bebox 0.0.1

data/spec/fixtures/puppet/steps/step-2/hiera/data/node0.server1.test.yaml.test

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/spec/fixtures/puppet/steps/step-2/hiera/data/pname_env.yaml.test

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/spec/fixtures/puppet/steps/step-2/hiera/data/production.yaml.test

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/spec/fixtures/puppet/steps/step-2/hiera/data/staging.yaml.test

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/spec/fixtures/puppet/steps/step-2/hiera/data/vagrant.yaml.test

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/spec/fixtures/puppet/steps/step-2/hiera/hiera.yaml.test

@@ -0,0 +1,11 @@
+# Important note: This file is empty.
+# /etc/puppet/hiera.yml is used by default.
+# deploy_user and deploy_environment is set in the puppet apply command executed by capistrano
+:backends: yaml
+:yaml:
+  :datadir: %{::deploy_to}/current/steps/2-services/hiera/data
+:hierarchy:
+  - %{::fqdn}
+  - %{::deploy_environment}
+  - common
+:logger: console

data/spec/fixtures/puppet/steps/step-2/manifests/site.pp.test

@@ -0,0 +1,10 @@
+# This file associates nodes with roles
+# Example:
+# node node0.server1.test {
+#   include roles::role_1
+# }
+# The roles and profiles pattern recommends to associate one node with
+# one and only one role.
+# The role can be set to the node manually or through the
+# 'bebox node set_role' command.
+

data/spec/fixtures/puppet/steps/step-2/manifests/site_with_node.pp.test

@@ -0,0 +1,13 @@
+# This file associates nodes with roles
+# Example:
+# node node0.server1.test {
+#   include roles::role_1
+# }
+# The roles and profiles pattern recommends to associate one node with
+# one and only one role.
+# The role can be set to the node manually or through the
+# 'bebox node set_role' command.
+
+node node0.server1.test {
+
+}

data/spec/fixtures/puppet/steps/step-2/manifests/site_with_node_role_association.pp.test

@@ -0,0 +1,16 @@
+# This file associates nodes with roles
+# Example:
+# node node0.server1.test {
+#   include roles::role_1
+# }
+# The roles and profiles pattern recommends to associate one node with
+# one and only one role.
+# The role can be set to the node manually or through the
+# 'bebox node set_role' command.
+
+node node0.server1.test {
+
+  include roles::role_0
+
+}
+

data/spec/fixtures/puppet/steps/step-2/modules/profiles/manifests/test/profile_0.pp.test

@@ -0,0 +1,17 @@
+# The profile class include the classes instantiation or
+# puppet/modules type resource definitions.
+# It can include hiera calls for the parametter setting.
+# Example:
+# class profiles::category::technology {
+#   $technology_parameters = hiera("technology")
+#   $parameter1 = technology_parameters[parameter1]
+#   ...
+#   class { "technology_resource":
+#     parameter1  => $parameter1
+#     ...
+#   }
+# }
+
+class profiles::test::profile_0 {
+
+}

data/spec/fixtures/puppet/steps/step-2/modules/roles/manifests/role_0.pp.test

@@ -0,0 +1,16 @@
+# The role class can include many profiles
+# Example:
+# class roles::example_role {
+#   include profiles::category::example_profile_1
+#   include profiles::category::example_profile_2
+#   ...
+#   include profiles::category::example_profile_N
+# }
+# The profiles can be added/removed to the role manually or through the
+# 'bebox role add_profile' and 'bebox role remove_profile' commands.
+
+class roles::role_0 {
+
+  include profiles::test::profile_0
+
+}

data/spec/fixtures/puppet/steps/step-3/hiera/data/common.yaml.test

@@ -0,0 +1,99 @@
+fail2ban:
+  bantime:   60
+  maxretry:  3
+  mailto: 'root@localhost'
+ssh::server:
+  password_authentication: 'no'
+  pubkey_authentication: 'yes'
+  permit_root_login: 'no'
+sysctl:
+  # IP Spoofing protection
+  'net.ipv4.conf.all.rp_filter':
+    value: '1'
+  'net.ipv4.conf.default.rp_filter':
+    value: '1'
+  # Ignore ICMP broadcast requests
+  'net.ipv4.icmp_echo_ignore_broadcasts':
+    value: '1'
+  # Disable source packet routing
+  'net.ipv4.conf.all.accept_source_route':
+    value: '0'
+  'net.ipv6.conf.all.accept_source_route':
+    value: '0'
+  'net.ipv4.conf.default.accept_source_route':
+    value: '0'
+  'net.ipv6.conf.default.accept_source_route':
+    value: '0'
+  # Ignore send redirects
+  'net.ipv4.conf.all.send_redirects':
+    value: '0'
+  'net.ipv4.conf.default.send_redirects':
+    value: '0'
+  # Block SYN attacks
+  'net.ipv4.tcp_syncookies':
+    value: '1'
+  'net.ipv4.tcp_max_syn_backlog':
+    value: '2048'
+  'net.ipv4.tcp_synack_retries':
+    value: '2'
+  'net.ipv4.tcp_syn_retries':
+    value: '5'
+  # Log Martians
+  'net.ipv4.conf.all.log_martians':
+    value: '1'
+  'net.ipv4.icmp_ignore_bogus_error_responses':
+    value: '1'
+  # Ignore ICMP redirects
+  'net.ipv4.conf.all.accept_redirects':
+    value: '0'
+  'net.ipv6.conf.all.accept_redirects':
+    value: '0'
+  'net.ipv4.conf.default.accept_redirects':
+    value: '0'
+  'net.ipv6.conf.default.accept_redirects':
+    value: '0'
+  # Ignore Directed pings
+  'net.ipv4.icmp_echo_ignore_all':
+    value: '1'
+iptables::allow_icmp: 'yes'
+iptables::allow_localhost: 'yes'
+iptables::log_failures: 'yes'
+iptables::ports:
+  22:
+    tcp: 'allow'
+  80:
+    tcp: 'allow'
+  23:
+    tcp: 'drop'
+    udp: 'drop'
+firewall:
+  '001 accept all icmp requests':
+    proto: 'icmp'
+    action: 'accept'
+  '002 allow loopback':
+    iniface: 'lo'
+    chain: 'INPUT'
+    action: 'accept'
+  '000 INPUT allow related and established':
+    state: ['RELATED', 'ESTABLISHED']
+    action: 'accept'
+    proto: 'all'
+  '100 allow ssh':
+    state: ['NEW']
+    dport: '22'
+    proto: 'tcp'
+    action: 'accept'
+  '100 allow httpd:80':
+    state: ['NEW']
+    dport: '80'
+    proto: 'tcp'
+    action: 'accept'
+  '998 deny all other requests':
+    action: 'reject'
+    proto: 'all'
+    reject: 'icmp-host-prohibited'
+  '999 deny all other requests':
+    chain: 'FORWARD'
+    action: 'reject'
+    proto: 'all'
+    reject: 'icmp-host-prohibited'

data/spec/fixtures/puppet/steps/step-3/hiera/data/node0.server1.test.yaml.test

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/spec/fixtures/puppet/steps/step-3/hiera/data/pname_env.yaml.test

@@ -0,0 +1,99 @@
+fail2ban:
+  bantime:   60
+  maxretry:  3
+  mailto: 'root@localhost'
+ssh::server:
+  password_authentication: 'no'
+  pubkey_authentication: 'yes'
+  permit_root_login: 'no'
+sysctl:
+  # IP Spoofing protection
+  'net.ipv4.conf.all.rp_filter':
+    value: '1'
+  'net.ipv4.conf.default.rp_filter':
+    value: '1'
+  # Ignore ICMP broadcast requests
+  'net.ipv4.icmp_echo_ignore_broadcasts':
+    value: '1'
+  # Disable source packet routing
+  'net.ipv4.conf.all.accept_source_route':
+    value: '0'
+  'net.ipv6.conf.all.accept_source_route':
+    value: '0'
+  'net.ipv4.conf.default.accept_source_route':
+    value: '0'
+  'net.ipv6.conf.default.accept_source_route':
+    value: '0'
+  # Ignore send redirects
+  'net.ipv4.conf.all.send_redirects':
+    value: '0'
+  'net.ipv4.conf.default.send_redirects':
+    value: '0'
+  # Block SYN attacks
+  'net.ipv4.tcp_syncookies':
+    value: '1'
+  'net.ipv4.tcp_max_syn_backlog':
+    value: '2048'
+  'net.ipv4.tcp_synack_retries':
+    value: '2'
+  'net.ipv4.tcp_syn_retries':
+    value: '5'
+  # Log Martians
+  'net.ipv4.conf.all.log_martians':
+    value: '1'
+  'net.ipv4.icmp_ignore_bogus_error_responses':
+    value: '1'
+  # Ignore ICMP redirects
+  'net.ipv4.conf.all.accept_redirects':
+    value: '0'
+  'net.ipv6.conf.all.accept_redirects':
+    value: '0'
+  'net.ipv4.conf.default.accept_redirects':
+    value: '0'
+  'net.ipv6.conf.default.accept_redirects':
+    value: '0'
+  # Ignore Directed pings
+  'net.ipv4.icmp_echo_ignore_all':
+    value: '1'
+iptables::allow_icmp: 'yes'
+iptables::allow_localhost: 'yes'
+iptables::log_failures: 'yes'
+iptables::ports:
+  22:
+    tcp: 'allow'
+  80:
+    tcp: 'allow'
+  23:
+    tcp: 'drop'
+    udp: 'drop'
+firewall:
+  '001 accept all icmp requests':
+    proto: 'icmp'
+    action: 'accept'
+  '002 allow loopback':
+    iniface: 'lo'
+    chain: 'INPUT'
+    action: 'accept'
+  '000 INPUT allow related and established':
+    state: ['RELATED', 'ESTABLISHED']
+    action: 'accept'
+    proto: 'all'
+  '100 allow ssh':
+    state: ['NEW']
+    dport: '22'
+    proto: 'tcp'
+    action: 'accept'
+  '100 allow httpd:80':
+    state: ['NEW']
+    dport: '80'
+    proto: 'tcp'
+    action: 'accept'
+  '998 deny all other requests':
+    action: 'reject'
+    proto: 'all'
+    reject: 'icmp-host-prohibited'
+  '999 deny all other requests':
+    chain: 'FORWARD'
+    action: 'reject'
+    proto: 'all'
+    reject: 'icmp-host-prohibited'

data/spec/fixtures/puppet/steps/step-3/hiera/data/production.yaml.test

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/spec/fixtures/puppet/steps/step-3/hiera/data/staging.yaml.test

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/spec/fixtures/puppet/steps/step-3/hiera/data/vagrant.yaml.test

@@ -0,0 +1 @@
+# Here you can set the hiera data to be used for your profiles

data/spec/fixtures/puppet/steps/step-3/hiera/hiera.yaml.test

@@ -0,0 +1,11 @@
+# Important note: This file is empty.
+# /etc/puppet/hiera.yml is used by default.
+# deploy_user and deploy_environment is set in the puppet apply command executed by capistrano
+:backends: yaml
+:yaml:
+  :datadir: %{::deploy_to}/current/steps/3-security/hiera/data
+:hierarchy:
+  - %{::fqdn}
+  - %{::deploy_environment}
+  - common
+:logger: console

data/spec/fixtures/puppet/steps/step-3/manifests/site.pp.test

@@ -0,0 +1,10 @@
+# This file associates nodes with roles
+# Example:
+# node node0.server1.test {
+#   include roles::role_1
+# }
+# The roles and profiles pattern recommends to associate one node with
+# one and only one role.
+# The role can be set to the node manually or through the
+# 'bebox node set_role' command.
+

data/spec/fixtures/puppet/steps/step-3/manifests/site_with_node.pp.test

@@ -0,0 +1,15 @@
+# This file associates nodes with roles
+# Example:
+# node node0.server1.test {
+#   include roles::role_1
+# }
+# The roles and profiles pattern recommends to associate one node with
+# one and only one role.
+# The role can be set to the node manually or through the
+# 'bebox node set_role' command.
+
+node node0.server1.test {
+
+  include roles::security
+
+}

data/spec/fixtures/puppet/ubuntu_dependencies.test

@@ -0,0 +1,10 @@
+git-core
+build-essential
+curl
+whois
+openssl
+libxslt1-dev
+autoconf
+bison
+libreadline5
+libsqlite3-dev

data/spec/node0.server1.test/prepare_phase_spec.rb

@@ -0,0 +1,53 @@
+require 'spec_helper'
+require_relative '../factories/node.rb'
+require_relative '../vagrant_spec_helper.rb'
+
+describe 'Test 06: Node prepared' do
+
+  let(:node) { build(:node) }
+
+  before(:all) do
+    node.prepare
+  end
+
+  context 'vagrant prepared' do
+    describe interface('eth1') do
+      it { should have_ipv4_address(node.ip) }
+    end
+
+    describe host('node0.server1.test') do
+      it { should be_resolvable }
+      it { should be_reachable.with( :port => 22 ) }
+    end
+
+    describe user('vagrant') do
+      it { should exist }
+    end
+  end
+
+  context 'all environments prepared' do
+    describe command('hostname') do
+      it 'should configure the hostname' do
+        should return_stdout node.hostname
+      end
+    end
+
+    describe command("dpkg -s #{Bebox::Project.so_dependencies} | grep Status") do
+      it 'should install ubuntu dependencies' do
+        should return_stdout /(Status: install ok installed\s*){#{Bebox::Project.so_dependencies.split(' ').size}}/
+      end
+    end
+
+    describe package('puppet') do
+      it { should be_installed }
+    end
+
+    it 'should create checkpoint' do
+      expect(File.exist?("#{node.project_root}/.checkpoints/environments/#{node.environment}/prepared_nodes/#{node.hostname}.yml")).to be (true)
+      prepared_node_content = File.read("#{node.project_root}/.checkpoints/environments/#{node.environment}/prepared_nodes/#{node.hostname}.yml").gsub(/\s+/, ' ').strip
+      ouput_template = Tilt::ERBTemplate.new('spec/fixtures/node/prepared_node_0.test.erb')
+      prepared_node_expected_content = ouput_template.render(nil, node: node).gsub(/\s+/, ' ').strip
+      expect(prepared_node_content).to eq(prepared_node_expected_content)
+    end
+  end
+end

data/spec/node0.server1.test/provision_step_0_spec.rb

@@ -0,0 +1,46 @@
+require 'spec_helper'
+require_relative '../factories/provision.rb'
+require_relative '../vagrant_spec_helper.rb'
+
+describe 'Test 12: Apply provision for fundamental step-0' do
+
+  let(:provision) { build(:provision) }
+  let(:fundamental_profiles) {['base/fundamental/ruby', 'base/fundamental/sudo', 'base/fundamental/users']}
+
+  before(:all) do
+    Bebox::Provision.generate_puppetfile(provision.project_root, provision.step, fundamental_profiles)
+    Bebox::Provision.generate_roles_and_profiles(provision.project_root, provision.step, 'fundamental', fundamental_profiles)
+    provision.apply
+  end
+
+  describe user('puppet') do
+    it { should exist }
+    it { should belong_to_group 'root' }
+    it { should have_home_directory '/home/puppet' }
+    it { should have_login_shell '/bin/bash' }
+    it { should have_uid 7000 }
+  end
+
+  describe file('/home/puppet/.ssh/authorized_keys') do
+    let(:disable_sudo) { false }
+    it { should be_file }
+    its(:content) {
+      keys_content = File.read("#{provision.project_root}/config/keys/environments/vagrant/id_rsa.pub").strip
+      should == "#{keys_content}"
+    }
+  end
+
+  describe file('/etc/sudoers.d/10_puppet') do
+    let(:disable_sudo) { false }
+    it { should be_file }
+  end
+
+  it 'should create checkpoint' do
+    checkpoint_file_path = "#{provision.project_root}/.checkpoints/environments/#{provision.environment}/steps/#{provision.step}/#{provision.node.hostname}.yml"
+    expect(File.exist?(checkpoint_file_path)).to eq(true)
+    prepared_node_content = File.read(checkpoint_file_path).gsub(/\s+/, ' ').strip
+    ouput_template = Tilt::ERBTemplate.new('spec/fixtures/node/provisioned_node_0.test.erb')
+    prepared_node_expected_content = ouput_template.render(nil, node: provision.node).gsub(/\s+/, ' ').strip
+    expect(prepared_node_content).to eq(prepared_node_expected_content)
+  end
+end

data/spec/node0.server1.test/provision_step_1_spec.rb

@@ -0,0 +1,41 @@
+require 'spec_helper'
+require_relative '../factories/provision.rb'
+require_relative '../puppet_spec_helper.rb'
+
+describe 'Test 13: Apply provision for users layer step-1' do
+
+  let(:provision) { build(:provision, step: 'step-1') }
+  let(:users_profiles) {['base/users/ssh', 'base/users/users']}
+
+  before(:all) do
+    Bebox::Provision.generate_puppetfile(provision.project_root, provision.step, users_profiles)
+    Bebox::Provision.generate_roles_and_profiles(provision.project_root, provision.step, 'users', users_profiles)
+    provision.apply
+  end
+
+  describe user('pname') do
+    it { should exist }
+    it { should belong_to_group 'root' }
+    it { should have_home_directory '/home/pname' }
+    it { should have_login_shell '/bin/bash' }
+    it { should have_uid 7001 }
+  end
+
+  describe file('/home/pname/.ssh/authorized_keys') do
+    let(:disable_sudo) { false }
+    it { should be_file }
+    its(:content) {
+      keys_content = File.read("#{provision.project_root}/config/keys/environments/vagrant/id_rsa.pub").strip
+      should == "#{keys_content}"
+    }
+  end
+
+  it 'should create checkpoint' do
+    checkpoint_file_path = "#{provision.project_root}/.checkpoints/environments/#{provision.environment}/steps/#{provision.step}/#{provision.node.hostname}.yml"
+    expect(File.exist?(checkpoint_file_path)).to eq(true)
+    prepared_node_content = File.read(checkpoint_file_path).gsub(/\s+/, ' ').strip
+    ouput_template = Tilt::ERBTemplate.new('spec/fixtures/node/provisioned_node_0.test.erb')
+    prepared_node_expected_content = ouput_template.render(nil, node: provision.node).gsub(/\s+/, ' ').strip
+    expect(prepared_node_content).to eq(prepared_node_expected_content)
+  end
+end

data/spec/node0.server1.test/provision_step_2_spec.rb

@@ -0,0 +1,79 @@
+require 'spec_helper'
+require_relative '../factories/provision.rb'
+require_relative '../factories/role.rb'
+require_relative '../factories/profile.rb'
+require_relative '../puppet_spec_helper.rb'
+
+describe 'Test 14: Apply provision for service layer step-2' do
+
+  let(:provision) { build(:provision, step: 'step-2') }
+  let(:role) { build(:role) }
+  let(:profile) { build(:profile) }
+
+  before :all do
+    role.create
+    profile.create
+    Bebox::Role.add_profile(role.project_root, role.name, profile.relative_path)
+    `cp spec/fixtures/puppet/profiles/#{profile.relative_path}/manifests/init_with_content.pp.test #{profile.absolute_path}/manifests/init.pp`
+    `cp spec/fixtures/puppet/hiera/data/#{provision.node.hostname}.yaml.test #{provision.project_root}/puppet/steps/#{provision.step_name}/hiera/data/#{provision.node.hostname}.yaml`
+    `cp spec/fixtures/puppet/profiles/#{profile.relative_path}/Puppetfile_with_modules.test #{profile.absolute_path}/Puppetfile`
+    profiles = Bebox::Provision.profiles_from_role(provision.project_root, role.name)
+    Bebox::Provision.generate_puppetfile(provision.project_root, provision.step, profiles)
+    Bebox::Provision.generate_roles_and_profiles(provision.project_root, provision.step, 'role_0', [profile.relative_path])
+    provision.apply
+  end
+
+  context 'should download the configured modules' do
+
+    module_dir = '/home/puppet/code/shared/librarian-puppet/2-services/modules'
+
+    describe file("#{module_dir}/rbenv") do
+      it { should be_directory }
+    end
+
+    describe file("#{module_dir}/nginx") do
+      it { should be_directory }
+    end
+
+    describe file("#{module_dir}/redis") do
+      it { should be_directory }
+    end
+
+    describe file("#{module_dir}/roles") do
+      it { should be_directory }
+    end
+
+    describe file("#{module_dir}/profiles") do
+      it { should be_directory }
+    end
+  end
+
+  context 'should install some packages' do
+    context 'wkhtmltopdf' do
+      describe package('wkhtmltopdf') do
+        it { should be_installed }
+      end
+    end
+
+    context 'imagemagick' do
+      describe package('imagemagick') do
+        it { should be_installed }
+      end
+    end
+
+    context 'htop' do
+      describe package('htop') do
+        it { should be_installed }
+      end
+    end
+  end
+
+  it 'should create checkpoint' do
+    checkpoint_file_path = "#{provision.project_root}/.checkpoints/environments/#{provision.environment}/steps/#{provision.step}/#{provision.node.hostname}.yml"
+    expect(File.exist?(checkpoint_file_path)).to eq(true)
+    prepared_node_content = File.read(checkpoint_file_path).gsub(/\s+/, ' ').strip
+    ouput_template = Tilt::ERBTemplate.new('spec/fixtures/node/provisioned_node_0.test.erb')
+    prepared_node_expected_content = ouput_template.render(nil, node: provision.node).gsub(/\s+/, ' ').strip
+    expect(prepared_node_content).to eq(prepared_node_expected_content)
+  end
+end

data/spec/node0.server1.test/provision_step_3_spec.rb

@@ -0,0 +1,76 @@
+require 'spec_helper'
+require_relative '../factories/provision.rb'
+require_relative '../puppet_spec_helper.rb'
+
+describe 'Test 15: Apply provision for security layer step-3' do
+
+  let(:provision) { build(:provision, step: 'step-3') }
+  let(:security_profiles) {['base/security/fail2ban', 'base/security/iptables', 'base/security/ssh', 'base/security/sysctl']}
+
+  before(:all) do
+    Bebox::Provision.generate_puppetfile(provision.project_root, provision.step, security_profiles)
+    Bebox::Provision.generate_roles_and_profiles(provision.project_root, provision.step, 'security', security_profiles)
+    provision.apply
+  end
+
+  context 'fail2ban module' do
+    describe service('fail2ban') do
+      it { should be_enabled }
+    end
+  end
+
+  context 'ssh' do
+    describe file('/etc/ssh/sshd_config') do
+      its(:content) { should match /PermitRootLogin no/ }
+      its(:content) { should match /PubkeyAuthentication yes/ }
+      its(:content) { should match /PasswordAuthentication no/ }
+    end
+
+  end
+
+  context 'iptables' do
+    describe iptables do
+      let(:disable_sudo) { false }
+      it { should have_rule('-A INPUT -m comment --comment "000 INPUT allow related and established" -m state --state RELATED,ESTABLISHED -j ACCEPT') }
+      it { should have_rule('-A INPUT -p icmp -m comment --comment "001 accept all icmp requests" -j ACCEPT') }
+      it { should have_rule('-A INPUT -i lo -p tcp -m comment --comment "002 allow loopback" -j ACCEPT') }
+      it { should have_rule('-A INPUT -p tcp -m multiport --dports 80 -m comment --comment "100 allow httpd:80" -m state --state NEW -j ACCEPT') }
+      it { should have_rule('-A INPUT -p tcp -m multiport --dports 22 -m comment --comment "100 allow ssh" -m state --state NEW -j ACCEPT') }
+      it { should have_rule('-A INPUT -m comment --comment "998 deny all other requests" -j REJECT --reject-with icmp-host-prohibited') }
+      it { should have_rule('-A FORWARD -m comment --comment "999 deny all other requests" -j REJECT --reject-with icmp-host-prohibited') }
+    end
+  end
+
+  context 'sysctl' do
+    describe command('sysctl -a') do
+      its(:stdout) { should match /net.ipv4.conf.default.rp_filter = 1/ }
+      its(:stdout) { should match /net.ipv4.icmp_echo_ignore_broadcasts = 1/ }
+      its(:stdout) { should match /net.ipv4.conf.all.accept_source_route = 0/ }
+      its(:stdout) { should match /net.ipv6.conf.all.accept_source_route = 0/ }
+      its(:stdout) { should match /net.ipv4.conf.default.accept_source_route = 0/ }
+      its(:stdout) { should match /net.ipv6.conf.default.accept_source_route = 0/ }
+      its(:stdout) { should match /net.ipv4.conf.all.send_redirects = 0/ }
+      its(:stdout) { should match /net.ipv4.conf.default.send_redirects = 0/ }
+      its(:stdout) { should match /net.ipv4.tcp_syncookies = 1/ }
+      its(:stdout) { should match /net.ipv4.tcp_max_syn_backlog = 2048/ }
+      its(:stdout) { should match /net.ipv4.tcp_synack_retries = 2/ }
+      its(:stdout) { should match /net.ipv4.tcp_syn_retries = 5/ }
+      its(:stdout) { should match /net.ipv4.conf.all.log_martians = 1/ }
+      its(:stdout) { should match /net.ipv4.icmp_ignore_bogus_error_responses = 1/ }
+      its(:stdout) { should match /net.ipv4.conf.all.accept_redirects = 0/ }
+      its(:stdout) { should match /net.ipv6.conf.all.accept_redirects = 0/ }
+      its(:stdout) { should match /net.ipv4.conf.default.accept_redirects = 0/ }
+      its(:stdout) { should match /net.ipv6.conf.default.accept_redirects = 0/ }
+      its(:stdout) { should match /net.ipv4.icmp_echo_ignore_all = 1/ }
+    end
+  end
+
+  it 'should create checkpoint' do
+    checkpoint_file_path = "#{provision.project_root}/.checkpoints/environments/#{provision.environment}/steps/#{provision.step}/#{provision.node.hostname}.yml"
+    expect(File.exist?(checkpoint_file_path)).to eq(true)
+    prepared_node_content = File.read(checkpoint_file_path).gsub(/\s+/, ' ').strip
+    ouput_template = Tilt::ERBTemplate.new('spec/fixtures/node/provisioned_node_0.test.erb')
+    prepared_node_expected_content = ouput_template.render(nil, node: provision.node).gsub(/\s+/, ' ').strip
+    expect(prepared_node_content).to eq(prepared_node_expected_content)
+  end
+end