cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-jenkins/files/default/cleanup_deploy_config.xml

@@ -0,0 +1,73 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<project>
+  <actions/>
+  <description>Clean up an extant Cloudamatic Deploy</description>
+  <keepDependencies>false</keepDependencies>
+  <properties>
+    <hudson.security.AuthorizationMatrixProperty>
+      <blocksInheritance>true</blocksInheritance>
+      <permission>hudson.model.Item.Cancel:master_user</permission>
+      <permission>hudson.model.Item.Cancel:mu_user</permission>
+      <permission>hudson.model.Item.Delete:master_user</permission>
+      <permission>hudson.model.Item.Delete:mu_user</permission>
+      <permission>hudson.model.Item.Read:master_user</permission>
+      <permission>hudson.model.Item.Read:mu_user</permission>
+      <permission>hudson.model.Item.Workspace:master_user</permission>
+      <permission>hudson.model.Item.Workspace:mu_user</permission>
+      <permission>hudson.model.Item.Build:master_user</permission>
+      <permission>hudson.model.Item.Build:mu_user</permission>
+      <permission>hudson.model.Item.Move:master_user</permission>
+      <permission>hudson.model.Item.Move:mu_user</permission>
+      <permission>hudson.model.Item.Configure:master_user</permission>
+      <permission>hudson.model.Item.Configure:mu_user</permission>
+      <permission>hudson.model.Item.Discover:master_user</permission>
+      <permission>hudson.model.Item.Discover:mu_user</permission>
+    </hudson.security.AuthorizationMatrixProperty>
+    <hudson.model.ParametersDefinitionProperty>
+      <parameterDefinitions>
+        <com.seitenbau.jenkins.plugins.dynamicparameter.ChoiceParameterDefinition plugin="dynamicparameter@0.2.0">
+          <name>Target_Deploy</name>
+          <description></description>
+          <__uuid>8a5d5b3c-c975-44f8-a1e2-7d3c4f3306f8</__uuid>
+          <__remote>false</__remote>
+          <__script>def proc = &quot;ls -1a /home/jenkins/.mu/var/deployments/&quot;.execute()
+            def b = new StringBuffer()
+            proc.consumeProcessErrorStream(b)
+            def list = proc.text.readLines()
+          </__script>
+          <__localBaseDirectory serialization="custom">
+            <hudson.FilePath>
+              <default>
+                <remote>/home/jenkins/dynamic_parameter/classpath</remote>
+              </default>
+              <boolean>true</boolean>
+            </hudson.FilePath>
+          </__localBaseDirectory>
+          <__remoteBaseDirectory>dynamic_parameter_classpath</__remoteBaseDirectory>
+          <__classPath></__classPath>
+          <readonlyInputField>false</readonlyInputField>
+        </com.seitenbau.jenkins.plugins.dynamicparameter.ChoiceParameterDefinition>
+      </parameterDefinitions>
+    </hudson.model.ParametersDefinitionProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <canRoam>true</canRoam>
+  <disabled>false</disabled>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <triggers/>
+  <concurrentBuild>false</concurrentBuild>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>source ~/.murc
+        mu-cleanup $Target_Deploy
+      </command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers/>
+  <buildWrappers>
+    <hudson.plugins.ansicolor.AnsiColorBuildWrapper plugin="ansicolor@0.4.1">
+      <colorMapName>xterm</colorMapName>
+    </hudson.plugins.ansicolor.AnsiColorBuildWrapper>
+  </buildWrappers>
+</project>

data/cookbooks/mu-jenkins/files/default/deploy_config.xml

@@ -0,0 +1,44 @@
+<project>
+  <actions/>
+  <description></description>
+  <keepDependencies>false</keepDependencies>
+  <properties>
+    <hudson.security.AuthorizationMatrixProperty>
+      <blocksInheritance>true</blocksInheritance>
+      <permission>hudson.model.Item.Cancel:master_user</permission>
+      <permission>hudson.model.Item.Cancel:mu_user</permission>
+      <permission>hudson.model.Item.Delete:master_user</permission>
+      <permission>hudson.model.Item.Delete:mu_user</permission>
+      <permission>hudson.model.Item.Read:master_user</permission>
+      <permission>hudson.model.Item.Read:mu_user</permission>
+      <permission>hudson.model.Item.Workspace:master_user</permission>
+      <permission>hudson.model.Item.Workspace:mu_user</permission>
+      <permission>hudson.model.Item.Build:master_user</permission>
+      <permission>hudson.model.Item.Build:mu_user</permission>
+      <permission>hudson.model.Item.Move:master_user</permission>
+      <permission>hudson.model.Item.Move:mu_user</permission>
+      <permission>hudson.model.Item.Configure:master_user</permission>
+      <permission>hudson.model.Item.Configure:mu_user</permission>
+      <permission>hudson.model.Item.Discover:master_user</permission>
+      <permission>hudson.model.Item.Discover:mu_user</permission>
+    </hudson.security.AuthorizationMatrixProperty>
+  </properties>
+  <scm class="hudson.scm.NullSCM"/>
+  <canRoam>true</canRoam>
+  <disabled>false</disabled>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <triggers/>
+  <concurrentBuild>false</concurrentBuild>
+  <builders>
+    <hudson.tasks.Shell>
+      <command>/opt/mu/bin/mu-deploy /opt/mu/lib/demo/simple-server.yaml</command>
+    </hudson.tasks.Shell>
+  </builders>
+  <publishers/>
+  <buildWrappers>
+    <hudson.plugins.ansicolor.AnsiColorBuildWrapper plugin="ansicolor@0.4.1">
+      <colorMapName>xterm</colorMapName>
+    </hudson.plugins.ansicolor.AnsiColorBuildWrapper>
+  </buildWrappers>
+</project>

data/cookbooks/mu-jenkins/metadata.rb

@@ -0,0 +1,21 @@
+name 'mu-jenkins'
+maintainer 'eGlobalTech, Inc'
+maintainer_email 'mu-developers@googlegroups.com'
+license 'BSD-3-Clause'
+description 'Installs/Configures mu-jenkins'
+long_description IO.read(File.join(File.dirname(__FILE__), 'README.md'))
+source_url 'https://github.com/cloudamatic/mu'
+issues_url 'https://github.com/cloudamatic/mu/issues'
+chef_version '>= 12.1' if respond_to?(:chef_version)
+version '0.6.0'
+
+%w( amazon centos redhat windows ).each do |os|
+	supports os
+end
+
+depends 'java', '~> 2.2.0'
+depends 'jenkins', '~> 6.2.0'
+depends 'chef-vault', '~> 3.1.1'
+depends 'mu-master'
+depends 'mu-utility'
+depends 'mu-tools'

data/cookbooks/mu-jenkins/recipes/default.rb

@@ -0,0 +1,195 @@
+# Cookbook Name:: mu-jenkins
+# Recipe:: default
+#
+# Copyright 2015, eGlobalTech, Inc
+#
+# All rights reserved - Do Not Redistribute
+#
+
+include_recipe 'mu-tools::disable-requiretty'
+include_recipe 'chef-vault'
+
+directory "/opt/java_jce" do
+  mode 0755
+end
+
+admin_vault = chef_vault_item(node['jenkins_admin_vault']['vault'], node['jenkins_admin_vault']['item'])
+
+directory "Mu Jenkins home #{node['jenkins']['master']['home']}" do
+  path node['jenkins']['master']['home']
+  owner "jenkins"
+  recursive true
+  notifies :restart, 'service[jenkins]', :immediately
+end
+
+package %w{git bzip2}
+
+#remote_file "#{node['jenkins']['master']['home']}/plugins/mailer.jpi" do
+#  source "http://updates.jenkins-ci.org/latest/mailer.hpi"
+#  owner "jenkins"
+#end
+
+ruby_block 'wait for jenkins' do
+  block do
+    sleep 30
+  end
+  action :nothing
+end
+
+
+# If security was enabled in a previous chef run then set the private key in the run_state
+# now as required by the Jenkins cookbook
+if node['application_attributes']['jenkins_auth_set']
+ruby_block 'set jenkins private key' do
+  block do
+    Chef::Log.info("Setting the previously enabled jenkins private key")
+    node.run_state[:jenkins_private_key] = admin_vault['private_key'].strip
+  end
+end
+end
+
+restart_jenkins = false
+
+directory "mu-jenkins fix #{Chef::Config[:file_cache_path]} perms" do
+  path Chef::Config[:file_cache_path]
+  mode 0755
+end
+cacheparent = File.expand_path("..", Chef::Config[:file_cache_path])
+directory "mu-jenkins fix #{cacheparent} perms" do
+  path cacheparent
+  mode 0755
+end
+
+
+# Download ALPN Jar file and fix to JENKINS_JAVA_OPTIONS
+# open_jdk_version = `java -version 2>&1`
+open_jdk_version = shell_out('java -version 2>&1').stdout.str
+if open_jdk_version.include?("openjdk version \"1.8") and node['platform_family'] == 'rhel'
+
+  remote_file 'download_anlp_jar' do
+    source node['jenkins']['alpn']['download_link']
+    path "/home/jenkins/alpn-boot-#{node['jenkins']['alpn']['version']}.jar"
+    owner "jenkins"
+    notifies :restart, "service[jenkins]",:delayed
+  end
+
+  service "jenkins" do
+    action :nothing
+  end
+
+end
+
+
+
+
+node['jenkins_plugins'].each { |plugin|
+#  if !::File.exists?("#{node['jenkins']['master']['home']}/plugins/#{plugin}.jpi")
+#    restart_jenkins = true
+#  end
+# XXX this runs as the 'jenkins' user, yet download the files as 0600/root
+  jenkins_plugin plugin
+  # do
+    # notifies :restart, 'service[jenkins]', :delayed
+    #not_if { ::File.exists?("#{node['jenkins']['master']['home']}/plugins/#{plugin}.jpi") }
+  # end
+}
+
+if !node['application_attributes']['jenkins_auth_set']
+  jenkins_command 'safe-restart'
+  jenkins_private_key_credentials admin_vault['username'] do
+    id '1671945-9fa7-4d24-ac87-51ea3b2aef4c'
+    description admin_vault['username']
+    private_key admin_vault['private_key'].strip
+  end
+end
+
+# The Jenkins service user that this cookbook uses MUST exist in our directory
+mu_master_user admin_vault['username'] do
+  realname admin_vault['username']
+#  email $MU_CFG['jenkins']['admin_email'] || $MU_CFG['admin_email']
+  email "mu-developers@googlegroups.com"
+end
+
+# Add the admin user only if it has not been added already then notify the resource
+# to configure the permissions for the admin user.  Note that we check for existence of jenkins_auth_set,
+# not value
+jenkins_user admin_vault['username'] do
+  full_name admin_vault['username']
+  email "mu-developers@googlegroups.com"
+  public_keys [admin_vault['public_key'].strip]
+  #not_if { node['application_attributes'].attribute?('jenkins_auth_set') }
+end
+
+
+# Configure the permissions so that login is required and the admin user is an administrator
+# after this point the private key will be required to execute jenkins scripts (including querying
+# if users exist) so we notify the `set the security_enabled flag` resource to set this up.
+# Also note that since Jenkins 1.556 the private key cannot be used until after the admin user
+# has been added to the security realm
+uidsearch = "uid={0}"
+uidsearch = "sAMAccountName={0}" if $MU_CFG['ldap']['type'] == "Active Directory"
+membersearch = "(| (member={0}) (uniqueMember={0}) (memberUid={1}))"
+membersearch = "memberUid={0}" if $MU_CFG['ldap']['type'] == "389 Directory Services"
+bind_creds = chef_vault_item($MU_CFG['ldap']['bind_creds']['vault'], $MU_CFG['ldap']['bind_creds']['item'])
+jenkins_admins = ::MU::Master.listUsers.delete_if { |u, data| !data['admin'] }.keys
+#jenkins_regular = ::MU::Master.listUsers.delete_if { |u, data| data['admin'] or u == "jenkins" }.keys
+regular_user_perms = ["Item.BUILD", "Item.CREATE", "Item.DISCOVER", "Item.READ"]
+jenkins_script 'configure_jenkins_auth' do
+  command <<-EOH.gsub(/^ {4}/, '')
+  import jenkins.model.*
+  import hudson.security.*
+  import org.jenkinsci.plugins.*
+  def instance = Jenkins.getInstance()
+  def hudsonRealm = new HudsonPrivateSecurityRealm(false)
+  String groupSearchFilter = 'memberUid={0}'
+  SecurityRealm ldapRealm = new LDAPSecurityRealm(server='ldap://#{$MU_CFG['ldap']['dcs'].first}', rootDN = '#{$MU_CFG['ldap']['base_dn']}', userSearchBase='#{$MU_CFG['ldap']['user_ou'].sub(/,.*/, "")}', userSearch="#{uidsearch}", groupSearchBase='#{$MU_CFG['ldap']['group_ou'].sub(/,.*/, "")}', groupSearchFilter="", groupMembershipFilter = '#{membersearch}', managerDN = '#{bind_creds[$MU_CFG['ldap']['bind_creds']['username_field']]}', managerPasswordSecret = '#{bind_creds[$MU_CFG['ldap']['bind_creds']['password_field']]}', inhibitInferRootDN = false, disableMailAddressResolver = false, cache = null)
+  instance.setSecurityRealm(ldapRealm)
+  def strategy = new ProjectMatrixAuthorizationStrategy()
+  strategy.add(Jenkins.ADMINISTER, "#{$MU_CFG['ldap']['admin_group_name']}")
+  strategy.add(Jenkins.ADMINISTER, "#{admin_vault['username']}")
+  #{jenkins_admins.map { |u| "strategy.add(Jenkins.ADMINISTER, \"#{u}\")" }.join("\n")}
+  strategy.add(Jenkins.READ, "authenticated")
+  #{regular_user_perms.map { |p| "strategy.add(hudson.model.#{p}, \"authenticated\")" }.join("\n")}
+  instance.setAuthorizationStrategy(strategy)
+  instance.save()
+  EOH
+#  not_if "grep managerDN #{node['jenkins']['master']['home']}/config.xml | grep #{bind_creds[$MU_CFG['ldap']['bind_creds']['username_field']]}"
+  notifies :run, 'ruby_block[configure_jenkins_auth_set]', :immediately
+  action :nothing unless !::File.size?("#{node['jenkins']['master']['home']}/config.xml") or !::File.read("#{node['jenkins']['master']['home']}/config.xml").match(bind_creds[$MU_CFG['ldap']['bind_creds']['username_field']])
+end
+
+file "#{node['jenkins']['master']['home']}/user-list-chef-guard" do
+  content "
+#{jenkins_admins.map { |u| "strategy.add(Jenkins.ADMINISTER, \"#{u}\")" }.join("\n")}
+#{regular_user_perms.map { |p| "strategy.add(Jenkins.#{p}, \"authenticated\")" }.join("\n")}
+#{bind_creds[$MU_CFG['ldap']['bind_creds']['username_field']]}
+"
+  notifies :execute, "jenkins_script[configure_jenkins_auth]", :immediately
+end
+
+# Set the security enabled flag and set the run_state to use the configured private key
+ruby_block 'configure_jenkins_auth_set' do
+  block do
+    node.run_state[:jenkins_private_key] = admin_vault['private_key'].strip
+    node.normal['application_attributes']['jenkins_auth_set'] = true
+    node.save
+  end
+  action :nothing
+end
+
+
+
+# Configure users from the vault
+#node['jenkins_users'].each { |user|
+#  user_vault = chef_vault_item(user[:vault], user[:vault_item])
+#
+#  # XXX This is dangerous. What if we stupidly step on the account of a
+#  # "real" user?
+#  ::MU::Master::LDAP.manageUser(user[:user_name], name: user[:fullname], password: user_vault[user[:user_name]+"_password"], admin: false, email: user[:email])
+#  jenkins_user user[:user_name] do
+#    full_name user[:fullname]
+#    email user[:email]
+#    password user_vault["#{user[:user_name]}_password"]
+#    sensitive true
+#  end
+#}

data/cookbooks/mu-jenkins/recipes/node-ssh-config.rb

@@ -0,0 +1,54 @@
+#
+# Cookbook Name:: mu-jenkins
+# Recipe:: node-ssh-config
+#
+# Copyright 2015, eGlobalTech, Inc
+#
+# All rights reserved - Do Not Redistribute
+#
+
+include_recipe 'mu-jenkins::public_key'
+include_recipe 'mu-tools::disable-requiretty'
+include_recipe 'chef-vault'
+
+ssh_vault = chef_vault_item(node['jenkins_ssh_vault']['vault'], node['jenkins_ssh_vault']['item'])
+
+case node['platform']
+  when platform_family?('rhel')
+    if platform?("centos")
+      ssh_user = "root" if node['platform_version'].to_i == 6
+      ssh_user = "centos" if node['platform_version'].to_i == 7
+    else
+      ssh_user = "ec2-user"
+    end
+
+    directory "#{node['jenkins']['master']['home']}/.ssh" do
+      owner "jenkins"
+      group "jenkins"
+      mode 0700
+    end
+
+    ssh_key_path = "#{node['jenkins']['master']['home']}/.ssh/jenkins_ssh"
+
+    template "#{node['jenkins']['master']['home']}/.ssh/config" do
+      source "ssh_config.erb"
+      owner "jenkins"
+      group "jenkins"
+      mode 0600
+      variables(
+          :ssh_user => ssh_user,
+          :ssh_key_path => ssh_key_path,
+          :ssh_urls => node['jenkins_ssh_urls']
+      )
+    end
+
+    file ssh_key_path do
+      owner "jenkins"
+      group "jenkins"
+      mode 0400
+      content ssh_vault['private_key'].strip
+      sensitive true
+    end
+  else
+    Chef::Log.info("Unsupported platform #{node['platform']}")
+end

data/cookbooks/mu-jenkins/recipes/public_key.rb

@@ -0,0 +1,24 @@
+#
+# Cookbook Name:: mu-jenkins
+# Recipe:: default
+#
+# Copyright 2015, eGlobalTech, Inc
+#
+# All rights reserved - Do Not Redistribute
+#
+
+case node['platform']
+  when platform_family?('rhel')
+    include_recipe 'chef-vault'
+
+    ssh_vault = chef_vault_item(node['jenkins_ssh_vault']['vault'], node['jenkins_ssh_vault']['item'])
+
+    ssh_authorized_keys = "/root/.ssh/authorized_keys" if node['platform_version'].to_i == 6
+    ssh_authorized_keys = "/home/centos/.ssh/authorized_keys" if node['platform_version'].to_i == 7
+
+    execute "echo '#{ssh_vault['public_key'].strip}' >> #{ssh_authorized_keys}" do
+      not_if "grep '^#{ssh_vault['public_key'].strip}$' #{ssh_authorized_keys}"
+    end
+  else
+    Chef::Log.info("Unsupported platform #{node['platform']}")
+end

data/cookbooks/mu-jenkins/templates/default/example_job.config.xml.erb

@@ -0,0 +1,24 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<project>
+  <actions/>
+  <description></description>
+  <keepDependencies>false</keepDependencies>
+  <properties/>
+  <scm class="hudson.scm.NullSCM"/>
+  <canRoam>true</canRoam>
+  <disabled>false</disabled>
+  <blockBuildWhenDownstreamBuilding>false</blockBuildWhenDownstreamBuilding>
+  <blockBuildWhenUpstreamBuilding>false</blockBuildWhenUpstreamBuilding>
+  <triggers/>
+  <concurrentBuild>false</concurrentBuild>
+  <builders>
+    <org.jvnet.hudson.plugins.SSHBuilder plugin="ssh@2.4">
+      <siteName><%= @ssh_user %>@<%= @node_ip %>:22</siteName>
+      <command>sudo su - &lt;&lt; eoh
+chef-client
+eoh</command>
+    </org.jvnet.hudson.plugins.SSHBuilder>
+  </builders>
+  <publishers/>
+  <buildWrappers/>
+</project>

data/cookbooks/mu-jenkins/templates/default/org.jvnet.hudson.plugins.SSHBuildWrapper.xml.erb

@@ -0,0 +1,14 @@
+<?xml version='1.0' encoding='UTF-8'?>
+<org.jvnet.hudson.plugins.SSHBuildWrapper_-DescriptorImpl plugin="ssh@2.4">
+  <sites>
+    <org.jvnet.hudson.plugins.SSHSite>
+      <hostname><%= @node_ip %></hostname>
+      <port>22</port>
+      <username><%= @ssh_user %></username>
+      <password></password>
+      <keyfile><%= @ssh_key_path %></keyfile>
+      <serverAliveInterval>0</serverAliveInterval>
+      <pty>false</pty>
+    </org.jvnet.hudson.plugins.SSHSite>
+  </sites>
+</org.jvnet.hudson.plugins.SSHBuildWrapper_-DescriptorImpl>

data/cookbooks/mu-jenkins/templates/default/ssh_config.erb

@@ -0,0 +1,6 @@
+<% @ssh_urls.each { |url| %>
+Host <%= url %>
+  User <%= @ssh_user %>
+  IdentityFile <%= @ssh_key_path %>
+  StrictHostKeyChecking no
+<% } %>

data/cookbooks/mu-master/CHANGELOG.md

@@ -0,0 +1,13 @@
+mu-master CHANGELOG
+====================
+
+This file is used to list changes made in each version of the mu-master cookbook.
+
+0.1.0
+-----
+- [your_name] - Initial release of mu-master
+
+- - -
+Check the [Markdown Syntax Guide](http://daringfireball.net/projects/markdown/syntax) for help with Markdown.
+
+The [Github Flavored Markdown page](http://github.github.com/github-flavored-markdown/) describes the differences between markdown on github and standard markdown.

data/cookbooks/mu-master/LICENSE

@@ -0,0 +1,37 @@
+Through accessing, reading, or utilizing this software in any manner whatsoever
+or through any means whatsoever, whether the access, reading or use is either
+solely looking at this software or this software has been integrated into any
+derivative work, the party accessing,  reading, or utilizing the software
+directly or indirectly agrees to abide by the following license. 
+
+The eGlobalTech Cloud Automation Platform is the Copyright (c) 2014 of Global
+Tech Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+Global Tech, Inc. is the co-owner of any derivative works created with this
+software. 
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+

data/cookbooks/mu-master/README.md

@@ -0,0 +1,6 @@
+mu-master Cookbook
+===================
+
+This is the key Mu-master cookbook! 
+
+TODO: Improve Readme.md

data/cookbooks/mu-master/attributes/default.rb

@@ -0,0 +1,95 @@
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+default['firewall']['redhat7_iptables'] = true
+default['apache']['docroot_dir'] = "/var/www/html"
+default['apache']['default_site_enabled'] = false
+default['apache']['mod_ssl']['cipher_suite'] = "ALL:!3DES:!ADH:!EXPORT:!SSLv2:!RC4+RSA:+HIGH:!MEDIUM:!LOW"
+default['apache']['mod_ssl']['directives']['SSLProtocol'] = "all -SSLv2 -SSLv3"
+
+default['apache']['contact'] = $MU_CFG['mu_admin_email']
+default['apache']['traceenable'] = 'Off'
+
+default["apache"]["listen"] = ["*:80", "*:443", "*:8443"]
+
+override["nagios"]["http_port"] = 8443
+default['nagios']['enable_ssl'] = true
+default['nagios']['sysadmin_email'] = $MU_CFG['mu_admin_email']
+default['nagios']['ssl_cert_file'] = $MU_CFG['ssl']['cert']
+default['nagios']['ssl_cert_key'] = $MU_CFG['ssl']['key']
+if $MU_CFG['ssl'].has_key?("chain") and !$MU_CFG['ssl']['chain'].empty?
+  default['nagios']['ssl_cert_chain_file'] = $MU_CFG['ssl']['chain']
+end
+if !$MU_CFG['public_address'].match(/^\d+\.\d+\.\d+\.\d+$/)
+  default["nagios"]["server_name"] = $MU_CFG['public_address']
+else
+  default["nagios"]["server_name"] = node['hostname']
+  default['nagios']['server']['server_alias'] = $MU_CFG['public_address']
+end
+#default['nagios']['server']['server_alias'] = node[:fqdn]+", "+node[:hostname]+", "+node['local_hostname']+", "+node['local_ipv4']+", "+node['public_hostname']+", "+node['public_ipv4']
+default["nagios"]["log_dir"] = "/var/log/httpd"
+default['nagios']['cgi-bin'] = "/usr/lib/cgi-bin/"
+default['nagios']['cgi-path'] = "/nagios/cgi-bin/"
+default['nagios']['server_role'] = "mu-master"
+default['nagios']['server']['install_method'] = 'source'
+default['nagios']['multi_environment_monitoring'] = true
+default['nagios']['users_databag'] = "nagios_users"
+default['nagios']['conf']['enable_notifications'] = 1
+default['nagios']['interval_length'] = 1
+default['nagios']['conf']['interval_length'] = 1
+default['nagios']['default_host']['notification_interval'] = 7200
+default['nagios']['default_host']['check_interval'] = 180
+default['nagios']['default_host']['retry_interval'] = 60
+default['nagios']['conf']['service_check_timeout'] = 10
+default['nagios']['default_host']['max_check_attempts'] = 4
+default['nagios']['default_host']['check_command'] = "check_node_ssh"
+default['nagios']['default_service']['check_interval'] = 180
+default['nagios']['default_service']['retry_interval'] = 30
+default['nagios']['default_service']['notification_interval'] = 7200
+default['nagios']['server']['url'] = "https://assets.nagios.com/downloads/nagioscore/releases/nagios-4.1.1.tar.gz"
+default['nagios']['server']['version'] = "4.1.1"
+default['nagios']['server']['src_dir'] = "nagios-4.1.1"
+default['nagios']['server']['checksum'] = "986c93476b0fee2b2feb7a29ccf857cc691bed7ca4e004a5361ba11f467b0401"
+# XXX dumb bug in Nagios cookbook
+#default['nagios']['url'] = "https://#{$MU_CFG['public_address']}/nagios"
+default['nagios']['url'] = default["nagios"]["server_name"]
+nrpe_host = []
+nrpe_host << MU.my_public_ip if MU.my_public_ip
+nrpe_host << MU.my_private_ip if MU.my_private_ip
+nrpe_host << node['ipaddress'] if nrpe_host.empty?
+default['nrpe']['allowed_hosts'] = nrpe_host.uniq
+
+# No idea why this is set wrong by default
+default['chef_node_name'] = node.name
+default['nagios']['host_name_attribute'] = 'chef_node_name'
+
+default['application_attributes']['logs']['volume_size_gb'] = 50
+default['application_attributes']['logs']['mount_device'] = "/dev/xvdl"
+default['application_attributes']['logs']['label'] = "#{node['hostname']} /Mu_Logs"
+default['application_attributes']['logs']['secure_location'] = MU.adminBucketName
+default['application_attributes']['logs']['ebs_keyfile'] = "log_vol_ebs_key"
+default['application_attributes']['logs']['mount_directory'] = "/Mu_Logs"
+
+case node['platform']
+  when "centos"
+    ssh_user = "root" if node['platform_version'].to_i == 6
+    ssh_user = "centos" if node['platform_version'].to_i == 7
+  when "redhat"
+    ssh_user = "ec2-user"
+end
+
+default['application_attributes']['sshd_allow_groups'] = "#{ssh_user} mu-users"
+default['application_attributes']['sshd_allow_password_auth'] = true
+default['update_nagios_only'] = false
+default['apache']['listen'] = [80, 443, 8443]

data/cookbooks/mu-master/files/default/0-mu-log-server.conf

@@ -0,0 +1,19 @@
+# make gtls driver the default
+$DefaultNetstreamDriver gtls
+
+# certificate files
+$DefaultNetstreamDriverCAFile /etc/pki/rsyslog/Mu_CA.pem
+$DefaultNetstreamDriverCertFile /etc/pki/rsyslog/rsyslog.crt
+$DefaultNetstreamDriverKeyFile /etc/pki/rsyslog/rsyslog.key
+
+$ModLoad imtcp # load TCP listener
+
+$InputTCPServerStreamDriverMode 1 # run driver in TLS-only mode
+$InputTCPServerStreamDriverAuthMode anon # client is NOT authenticated
+$InputTCPServerRun 10514 # start up listener at port 10514
+
+if $fromhost-ip != '127.0.0.1' then /Mu_Logs/nodes.log
+
+& ~
+
+if $fromhost-ip == '127.0.0.1' then /Mu_Logs/master.log

data/cookbooks/mu-master/files/default/addRSA.ldif

@@ -0,0 +1,8 @@
+dn: cn=RSA,cn=encryption,cn=config
+changetype: add
+objectclass: top
+objectclass: nsEncryptionModule
+cn: RSA
+nsSSLPersonalitySSL: ldap
+nsSSLToken: internal (software)
+nsSSLActivation: on