cloud-mu 1.9.0.pre.beta

data/test/mu-tools-test/controls/base.rb

@@ -0,0 +1,265 @@
+control 'base_repositories' do
+  title 'mu-tools cookbook'
+    
+    describe directory('/tmp') do
+      it { should exist }
+    end
+  
+    node = json('/tmp/chef_node.json').params
+    node['default']['application_attributes']['skip_recipes'] = []
+    if !node['default']['application_attributes']['skip_recipes'].include?('base_repositories')
+      case os[:family]
+        when "redhat"
+          # Workaround for EOL CentOS 5 repos
+          if os[:name] != "amazon" and os[:release].to_i == 5
+             
+             describe file("/etc/yum.repos.d/CentOS-Base.repo") do
+              it { should exist }
+              it { should be_file }
+            end
+            
+            describe parse_config_file('/etc/yum.repos.d/CentOS-Base.repo') do
+              params = {
+                        'CentOS-$releasever - Base':'name', 'http://vault.centos.org/5.11/os/$basearch/':'baseurl',
+                        '1':'gpgcheck','file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CentOS-5':'gpgkey'
+                        }
+              params.each do |val,var|
+                its(var){should eq val}
+              end
+            end
+
+          end
+          describe file('/etc/yum.repos.d/epel.repo') do
+            it { should exist }
+            it { should be_owned_by 'root' }
+            it { should be_grouped_into 'root' }
+          end
+        end
+    end
+end
+
+
+control 'set_mu_hostname' do
+  title 'mu-tools cookbook'
+
+    node = json('/tmp/chef_node.json').params
+    @platform = os[:name]
+    if !node['default']['application_attributes']['skip_recipes'].include?('set_mu_hostname')
+      $hostname = node['default']['name']
+    if !node['default']['ad']['computer_name'].nil? and !node['default']['ad']['computer_name'].empty?
+      $hostname = node['default']['ad']['computer_name']
+    end rescue NoMethodError
+      $ipaddress = node['default']['ipaddress']
+
+     
+    case os[:name]
+      when "centos", "redhat","amazon"
+        
+        describe file('/etc/sysconfig/network') do
+          it { should exist }
+          it { should be_file }
+          its('content'){should match /NETWORKING=yes/}
+          its('content'){ should match /NETWORKING_IPV6=no/n}
+          its('content'){should match /#{node['name']}/}
+        end
+
+        describe sys_info do
+          its('hostname') { should eq node['name'] }
+        end
+        
+      end
+    end
+  end
+
+
+control 'disable-requiretty' do
+  title 'mu-tools cookbook'
+    
+  case os[:name]
+  when "centos", "redhat"
+    
+    describe file('/etc/sudoers') do
+      it { should exist }
+      its('content') { should match /Defaults   !requiretty/}
+    end  
+  end
+
+end
+
+
+control 'set_local_fw' do
+  title 'mu-tools cookbook'
+  
+  case os[:name]
+  when "centos", "redhat"
+    if os[:release].to_i >= 7
+      describe package('firewall_config') do
+        it { should be_installed }
+      end
+      
+      describe service('iptables') do
+        it { should be_running }
+      end
+    end
+    
+    if os[:release].to_i <= 6
+      describe iptables do
+        it { should have_rule('-A INPUT -i lo -j ACCEPT') }
+        it { should have_rule('-A OUTPUT -o lo -j ACCEPT') }
+      end
+
+      #### missing resource test here -- where is get_mu_master_ips
+
+    end
+  end
+end 
+
+
+control 'rsyslog' do
+  title 'mu-tools cookbook'
+  node = json('/tmp/chef_node.json').params
+  
+  if !node['default']['application_attributes']['skip_recipes'].include?('rsyslog')
+  case os[:family]
+  when 'redhat', 'debian'
+    %w(rsyslog rsyslog-gnutls).each do |p|
+      describe package(p) do
+        it { should be_installed }
+      end
+    end
+
+    describe service('rsyslog') do
+      it { should be_running }
+      it { should be_enabled }
+    end
+
+    if os[:family] == 'redhat'
+      $rsyslog_ssl_ca_path = "/etc/pki/Mu_CA.pem"
+      if os[:name] == 'amazon'
+        describe package('policycoreutils-python') do
+          it { should be_installed }
+        end
+        describe command("/usr/sbin/semanage port -l | grep '^syslogd_port_t.*10514'") do
+          its('exit_status') { should eq 0 }
+        end
+      end
+    elsif os[:family] == 'debian'
+      $rsyslog_ssl_ca_path = "/etc/ssl/Mu_CA.pem"
+      describe package('policycoreutils') do
+        it { should be_installed }
+      end
+    end
+
+    if node['name'] != 'MU-MASTER'
+      ### missing get_mu_master_ips
+      
+      describe file('/etc/rsyslog.d/0-mu-log-client.conf') do
+        it { should exist }
+        its('content') { should match /\$LocalHostName #{node['name']}/ }
+        its('content') { should match /\$DefaultNetstreamDriverCAFile #{$rsyslog_ssl_ca_path}/ }
+        its('content') { should match /\$DefaultNetstreamDriver gtls/ }
+        its('content') { should match /\$ActionSendStreamDriverMode 1/ }
+        its('content') { should match /\$ActionSendStreamDriverAuthMode anon/}
+     end
+
+     describe file($rsyslog_ssl_ca_path) do
+      it { should exist }
+      it { should be_file }
+     end
+      
+    end
+  end 
+  end 
+end 
+
+
+
+control 'nrpe' do
+  title 'mu-tools cookbook'
+
+  node = json('/tmp/chef_node.json').params
+
+  if !node['default']['application_attributes']['skip_recipes'].include?('nrpe')
+    case os[:family]
+    when "redhat"
+
+      ['nrpe', 'nagios-plugins-disk', 'nagios-plugins-nrpe', 'nagios-plugins-ssh'].each do |p|
+        describe package(p) do
+          it { should be_installed }
+        end
+      end
+      
+      describe file('/etc/nagios/nrpe.cfg') do
+        it { should exist }
+        it { should be_file }
+        its('mode') { should cmp '0644' }
+      end
+
+      describe parse_config_file('/etc/nagios/nrpe.cfg') do
+        # missing master ips..........
+        params = {
+          'log_facility': 'daemon', 'pid_file':'/var/run/nrpe/nrpe.pid', 'server_port':'5666',
+          'nrpe_group':'nrpe', 'dont_blame_nrpe':'0','allow_bash_command_substitution':'0',
+          'debug':'0', 'command_timeout':'60', 'connection_timeout':'300',
+          'command[check_users]':'/usr/lib64/nagios/plugins/check_users -w 5 -c 10',
+          'command[check_load]':'/usr/lib64/nagios/plugins/check_load -w 15,10,5 -c 30,25,20',
+          'command[check_zombie_procs]':'/usr/lib64/nagios/plugins/check_procs -w 5 -c 10 -s Z',
+          'command[check_total_procs]': '/usr/lib64/nagios/plugins/check_procs -w 150 -c 200',
+          'command[check_disk]':'/usr/lib64/nagios/plugins/check_disk -w 15% -c 5% -X nfs -X nfs4',
+          'include_dir': '/etc/nagios/nrpe.d/'
+        }
+        params.each do |var,val|
+          its(var){ should eq val }
+        end
+      end
+
+      describe service('nrpe') do
+        it { should be_running }
+        it { should be_enabled }
+      end
+
+      describe directory('/etc/nagios/nrpe.d') do
+        it { should exist }
+        its('owner') { should eq 'nrpe' }
+        its('group') { should eq 'nrpe' }
+        its('mode') { should cmp '0755' }
+      end
+      
+      case os[:release].to_i
+      when 7
+=begin
+  %w{nrpe_file.pp nrpe_file.te nrpe_check_disk.te nrpe_check_disk.pp}.each do |x|
+          describe file("/var/chef/cache/#{x}" do
+            it { should exist}
+            it { should be_file}
+          end
+        end
+        
+        describe command('/usr/sbin/semodule -l | grep nrpe_check_disk') do
+          its('exit_status') { should eq 0 }
+        end
+
+        describe command('/usr/sbin/semodule -l | grep nrpe_file') do
+          its('exit_status') { should eq 0 }
+        end
+      
+      when 6
+        if os[:name] != 'amazon'
+          describe file("/var/chef/cache/nrpe_disk.pp") do
+            it { should exist}
+          end
+
+          describe command("/usr/sbin/semodule | grep -i nrpe_disk.pp") do
+            its('exit_status') { should eq 0 }
+          end
+        end
+=end  end
+    end
+
+    describe service('nrpe') do
+      it { should be_enabled }
+      it { should be_running }
+    end
+  end
+end
+end

data/test/mu-tools-test/inspec.lock

@@ -0,0 +1,3 @@
+---
+lockfile_version: 1
+depends: []

data/test/mu-tools-test/inspec.yml

@@ -0,0 +1,8 @@
+name: mu-tools-test
+title: InSpec Profile
+maintainer: The Authors
+copyright: The Authors
+copyright_email: you@example.com
+license: Apache-2.0
+summary: An InSpec Compliance Profile
+version: 0.1.0

data/test/simple-server-php-test/README.md

@@ -0,0 +1,3 @@
+# Example InSpec Profile
+
+This example shows the implementation of an InSpec profile.

data/test/simple-server-php-test/controls/apachephp.rb

@@ -0,0 +1,25 @@
+include_controls 'mu-tools-test'
+node =json('/tmp/chef_node.json').params
+control 'apache' do
+    title 'This will test apache2 recipe'
+	  %w(apache2 apache2-bin apache2-data apache2-utils).each do |pack|
+      describe package(pack) do
+        it { should be_installed }
+      end
+    end
+
+  	describe service('apache2') do
+	    it { should be_installed }
+	    it { should be_enabled }
+	    it { should be_running }
+    end
+end
+
+control 'php' do 
+  title 'This will test the php recipe'
+	%w(php7.0).each do |pack|
+    describe package(pack) do
+      it { should be_installed }
+    end
+  end
+end

data/test/simple-server-php-test/controls/example.rb

@@ -0,0 +1,19 @@
+# encoding: utf-8
+# copyright: 2018, The Authors
+
+title 'sample section'
+
+# you can also use plain tests
+describe file('/tmp') do
+  it { should be_directory }
+end
+
+# you add controls here
+control 'tmp-1.0' do                        # A unique ID for this control
+  impact 0.7                                # The criticality, if this control fails.
+  title 'Create /tmp directory'             # A human-readable title
+  desc 'An optional description...'
+  describe file('/tmp') do                  # The actual test
+    it { should be_directory }
+  end
+end

data/test/simple-server-php-test/inspec.lock

@@ -0,0 +1,7 @@
+---
+lockfile_version: 1
+depends:
+- name: mu-tools-test
+  resolved_source:
+    path: "/opt/mu/lib/test/mu-tools-test"
+  version_constraints: "[]"

data/test/simple-server-php-test/inspec.yml

@@ -0,0 +1,12 @@
+name: simple-server-php-test
+title: InSpec Profile
+maintainer: The Authors
+copyright: The Authors
+copyright_email: you@example.com
+license: Apache-2.0
+summary: An InSpec Compliance Profile
+version: 0.1.0
+depends:
+- name: mu-tools-test
+  path: ../mu-tools-test
+

data/test/simple-server-rails-test/README.md

@@ -0,0 +1,3 @@
+# Example InSpec Profile
+
+This example shows the implementation of an InSpec profile.

data/test/simple-server-rails-test/controls/rails.rb

@@ -0,0 +1,188 @@
+
+include_controls 'mu-tools-test'
+
+control 'rails' do
+  title 'rails test'
+
+  node = json('/tmp/chef_node.json').params
+  #####################################
+  ### Node Attrs
+  #####################################
+  service_name = node['normal']['service_name']
+  chef_environment = node['default']['chef_environment']
+  application_dir = node['default']['dev']['rails']['apps_dir']
+  repo_path = 'concerto/concerto.git'
+  version = '2.3.5'
+  application_repo = "https://github.com/#{repo_path}"
+
+
+  ###################################
+  ### Tests
+  ###################################
+  %w(libpq-dev sqlite3 libsqlite3-dev libmysqlclient-dev software-properties-common libxml2-dev  libmagickwand-dev make build-essential g++ git).each do |pack|
+    describe package(pack) do
+      it { should be_installed }
+    end
+  end
+
+
+  if os[:family] == 'debian' && os[:release].to_i == 9
+    describe package('runit-systemd') do
+      it { should be_installed }
+    end
+  end
+
+  describe package('runit') do
+    it { should be_installed }
+  end
+
+  describe processes('runsvdir') do
+    it { should exist }
+  end
+
+  describe file('/etc/service') do
+    it { should be_directory }
+    its('mode') { should cmp '0755' }
+    it { should be_owned_by 'root' }
+    it { should be_grouped_into 'root' }
+  end
+
+  describe command('node -v') do
+    its('exit_status') { should eq 0 }
+  end
+
+  describe command('npm -v') do
+    its('exit_status') { should eq 0 }
+  end
+
+
+  describe service('nginx') do
+    it { should be_installed }
+    it { should be_enabled }
+    it { should be_running }
+  end
+
+
+  describe package('nginx') do
+    it { should be_installed }
+  end
+
+  describe apt('http://ppa.launchpad.net/brightbox/ruby-ng/ubuntu') do
+    it { should exist }
+    it { should be_enabled }
+  end
+
+  # Unicorn config
+  unicorn_log_dir = '/var/log/unicorn'
+  unicorn_log = "#{unicorn_log_dir}/unicorn.log"
+  unicorn_error_log = "#{unicorn_log_dir}/error.log"
+  # RDS config
+  db = node['normal']['deployment']['databases']['concerto'].first.last
+  db_name = db['db_name']
+  db_username = db['username']
+  db_host = db['endpoint']
+  db_port = db['port']
+  #db_password = chef_vault_item(db.vault_name, db.vault_item)[db.password_field]
+  default_root= "#{application_dir}/"
+  
+   %w(ruby2.2 ruby2.2-dev).each do |pack|
+    describe package(pack) do
+      it { should be_installed }
+    end
+  end
+
+  describe gem('bundler', '/usr/bin/gem') do
+    it { should be_installed }
+  end
+
+  describe directory(unicorn_log_dir) do
+    it { should exist }
+    it { should be_directory }
+    its('owner') { should eq 'www-data' }
+    its('group') { should eq 'www-data' }
+    its('mode') { should cmp '00555' }
+  end
+
+  [unicorn_log, unicorn_error_log].each do |f|
+    describe file(f) do
+      it { should exist }
+      it { should be_file }
+      its('owner') { should eq 'www-data' }
+      its('group') { should eq 'www-data' }
+    end
+  end
+
+  describe file('/etc/nginx/sites-available/default') do
+    it { should exist }
+    it { should be_file }
+    its('content') { should match /proxy_pass http:\/\/127\.0\.0\.1:9000/ }
+    its('content') { should match /listen 80/}
+  end
+
+  describe directory(application_dir) do
+    it { should exist }
+    it { should be_directory }
+    its('owner') { should eq 'www-data' }
+  end
+
+  ### this is git resource really...
+  describe directory("#{application_dir}/rails") do
+    it { should exist }
+    it { should be_directory }
+    #its('owner') { should eq 'www-data' }
+    #its('group') { should eq 'www-data' }
+  end
+
+  rails_env = 'development'
+  database = {
+    'adapter' => 'mysql2',
+    'encoding' => 'utf8',
+    'database' => db_name,
+    'username' => db_username,
+    'port' => db_port
+}
+
+
+
+  describe file("#{application_dir}/rails/config/database.yml") do
+    it { should exist }
+    it { should be_file }
+    its('content') { should match /#{rails_env}/ }
+    its('content') { should match /#{db_host}/ }
+  end
+
+  describe file("#{application_dir}/rails/config/concerto.yml") do
+    it { should exist }
+    it { should be_file }
+    its('content'){should match /automatic_bundle_installation: false/}
+    its('content'){ should match /automatic_database_installation: false/}
+    its('content'){should match /compile_production_assets: true/ }
+    its('content'){ should match /airbrake_enabled_initially: true/}
+    its('content'){should match /bundle_install_options: "--path vendor\/bundle"/} 
+  end
+
+  describe file("#{application_dir}/rails/Gemfile-plugins") do
+    its('content'){should_not match /gem \"concerto_simple_rss\"/ }
+    its('content'){should_not match /gem \"concerto_remote_video\"/ }
+  end
+
+  describe file('/etc/nginx/nginx.conf') do
+    it { should exist }
+    it { should be_file }
+    its('content'){ should match /\  #include \/etc\/nginx\/conf.d\/\*\.conf;/ }
+    its('content') { should match /include \/etc\/nginx\/sites-enabled\/\*;/ }
+  end
+ 
+  ## is rails running?
+  describe command('sudo lsof -wni tcp:9000') do
+    its('exit_status'){ should eq 0 }
+  end
+
+  describe command("curl http://#{node['normal']['ec2']['public_dns_name']}") do
+    its('exit_status') { should eq 0 }
+    its('stdout'){should_not match 'Welcome to nginx!'}
+  end
+
+
+
+end ## end of control

data/test/simple-server-rails-test/inspec.lock

@@ -0,0 +1,7 @@
+---
+lockfile_version: 1
+depends:
+- name: mu-tools-test
+  resolved_source:
+    path: "/opt/mu/lib/test/mu-tools-test"
+  version_constraints: "[]"

data/test/simple-server-rails-test/inspec.yml

@@ -0,0 +1,11 @@
+name: simple-server-rails-test
+title: InSpec Profile
+maintainer: The Authors
+copyright: The Authors
+copyright_email: you@example.com
+license: Apache-2.0
+summary: An InSpec Compliance Profile
+version: 0.1.0
+depends:
+- name: mu-tools-test
+  path: ../mu-tools-test

data/test/simple-windows-test/README.md

@@ -0,0 +1,3 @@
+# Example InSpec Profile
+
+This example shows the implementation of an InSpec profile.

data/test/simple-windows-test/controls/windows.rb

@@ -0,0 +1,20 @@
+
+
+include_controls 'mu-tools-test'
+
+control 'Mu-Utility Cookbook' do
+  title 'windows_basics'
+
+=begin    
+  describe windows_feature('AWS Tools for Windows Powershell') do
+    it{ should be_installed }
+  end
+
+    describe windows_feature('Google Chrome') do
+      it{ should be_installed }
+    end
+=end
+  describe package('7-Zip') do
+    it{ should be_installed }
+  end
+end

data/test/simple-windows-test/inspec.lock

@@ -0,0 +1,7 @@
+---
+lockfile_version: 1
+depends:
+- name: mu-tools-test
+  resolved_source:
+    path: "/opt/mu/lib/test/mu-tools-test"
+  version_constraints: "[]"

data/test/simple-windows-test/inspec.yml

@@ -0,0 +1,11 @@
+name: simple-windows-test
+title: InSpec Profile
+maintainer: The Authors
+copyright: The Authors
+copyright_email: you@example.com
+license: Apache-2.0
+summary: An InSpec Compliance Profile
+version: 0.1.0
+depends:
+- name: mu-tools-test
+  path: ../mu-tools-test

data/test/smoke_test.rb

@@ -0,0 +1,75 @@
+#!/usr/local/ruby-current/bin/ruby
+
+require 'thread'
+require 'optimist'
+
+$opts = Optimist::options do
+  banner <<-EOS
+Usage:
+#{$0} [-s <skipaz>] [-n <nocleanup>]
+  EOS
+  opt :skipaz, "skip an availability zone", :require => false, :type => :string
+  opt :nocleanup, "no cleanup on successful run"
+end
+
+def test(file, flags = "")
+  bok = "/opt/mu/lib/demo/#{file}"
+  filename = file.split('.').first+flags.gsub(/ /, "")
+  output = "#{Dir.home}/#{filename}.out"
+
+  puts "deploying #{bok} #{flags}; sending output to #{output}"
+
+  cmd="/opt/mu/bin/mu-deploy #{bok} #{flags}"
+  if $opts[:skipaz]
+    cmd += " -p azskip=#{$opts[:skipaz]}"
+  end
+  
+  `#{cmd} >& #{output}`
+  status = $?.to_i
+
+  deploy_id = File.foreach(output).grep(/Deployment id:/)[0].scan(/\(([^\)]+)\)/).last.first
+  if status == 0
+    message = "Deployment of #{bok} #{flags} as #{deploy_id} was successful"
+    if !$opts[:nocleanup] 
+      message += ", tore down #{deploy_id}" 
+      `/opt/mu/bin/mu-cleanup -s #{deploy_id} >> #{output}`
+    end
+  else
+    message = "error deploying #{bok} #{flags}. See #{output} for details" 
+  end
+  puts message
+
+  status
+end
+
+def main
+  boks = %w(simple-server-rails.yaml simple-windows.yaml simple-server.yaml dnszone.yaml cache_cluster.yaml wordpress.yaml)
+  successes = 0
+  failures = 0
+
+  work_q = Queue.new
+  boks.each{ |x|
+    work_q.push({ "bok" => x, "arg" => "-c" })
+    work_q.push({ "bok" => x, "arg" => "" })
+  }
+  workers = (0...4).map do
+    Thread.new do
+      begin
+        while job = work_q.pop(true)
+          status = test job["bok"], job["arg"]
+          if status == 0
+            successes += 1
+          else
+            failures += 1
+          end
+        end
+      rescue ThreadError
+      end
+    end
+  end; "ok"
+  workers.map(&:join); "ok"
+
+  puts "#{successes} successes, #{failures} failures"
+end
+
+main