}/"].map { |f| File.basename(f) }
+        directories << Dir["#{subject.project_root}/.checkpoints/environments/#{subject.name}/*/"].map { |f| File.basename(f) }
+        directories << Dir["#{subject.project_root}/.checkpoints/environments/#{subject.name}/*/*/"].map { |f| File.basename(f) }
+        expect(directories.flatten).to_not include(*environment_directories)
+      end
+
+      it 'should remove capistrano base' do
+        subject.remove_capistrano_base
+        expect(Dir.exist?("#{subject.project_root}/config/keys/environments/#{subject.name}")).to be (false)
+      end
+
+      it 'should remove deploy file' do
+        subject.remove_deploy_file
+        expect(File.exist?("#{subject.project_root}/config/deploy/#{subject.name}.rb")).to be (false)
+      end
+
+      it 'should remove deploy file' do
+        subject.remove_hiera_template
+        Bebox::PROVISION_STEPS.each do |step|
+          expect(File.exist?("#{subject.project_root}/puppet/steps/#{Bebox::Provision.step_name(step)}/hiera/data/#{subject.name}.yaml")).to be (false)
+        end
+      end
+    end
+  end
+end

data/spec/factories/environment.rb

@@ -0,0 +1,20 @@
+FactoryGirl.define do
+  factory :environment, :class => Bebox::Environment do
+    name "pname_env"
+    project_root "#{Dir.pwd}/tmp/bebox-pname"
+
+    initialize_with { new(name, project_root) }
+
+    trait :created do
+      after(:build) do |environment|
+        environment.create
+      end
+    end
+
+    trait :removed do
+      after(:build) do |environment|
+        environment.remove
+      end
+    end
+  end
+end

data/spec/factories/node.rb

@@ -0,0 +1,22 @@
+FactoryGirl.define do
+  factory :node, :class => Bebox::Node do
+    environment   'vagrant'
+    project_root  "#{Dir.pwd}/tmp/bebox-pname"
+    hostname      'node0.server1.test'
+    ip            YAML.load_file('spec/support/config_specs.yaml')['test_ip']
+
+    initialize_with { new(environment, project_root, hostname, ip) }
+
+    trait :created do
+      after(:build) do |node|
+        node.create
+      end
+    end
+
+    trait :removed do
+      after(:build) do |node|
+        node.remove
+      end
+    end
+  end
+end

data/spec/factories/profile.rb

@@ -0,0 +1,10 @@
+FactoryGirl.define do
+  factory :profile, :class => Bebox::Profile do
+    project_root  "#{Dir.pwd}/tmp/bebox-pname"
+    name          'profile_0'
+    path          'test'
+
+    initialize_with { new(name, project_root, path) }
+
+  end
+end

data/spec/factories/project.rb

@@ -0,0 +1,17 @@
+FactoryGirl.define do
+  factory :project, :class => Bebox::Project do
+    name "bebox-pname"
+    vagrant_box_base "ubuntu-server-12042-x64-vbox4210-nocm.box"
+    parent_path "#{Dir.pwd}/tmp"
+    vagrant_box_provider 'virtualbox'
+    default_environments ['vagrant', 'staging', 'production']
+
+    initialize_with { new(name, vagrant_box_base, parent_path, vagrant_box_provider, default_environments) }
+
+    trait :created do
+      after(:build) do |project|
+        project.create
+      end
+    end
+  end
+end

data/spec/factories/provision.rb

@@ -0,0 +1,13 @@
+require_relative '../factories/node.rb'
+
+FactoryGirl.define do
+  factory :provision, :class => Bebox::Provision do
+    project_root  "#{Dir.pwd}/tmp/bebox-pname"
+    environment   'vagrant'
+    node          FactoryGirl.build(:node)
+    step          'step-0'
+
+    initialize_with { new(project_root, environment, node, step) }
+
+  end
+end

data/spec/factories/role.rb

@@ -0,0 +1,9 @@
+FactoryGirl.define do
+  factory :role, :class => Bebox::Role do
+    project_root  "#{Dir.pwd}/tmp/bebox-pname"
+    name          'role_0'
+
+    initialize_with { new(name, project_root) }
+
+  end
+end

data/spec/fixtures/Capfile.test

@@ -0,0 +1,2 @@
+load 'deploy'
+load 'config/deploy'

data/spec/fixtures/Gemfile.test

@@ -0,0 +1,5 @@
+source 'https://rubygems.org'
+
+gem 'rake', '0.9.2.2'
+gem 'capistrano', '2.15.5'
+gem 'capistrano-copy-subdir', '0.1.0'