cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-master/recipes/sssd.rb

@@ -0,0 +1,89 @@
+#
+# Cookbook Name:: mu-master
+# Recipe:: sssd
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include_recipe 'mu-master::firewall-holes'
+include_recipe "mu-master::389ds"
+
+package "sssd"
+package "sssd-ldap"
+package "sssd-client"
+package "nss-pam-ldapd" do
+  action :remove
+end
+package "pam_ldap" do
+  action :remove
+end
+package "dbus"
+service "messagebus" do
+  action [:enable, :start]
+end
+package "nscd"
+service "nscd" do
+  action [:disable, :stop]
+end
+package "oddjob-mkhomedir"
+execute "restorecon -r /usr/sbin"
+service "sshd" do
+  action :nothing
+end
+
+# SELinux Policy for oddjobd and its interaction with syslogd
+cookbook_file "syslogd_oddjobd.pp" do
+  path "#{Chef::Config[:file_cache_path]}/syslogd_oddjobd.pp"
+end
+
+execute "Add oddjobd and syslogd interaction to SELinux allow list" do
+  command "/usr/sbin/semodule -i syslogd_oddjobd.pp"
+  cwd Chef::Config[:file_cache_path]
+  not_if "/usr/sbin/semodule -l | grep syslogd_oddjobd"
+  notifies :restart, "service[oddjobd]", :delayed
+end
+
+service "oddjobd" do
+  start_command "sh -x /etc/init.d/oddjobd start" if %w{redhat centos}.include?(node['platform']) && node['platform_version'].to_i == 6  # seems to actually work
+  action [:enable, :start]
+end
+execute "/usr/sbin/authconfig --disablenis --disablecache --disablewinbind --disablewinbindauth --enablemkhomedir --disablekrb5 --enablesssd --enablesssdauth --enablelocauthorize --disableforcelegacy --disableldap --disableldapauth --updateall" do
+  notifies :restart, "service[oddjobd]", :immediately
+  notifies :reload, "service[sshd]", :delayed
+  not_if "grep pam_sss.so /etc/pam.d/password-auth"
+end
+directory "/var/log/sssd" do
+  mode 0750
+  recursive true
+end
+service "sssd" do
+  action :nothing
+  notifies :restart, "service[sshd]", :immediately
+end
+template "/etc/sssd/sssd.conf" do
+  source "sssd.conf.erb"
+  mode 0600
+  owner "root"
+  group "root"
+  notifies :restart, "service[sssd]", :immediately
+  variables(
+    :base_dn => $MU_CFG['ldap']['base_dn'],
+    :user_ou => $MU_CFG['ldap']['user_ou'],
+    :dcs => $MU_CFG['ldap']['dcs']
+  )
+end
+service "sssd" do
+  action [:enable, :start]
+  notifies :restart, "service[sshd]", :immediately
+end

data/cookbooks/mu-master/recipes/update_nagios_only.rb

@@ -0,0 +1,242 @@
+#
+# Cookbook Name:: mu-master
+# Recipe:: update_nagios_only
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include_recipe "nagios::server_source"
+include_recipe "nagios"
+include_recipe 'mu-master::firewall-holes'
+
+if $MU_CFG.has_key?('ldap')
+  include_recipe 'chef-vault'
+  bind_creds = chef_vault_item($MU_CFG['ldap']['bind_creds']['vault'], $MU_CFG['ldap']['bind_creds']['item'])
+  node.normal['nagios']['server_auth_method'] = "ldap"
+  node.normal['nagios']['ldap_bind_dn'] = bind_creds[$MU_CFG['ldap']['bind_creds']['username_field']]
+  node.normal['nagios']['ldap_bind_password'] = bind_creds[$MU_CFG['ldap']['bind_creds']['password_field']]
+  if $MU_CFG['ldap']['type'] == "Active Directory"
+    node.normal['nagios']['ldap_url'] = "ldap://#{$MU_CFG['ldap']['dcs'].first}/#{$MU_CFG['ldap']['base_dn']}?sAMAccountName?sub?(objectClass=*)"
+  else
+    node.normal['nagios']['ldap_url'] = "ldap://#{$MU_CFG['ldap']['dcs'].first}/#{$MU_CFG['ldap']['base_dn']}?uid?sub?(objectClass=*)"
+    node.normal['nagios']['ldap_group_attribute'] = "memberUid"
+    node.normal['nagios']['ldap_group_attribute_is_dn'] = "Off"
+# Trying to use SSL seems to cause mod_ldap to die without logging any errors,
+# currently. Probably an Apache bug? XXX
+#    node.normal['nagios'][:ldap_trusted_global_cert] = "CA_BASE64 #{$MU_CFG['ssl']['chain']}"
+#    node.normal['nagios'][:ldap_trusted_mode] = "SSL"
+  end
+  node.normal['nagios']['server_auth_require'] = "ldap-group #{$MU_CFG['ldap']['user_group_dn']}"
+  node.normal['nagios']['ldap_authoritative'] = "On"
+  node.save
+end
+
+# XXX The Nagios init script from source is buggy; config test always fails
+# when invoked via "service nagios start," which is what the cookbook does.
+# This at least keeps it from trashing our Chef runs.
+file "/etc/sysconfig/nagios" do
+  content "checkconfig=\"false\"\n"
+  mode 0600
+end
+include_recipe "nagios"
+
+# scrub our old stuff if it's around
+["nagios_fifo", "nagios_more_selinux"].each { |policy|
+  execute "/usr/sbin/semodule -r #{policy}" do
+    only_if "/usr/sbin/semodule -l | egrep '^#{policy}(\t|$)'"
+  end
+}
+
+nagios_policies = ["nagios_selinux"]
+
+if platform_family?("rhel") and node['platform_version'].to_i == 7
+  nagios_policies << "nagios_selinux_7"
+end
+
+# Restart Nagios inelegantly, because the standard service resource doesn't
+# seem to work reliably on CentOS 7 or RHEL 7. May be an issue with the nagios
+# community cookbook? Maybe it doesn't do systemctl correctly?
+bash "RHEL7-family Nagios restart" do
+  code <<-EOH
+    /bin/systemctl stop nagios.service
+    /bin/pkill -u nagios
+    /bin/rm -f /var/run/nagios/nagios.pid
+    /bin/systemctl start nagios.service
+  EOH
+  action :nothing
+end
+
+nagios_policies.each { |policy|
+  execute "/usr/sbin/semodule -r #{policy}" do
+    action :nothing
+    only_if "/usr/sbin/semodule -l | egrep '^#{policy}(\t|$)'"
+  end
+  cookbook_file "#{policy}.pp" do
+    path "#{Chef::Config[:file_cache_path]}/#{policy}.pp"
+    notifies :run, "execute[/usr/sbin/semodule -r #{policy}]", :immediately
+  end
+  execute "Add Nagios-related SELinux policies: #{policy}" do
+    command "/usr/sbin/semodule -i #{policy}.pp"
+    cwd Chef::Config[:file_cache_path]
+    not_if "/usr/sbin/semodule -l | egrep '^#{policy}(\t|$)'"
+    notifies :reload, "service[apache2]", :delayed
+    notifies :restart, "service[nrpe]", :delayed
+    if platform_family?("rhel") and node['platform_version'].to_i >= 7
+      notifies :run, "bash[RHEL7-family Nagios restart]", :delayed
+    else
+      notifies :reload, "service[nagios]", :delayed
+    end
+  end
+}
+
+# Workaround for minor Nagios (cookbook?) bug. It looks for this at the wrong
+# URL at the moment, so copy it where it's actually looking.
+if File.exists?("/usr/lib/cgi-bin/nagios/statusjson.cgi")
+  remote_file "/usr/lib/cgi-bin/statusjson.cgi" do
+    source "file:///usr/lib/cgi-bin/nagios/statusjson.cgi"
+    mode 0755
+    owner "root"
+    group "nagios"
+  end
+end
+
+# ... the nagios cookbook is bafflingly inconsistent
+directory "/usr/lib/cgi-bin/nagios" do
+  mode 0755
+  owner "root"
+  group "nagios"
+end
+Dir.glob("/usr/lib/cgi-bin/*.cgi").each { |script|
+  shortname = script.gsub(/.*?\/([^\/]+)$/, '\1')
+  remote_file "/usr/lib/cgi-bin/nagios/#{shortname}" do
+    source "file:///#{script}"
+    mode 0755
+    owner "root"
+    group "nagios"
+  end
+}
+
+["/usr/lib/nagios", "/etc/nagios", "/etc/nagios3", "/var/www/html/docs"].each { |dir|
+  if Dir.exist?(dir)
+    execute "chcon -R -h -t httpd_sys_content_t #{dir}" do
+      not_if "ls -aZ #{dir} | grep ':httpd_sys_content_t:'"
+      returns [0, 1]
+      notifies :reload, "service[apache2]", :delayed
+    end
+  end
+}
+
+["/usr/lib/cgi-bin"].each { |cgidir|
+  if Dir.exist?(cgidir)
+    execute "chcon -R -h -t httpd_sys_script_exec_t #{cgidir}" do
+      not_if "ls -aZ #{cgidir} | grep ':httpd_sys_script_exec_t:'"
+      notifies :reload, "service[apache2]", :delayed
+    end
+  end
+}
+if File.exist?("/usr/lib64/nagios/plugins/check_nagios")
+  execute "chcon -R -h -t nagios_unconfined_plugin_exec_t /usr/lib64/nagios/plugins/check_nagios" do
+    not_if "ls -aZ /usr/lib64/nagios/plugins/check_nagios | grep ':nagios_unconfined_plugin_exec_t:'"
+  end
+end
+
+# execute "chgrp apache /var/log/nagios"
+["/etc/nagios/conf.d/", "/etc/nagios/*.cfg", "/var/run/nagios.pid"].each { |dir|
+  execute "/sbin/restorecon -R #{dir}" do
+    not_if "ls -aZ #{dir} | grep ':nagios_etc_t:'"
+    only_if { ::File.exists?(dir) }
+  end
+}
+
+execute "/sbin/restorecon -R /var/log/nagios"
+
+# The Nagios cookbook currently screws up this setting, so work around it.
+execute "sed -i s/^interval_length=.*/interval_length=1/ || echo 'interval_length=1' >> /etc/nagios/nagios.cfg" do
+  not_if "grep '^interval_length=1$' /etc/nagios/nagios.cfg"
+  if platform_family?("rhel") and node['platform_version'].to_i >= 7
+    notifies :run, "bash[RHEL7-family Nagios restart]", :delayed
+  else
+    notifies :reload, "service[nagios]", :delayed
+  end
+end
+
+package "nagios-plugins-nrpe"
+package "nagios-plugins-disk"
+include_recipe "mu-tools::nrpe"
+
+cookbook_file "/usr/lib64/nagios/plugins/check_mem" do
+  source "check_mem.pl"
+  mode 0755
+  owner "root"
+  notifies :restart, "service[nrpe]", :delayed
+end
+
+file "/etc/sysconfig/nrpe" do
+  content "NRPE_SSL_OPT=\"\"\n"
+end
+
+#Sometimes doesn’t exist on the first run
+directory "/opt/mu/var/nagios_user_home" do
+  owner "nagios"
+	group "nagios"
+	mode 0700
+end
+
+directory "/opt/mu/var/nagios_user_home/.ssh" do
+  owner "nagios"
+	group "nagios"
+	mode 0711
+end
+file "/opt/mu/var/nagios_user_home/.ssh/known_hosts" do
+  owner "nagios"
+	group "nagios"
+	mode 0600
+end
+file "/opt/mu/var/nagios_user_home/.ssh/known_hosts2" do
+  owner "nagios"
+	group "nagios"
+	mode 0600
+end
+
+
+nrpe_check "check_mem" do
+  command "#{node['nrpe']['plugin_dir']}/check_mem"
+  warning_condition '80'
+  critical_condition '95'
+  action :add
+end
+
+nagios_command 'host_notify_by_email' do
+  options 'command_line' => '/usr/bin/printf "%b" "$LONGDATETIME$\n\n$HOSTALIAS$ $NOTIFICATIONTYPE$ $HOSTSTATE$ ('+$MU_CFG['hostname']+')\n\n$HOSTOUTPUT$\n\nLogin: ssh://$HOSTNAME$" | ' + node['nagios']['server']['mail_command'] + ' -s "$NOTIFICATIONTYPE$ - $HOSTALIAS$ $HOSTSTATE$! ('+$MU_CFG['hostname']+')" $CONTACTEMAIL$'
+end
+
+nagios_command 'service_notify_by_email' do
+  options 'command_line' => '/usr/bin/printf "%b" "$LONGDATETIME$ - $SERVICEDESC$ $SERVICESTATE$ ('+$MU_CFG['hostname']+')\n\n$HOSTALIAS$  $NOTIFICATIONTYPE$\n\n$SERVICEOUTPUT$\n\nLogin: ssh://$HOSTNAME$" | ' + node['nagios']['server']['mail_command'] + ' -s "** $NOTIFICATIONTYPE$ - $HOSTALIAS$ - $SERVICEDESC$ - $SERVICESTATE$ ('+$MU_CFG['hostname']+')" $CONTACTEMAIL$'
+end
+
+nagios_command 'host_notify_by_sms_email' do
+  options 'command_line' => '/usr/bin/printf "%b" "$HOSTALIAS$ $NOTIFICATIONTYPE$ $HOSTSTATE$ ('+$MU_CFG['hostname']+')\n\n$HOSTOUTPUT$" | ' + node['nagios']['server']['mail_command'] + ' -s "$HOSTALIAS$ $HOSTSTATE$! ('+$MU_CFG['hostname']+')" $CONTACTPAGER$'
+end
+
+nagios_command 'service_notify_by_sms_email' do
+  options 'command_line' => '/usr/bin/printf "%b" "$SERVICEDESC$ $NOTIFICATIONTYPE$ $SERVICESTATE$ ('+$MU_CFG['hostname']+')\n\n$SERVICEOUTPUT$" | ' + node['nagios']['server']['mail_command'] + ' -s "$HOSTALIAS$ $SERVICEDESC$ $SERVICESTATE$! ('+$MU_CFG['hostname']+')" $CONTACTPAGER$'
+end
+
+execute "chgrp nrpe /etc/nagios/nrpe.d/*"
+execute "/sbin/restorecon /etc/nagios/nrpe.cfg" do
+  if platform_family?("rhel") and node['platform_version'].to_i >= 7
+    notifies :run, "bash[RHEL7-family Nagios restart]", :delayed
+  end
+end
+include_recipe "mu-master::init" # gem permission fixes, mainly

data/cookbooks/mu-master/recipes/vault.rb

@@ -0,0 +1,111 @@
+# Cookbook Name:: mu-master
+# Recipe:: vault
+#
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This recipe is meant to be invoked standalone, by chef-apply. It can safely
+# be invoked during a regular chef-client run.
+#
+# When modifying this recipe, DO NOT ADD EXTERNAL DEPENDENCIES. That means no
+# references to other cookbooks, no include_recipes, no cookbook_files, no
+# templates.
+
+include_recipe 'mu-master::firewall-holes'
+
+# Mangle a bunch of values used by the Consul and Vault community cookbooks
+node.normal['consul']['config']['bootstrap_expect'] = 1 # XXX we only want this on our first run, maybe figure out how to toss it later
+node.normal['consul']['config']['start_join'] = ["127.0.0.1"]
+node.normal['consul']['config']['ca_file'] = "#{$MU_CFG['datadir']}/ssl/Mu_CA.pem"
+node.normal['consul']['config']['key_file'] = "#{$MU_CFG['datadir']}/ssl/consul.key"
+node.normal['consul']['config']['cert_file'] = "#{$MU_CFG['datadir']}/ssl/consul.crt"
+consul_public = $MU_CFG['public_address']
+if !consul_public.match(/^\d+\.\d+\.\d+\.\d+$/)
+  resolver = Resolv::DNS.new
+  begin
+    consul_public = resolver.getaddress(consul_public).to_s
+  end
+end
+# strictly speaking we could split internal vs. external IPs here, but atm
+# we're treating everything not local to this machine as public anyway
+node.normal['consul']['config']['advertise_addr'] = consul_public
+node.normal['consul']['config']['advertise_addr_wan'] = consul_public
+node.normal['consul']['config']['bind_addr'] = "0.0.0.0"
+node.normal['hashicorp-vault']['config']['tls_key_file'] = "#{$MU_CFG['datadir']}/ssl/vault.key"
+node.normal['hashicorp-vault']['config']['tls_cert_file'] = "#{$MU_CFG['datadir']}/ssl/vault.crt"
+node.normal['hashicorp-vault']['config']['address'] = '0.0.0.0:8200'
+node.save
+
+["consul", "vault"].each { |cert|
+  # These community cookbooks aren't bright enough to deal with a stringent
+  # umask, and create these unreadable by the application if we don't do it for
+  # them.
+  directory "fix /opt/#{cert} permissions" do
+    path "/opt/#{cert}"
+    mode 0755
+    notifies :restart, "service[#{cert}]", :delayed
+  end
+}
+
+include_recipe "consul-cluster"
+include_recipe "vault-cluster"
+
+["consul", "vault"].each { |cert|
+  file "fix #{cert} cert permissions" do
+    path "#{$MU_CFG['datadir']}/ssl/#{cert}.crt"
+    owner cert
+    notifies :restart, "service[#{cert}]", :delayed
+  end
+  file "fix #{cert} key permissions" do
+    path "#{$MU_CFG['datadir']}/ssl/#{cert}.key"
+    notifies :restart, "service[#{cert}]", :delayed
+    owner cert
+  end
+  }
+
+directory "/opt/vault/#{node['hashicorp-vault']['version']}" do
+  mode 0755
+  notifies :restart, "service[vault]", :delayed
+end
+
+directory "/etc/consul/ssl" do
+  owner "consul"
+  group "consul"
+  mode 0755
+end
+directory "/etc/vault" do
+  owner "root"
+  mode 0755
+end
+directory "/etc/vault/ssl" do
+  owner "root"
+  mode 0755
+end
+directory "/etc/consul/ssl/CA" do
+  owner "root"
+  mode 0755
+end
+include_recipe 'chef-vault'
+
+file "/etc/consul/ssl/CA/ca.crt" do
+  mode 0644
+  content chef_vault_item("secrets", "consul")["ca_certificate"]
+end
+
+service "consul" do
+  action [:enable, :start]
+end
+service "vault" do
+  action [:enable, :start]
+end

data/cookbooks/mu-master/resources/user.rb

@@ -0,0 +1,19 @@
+#
+# Cookbook Name:: mu-master
+# Resource:: mu_user
+#
+# Copyright 2017, eGlobalTech,
+#
+# All rights reserved - Do Not Redistribute
+#
+
+actions :add, :remove
+default_action :add
+
+attribute :username, :kind_of => String, :name_attribute => true, :required => true
+attribute :realname, :kind_of => String, :required => true
+attribute :email, :kind_of => String, :required => true
+attribute :password, :kind_of => String, :required => false
+attribute :admin, :kind_of => [TrueClass, FalseClass], :required => false, :default => false
+attribute :orgs, :kind_of => Array, :required => false
+attribute :remove_orgs, :kind_of => Array, :required => false

data/cookbooks/mu-master/templates/default/389-directory-setup.inf.erb

@@ -0,0 +1,28 @@
+[General] 
+FullMachineName= <%= @address %>
+SuiteSpotUserID= nobody 
+SuiteSpotGroup= nobody 
+AdminDomain= <%= @domain %>
+ServerRoot = /usr/lib64/dirsrv
+StrictHostCheck = false
+ConfigDirectoryAdminID= <%= @creds["cfg_directory_adm"]["user"] %> 
+ConfigDirectoryAdminPwd= <%= @creds["cfg_directory_adm"]["pw"] %> 
+ConfigDirectoryLdapURL= ldap://<%= @address %>:389/o=NetscapeRoot 
+
+[admin] 
+Port= 9830
+ServerIpAddress= 0.0.0.0
+ServerAdminID= <%= @creds["cfg_directory_adm"]["user"] %> 
+ServerAdminPwd= <%= @creds["cfg_directory_adm"]["pw"] %>
+
+[slapd] 
+AddOrgEntries = Yes
+AddSampleEntries = No
+SlapdConfigForMC= Yes 
+UseExistingMC= No 
+ServerPort= 389 
+ServerIdentifier= <%= @hostname.gsub(/[^a-z0-9#%:@_-]/i, "_") %> 
+Suffix= <%= @domain_dn %>
+naming_value= <%= @domain %>
+RootDN= <%= @creds["root_dn_user"]["user"] %>
+RootDNPwd= <%= @creds["root_dn_user"]["pw"] %>

data/cookbooks/mu-master/templates/default/chef-server.rb.erb

@@ -0,0 +1,18 @@
+server_name='<%= $MU_CFG['public_address'] %>'
+api_fqdn server_name
+nginx['server_name'] = server_name
+nginx['enable_non_ssl'] = false
+nginx['non_ssl_port'] = 81
+nginx['ssl_port'] = 7443
+nginx['ssl_ciphers'] = 'HIGH:!MEDIUM:!3DES:!LOW:!kEDH:!aNULL:!ADH:!eNULL:!EXP:!SSLv2:!SEED:!CAMELLIA:!PSK'
+nginx['ssl_protocols'] = 'TLSv1.2'
+bookshelf['external_url'] = 'https://'+server_name+':7443'
+bookshelf['vip_port'] = 7443
+<% if $MU_CFG.has_key?("ssl") %>
+nginx['ssl_certificate'] = '<%= $MU_CFG["ssl"]["cert"] %>'
+nginx['ssl_certificate_key'] = '<%= $MU_CFG["ssl"]["key"] %>'
+<% if $MU_CFG["ssl"].has_key?("chain") %>
+nginx['ssl_ca_path'] = '<%= File.dirname($MU_CFG["ssl"]["chain"]) %>'
+nginx['ssl_ca_file'] = '<%= File.basename($MU_CFG["ssl"]["chain"]) %>'
+<% end %>
+<% end %>

data/cookbooks/mu-master/templates/default/dhclient-eth0.conf.erb

@@ -0,0 +1,9 @@
+interface "eth0" {
+#  <%= @search_domains.join(", ") %>
+<% if @search_domains.size > 0 %>
+  supersede domain-search <%= @search_domains.map{|dom| dom = '"'+dom+'"' }.join(", ") %>;
+<% end %>
+<% if node['ad']['dc_ips'].size > 0 %>
+  prepend domain-name-servers <%= node['ad']['dc_ips'].join(", ") %>;
+<% end rescue NoMethodError %>
+}

data/cookbooks/mu-master/templates/default/mu-momma-cat.erb

@@ -0,0 +1,149 @@
+#!/bin/bash
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# mu-momma-cat		The listening server for Mu bootstrap requests.
+#
+# chkconfig: 2345 55 25
+# description: The listening server for Mu bootstrap requests. Uses \
+#							 the Ruby 'thin' webserver.
+#
+# processname: thin
+# pidfile: /var/run/mommacat.pid
+
+### BEGIN INIT INFO
+# Provides: mu-momma-cat
+# Required-Start: $local_fs $network $syslog
+# Required-Stop: $local_fs $syslog
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: The listening server for Mu bootstrap requests.
+# Description:       The listening server for Mu bootstrap requests.
+### END INIT INFO
+
+# source function library
+. /etc/rc.d/init.d/functions
+
+RETVAL=0
+THIN="/usr/local/ruby-current/bin/thin"
+MU_RUBY="/usr/local/ruby-current/bin/bundle exec /usr/local/ruby-current/bin/ruby"
+LOG_FILE="/var/log/mu-momma-cat.log"
+PID_FILE="/var/run/mommacat.pid"
+PORT=2260
+prog="mu-momma-cat"
+lockfile=/var/lock/subsys/mommacat
+
+USER=`whoami`
+if [ "$USER" != "root" ];then
+	echo "Momma Cat must be run with root privileges."
+	exit 1
+fi
+HOMEDIR="`eval echo ~$USER`"
+
+MU_INSTALLDIR="<%= @installdir %>"
+MU_SSL_CERT="<%= @ssl_cert %>"
+MU_SSL_KEY="<%= @ssl_key %>"
+if [ -z $MU_LIBDIR ];then
+	if [ -z $MU_INSTALLDIR ];then
+		echo "MU_LIBDIR and MU_INSTALLDIR are unset, I don't know where to find Mu!"
+		exit 1
+	else
+		MU_LIBDIR="$MU_INSTALLDIR/lib"
+	fi
+fi
+
+mudir="$MU_LIBDIR/modules"
+
+runlevel=$(set -- $(runlevel); eval "echo \$$#" )
+
+start()
+{
+	cd $mudir || ( echo "Couldn't cd to $mudir" && exit 1 )
+	[ -f $mudir/mommacat.ru ] || exit 5
+
+	echo -n $"Starting $prog: "
+	ulimit -s unlimited
+	$MU_RUBY $THIN --threaded --daemonize --port $PORT --pid $PID_FILE --log $LOG_FILE --ssl --ssl-key-file $MU_SSL_KEY --ssl-cert-file $MU_SSL_CERT --ssl-disable-verify --tag "mu-momma-cat" -R mommacat.ru start && success || failure
+	RETVAL=$?
+	[ $RETVAL -eq 0 ] && touch $lockfile
+	echo
+	return $RETVAL
+}
+
+stop()
+{
+	cd $mudir || ( echo "Couldn't cd to $mudir" && exit 1 )
+	echo -n $"Stopping $prog: "
+	killproc -p $PID_FILE $THIN
+	RETVAL=$?
+	# if we are in halt or reboot runlevel kill all running sessions
+	# so the TCP connections are closed cleanly
+	if [ "x$runlevel" = x0 -o "x$runlevel" = x6 ] ; then
+	    trap '' TERM
+	    killall $prog 2>/dev/null
+	    trap TERM
+	fi
+	[ $RETVAL -eq 0 ] && rm -f $lockfile
+	echo
+}
+
+restart() {
+	stop
+	start
+}
+
+case "$1" in
+	start)
+		start
+		;;
+	stop)
+		stop
+		;;
+	restart)
+		restart
+		;;
+	status)
+		if [ ! -f $PID_FILE ];then
+			maybe="`ps auxww | egrep \"thin server.*\[$prog\]\" | grep -v grep`"
+			if [ ! -z "$maybe" ];then
+				echo "$PID_FILE is missing, but I see a process that might be ours"
+				echo $maybe
+			else
+				echo "$prog not running"
+			fi
+			RETVAL=1
+		else
+			if [ -z "`cat $PID_FILE`" ];then
+				echo "$PID_FILE appears to be present but empty"
+				RETVAL=1
+			else
+				ps uwwp `cat $PID_FILE` | grep "$prog"
+				RETVAL=$?
+				if [ $RETVAL -ne 0 ];then
+					echo "$prog doesn't seem to be running"
+					if [ -f "$PID_FILE" ];then
+						echo "$PID_FILE may be stale"
+					fi
+				else
+					echo "$prog is running"
+					RETVAL=0
+				fi
+			fi
+		fi
+		;;
+	*)
+		echo $"Usage: $0 {start|stop|restart|status}"
+		RETVAL=2
+esac
+exit $RETVAL

data/cookbooks/mu-master/templates/default/mu.rc.erb

@@ -0,0 +1,9 @@
+# bash/sh environment support for Mu tools. Intended for the system (root)
+# user. Regular users get a .murc installed by mu-user-manage, from the template
+# in <%= @installdir %>/lib/install/user-dot-murc.erb
+export PATH="<%= @installdir %>/bin:/usr/local/ruby-current/bin:${PATH}:/opt/opscode/embedded/bin"
+#export MU_INSTALLDIR="<%= @installdir %>"
+#export MU_DATADIR="<%= @installdir %>/var"
+
+alias vi=vim
+export EDITOR=vim