cloud-mu 1.9.0.pre.beta

data/bin/mu-configure

@@ -0,0 +1,1133 @@
+#!/usr/local/ruby-current/bin/ruby
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+require 'optimist'
+require 'simple-password-gen'
+require 'socket'
+require 'open-uri'
+require 'colorize'
+require 'timeout'
+require 'etc'
+require 'aws-sdk-core'
+require 'json'
+require 'pp'
+require 'readline'
+require 'fileutils'
+require 'erb'
+require 'tmpdir'
+
+GIT_PATTERN = /(((git|ssh|http(s)?)|(git@[\w\.]+))(:(\/\/)?))?([\w\.@\:\/\-~]+)(\.git)?(\/)?/
+
+# Top-level keys in $MU_CFG for which we'll provide interactive, menu-driven
+# configuration.
+$CONFIGURABLES = {
+  "public_address" => {
+    "title" => "Public Address",
+    "desc" => "IP address or hostname",
+    "required" => true,
+    "rootonly" => true,
+    "pattern" => /^(localhost|127\.0\.0\.1|#{Socket.gethostname})$/,
+    "negate_pattern" => true,
+    "changes" => ["389ds", "chef-server", "chefrun", "chefcerts"]
+  },
+  "mu_admin_email" => {
+    "title" => "Admin Email",
+    "desc" => "Administative contact email",
+    "pattern" => /\A([\w+\-].?)+@[a-z\d\-]+(\.[a-z]+)*\.[a-z]+\z/i,
+    "required" => true,
+    "rootonly" => true,
+    "changes" => ["mu-user", "chefrun"]
+  },
+  "mu_admin_name" => {
+    "title" => "Admin Name",
+    "desc" => "Administative contact's full name",
+    "default" => "Mu Administrator",
+    "rootonly" => true,
+    "changes" => ["mu-user", "chefrun"]
+  },
+  "hostname" => {
+    "title" => "Local Hostname",
+    "pattern" => /^[a-z0-9\-_]+$/i,
+    "required" => true,
+    "rootonly" => true,
+    "desc" => "The local system's value for HOSTNAME",
+    "changes" => ["chefrun", "hostname"]
+  },
+  "banner" => {
+    "title" => "Banner",
+    "desc" => "Login banner, displayed in various locations",
+    "rootonly" => true,
+    "changes" => ["chefrun"]
+  },
+  "mu_repository" => {
+    "title" => "Mu Tools Repository",
+    "desc" => "Source repository for Mu tools",
+    "pattern" => GIT_PATTERN,
+    "callback" => :cloneGitRepo,
+    "changes" => ["chefartifacts", "chefrun"],
+    "default" => "git://github.com/cloudamatic/mu.git"
+  },
+  "repos" => {
+    "title" => "Additional Repositories",
+    "desc" => "Optional platform repositories, as a Git URL or Github repo name (ex: eGT-Labs/fema_platform.git)",
+    "pattern" => GIT_PATTERN,
+    "callback" => :cloneGitRepo,
+    "changes" => ["chefartifacts", "chefrun"],
+    "array" => true,
+    "default" => ['https://github.com/cloudamatic/mu_demo_platform']
+  },
+  "master_runlist_extras" => {
+    "title" => "Mu Master Runlist Extras",
+    "desc" => "Optional extra Chef roles or recipes to invoke when running chef-client on this Master (ex: recipe[mycookbook::mumaster])",
+    "array" => true,
+    "rootonly" => true,
+    "changes" => ["chefrun"]
+  },
+  "allow_invade_foreign_vpcs" => {
+    "title" => "Invade Foreign VPCs?",
+    "desc" => "If set to true, Mu will be allowed to modify routing and peering behavior of VPCs which it did not create, but for which it has permissions.",
+    "boolean" => true
+  },
+  "jenkins" => {
+    "title" => "Jenkins Continuous Integration",
+    "rootonly" => true,
+    "subtree" => {
+      "enable" => {
+        "title" => "Enable Jenkins",
+        "desc" => "Enable Jenkins, with UI web-accessible at /jenkins.",
+        "default" => false,
+        "boolean" => true,
+        "changes" => ["chefrun"]
+      },
+      "admin_email" => {
+        "title" => "Jenkins Admin Email",
+        "desc" => "Administative contact email for Jenkins",
+        "pattern" => /\A([\w+\-].?)+@[a-z\d\-]+(\.[a-z]+)*\.[a-z]+\z/i,
+        "changes" => ["chefrun"]
+      },
+      "admin_user" => {
+        "title" => "Jenkins admin username",
+        "desc" => "The name of a Mu user who will serve as the Jenkins admin.",
+        "default" => "jenkins",
+        "changes" => ["chefrun"]
+      }
+    }
+  },
+  "aws" => {
+    "title" => "Amazon Web Services",
+    "subtree" => {
+      "account_number" => {
+        "title" => "Account Number",
+        "desc" => "Account number for the Amazon Web Services account which we administer",
+        "pattern" => /^\d+$/
+      },
+      "region" => {
+        "title" => "Default Region",
+        "desc" => "Default Amazon Web Services region in which we operate"
+      },
+      "access_key" => {
+        "title" => "Access Key",
+        "desc" => "Credentials used for accessing the AWS API (looks like: AKIAINWLOOAA24PBRBZA)",
+        "pattern" => /^[a-z0-9]+$/i
+      },
+      "access_secret" => {
+        "title" => "Access Secret",
+        "desc" => "Credentials used for accessing the AWS API (looks like: +Z16iRP9QAq7EcjHINyEMs3oR7A76QpfaSgCBogp)"
+      },
+      "log_bucket_name" => {
+        "title" => "Log and Secret Bucket Name",
+        "desc" => "S3 bucket into which we'll synchronize deploy secrets, and if we're hosted in AWS, collected system logs",
+        "changes" => ["chefrun"]
+      }
+    }
+  },
+  "google" => {
+    "title" => "Google Cloud Platform",
+    "subtree" => {
+      "project" => {
+        "title" => "Default Project",
+        "desc" => "Default Google Cloud Platform project in which we operate and deploy. Generate a service account at: https://console.cloud.google.com/iam-admin/serviceaccounts/project, making sure the account has sufficient privileges to manage cloud resources. Download the private key as JSON, and import that key to the vault specified here. Import example: knife vault create secrets google -J my-google-service-account.json"
+      },
+      "credentials" => {
+        "title" => "Credentials Vault:Item",
+        "desc" => "A vault and item from which to retrieve the JSON-formatted Service Account credentials for our GCP account, in the format vault:itemname (e.g. 'secrets:google'). Generate a service account at: https://console.cloud.google.com/iam-admin/serviceaccounts/project, making sure the account has sufficient privileges to manage cloud resources. Download the private key as JSON, and import that key to the vault specified here. Import example: knife vault create secrets google -J my-google-service-account.json "
+      },
+      "region" => {
+        "title" => "Default Region",
+        "desc" => "Default Google Cloud Platform region in which we operate and deploy",
+        "default" => "us-east4"
+      },
+      "log_bucket_name" => {
+        "title" => "Log and Secret Bucket Name",
+        "desc" => "Cloud Storage bucket into which we'll synchronize deploy secrets, and if we're hosted in GCP, collected system logs",
+        "changes" => ["chefrun"]
+      }
+    }
+  }
+}
+
+AMROOT = Process.uid == 0
+HOMEDIR = Etc.getpwuid(Process.uid).dir
+
+$opts = Optimist::options do
+  banner <<-EOS
+  EOS
+  required = []
+  opt :noninteractive, "Skip menu-based configuration prompts. If there is no existing configuration, the following flags are required: #{required.map{|x|"--"+x}.join(", ")}", :require => false, :default => false, :type => :boolean
+  $CONFIGURABLES.each_pair { |key, data|
+    next if !AMROOT and data['rootonly']
+    if data.has_key?("subtree")
+      data["subtree"].each_pair { |subkey, subdata|
+        next if !AMROOT and subdata['rootonly']
+        subdata['cli-opt'] = (key+"-"+subkey).gsub(/_/, "-")
+        opt (key+"-"+subkey).to_sym, subdata["desc"], :require => false, :type => (subdata["boolean"] ? :boolean : :string)
+        required << subdata['cli-opt'] if subdata['required']
+      }
+    elsif data["array"]
+      data['cli-opt'] = key.gsub(/_/, "-")
+      opt key.to_sym, data["desc"], :require => false, :type => (data["boolean"] ? :booleans : :strings)
+      required << data['cli-opt'] if data['required']
+    else
+      data['cli-opt'] = key.gsub(/_/, "-")
+      opt key.to_sym, data["desc"], :require => false, :type => (data["boolean"] ? :boolean : :string)
+      required << data['cli-opt'] if data['required']
+    end
+  }
+
+  opt :force, "Run all rebuild actions, whether or not our configuration is changed.", :require => false, :default => false, :type => :boolean if AMROOT
+  opt :ssh_keys, "One or more paths to SSH private keys, which we can try to use for SSH-based Git clone operations", :require => false, :type => :strings
+end
+
+if ENV.has_key?("MU_INSTALLDIR")
+  MU_BASE = ENV["MU_INSTALLDIR"]
+else
+  MU_BASE = "/opt/mu"
+end
+
+$INITIALIZE = (!File.size?("#{MU_BASE}/etc/mu.yaml") or $opts[:force])
+$HAVE_GLOBAL_CONFIG = File.size?("#{MU_BASE}/etc/mu.yaml")
+if !AMROOT and ($INITIALIZE or !$HAVE_GLOBAL_CONFIG)
+  puts "Global configuration has not been initialized or is missing. Must run as root to correct."
+  exit 1
+end
+if !$HAVE_GLOBAL_CONFIG and $opts[:noninteractive] and (!$opts[:public_address] or !$opts[:mu_admin_email])
+  puts "Specify --public-address and --mu-admin-email on new non-interactive configs"
+  exit 1
+end
+
+$IN_AWS = false
+begin
+  Timeout.timeout(2) do
+    instance_id = open("http://169.254.169.254/latest/meta-data/instance-id").read
+    $IN_AWS = true if !instance_id.nil? and instance_id.size > 0
+  end
+rescue OpenURI::HTTPError, Timeout::Error, SocketError, Errno::ENETUNREACH
+end
+$IN_GOOGLE = false
+begin
+  Timeout.timeout(2) do
+    instance_id = open(
+      "http://metadata.google.internal/computeMetadata/v1/instance/name",
+      "Metadata-Flavor" => "Google"
+    ).read
+    $IN_GOOGLE = true if !instance_id.nil? and instance_id.size > 0
+  end
+rescue OpenURI::HTTPError, Timeout::Error, SocketError, Errno::ENETUNREACH
+end
+
+
+KNIFE_TEMPLATE = "log_level                :info
+log_location             STDOUT
+node_name                '<%= chefuser %>'
+client_key               '<%= MU_BASE %>/var/users/<%= user %>/<%= chefuser %>.user.key'
+validation_client_name   'mu-validator'
+validation_key           '<%= MU_BASE %>/var/orgs/<%= user %>/<%= chefuser %>.org.key'
+chef_server_url 'https://<%= MU.mu_public_addr %>:7443/organizations/<%= chefuser %>'
+chef_server_root 'https://<%= MU.mu_public_addr %>:7443/organizations/<%= chefuser %>'
+syntax_check_cache_path  '<%= HOMEDIR %>/.chef/syntax_check_cache'
+cookbook_path [ '<%= HOMEDIR %>/.chef/cookbooks', '<%= HOMEDIR %>/.chef/site_cookbooks' ]
+<% if $MU_CFG.has_key?('ssl') and $MU_CFG['ssl'].has_key?('chain') %>
+ssl_ca_path '<%= File.dirname($MU_CFG['ssl']['chain']) %>'
+ssl_ca_file '<%= File.basename($MU_CFG['ssl']['chain']) %>'
+<% end %>
+knife[:vault_mode] = 'client'
+knife[:vault_admins] = ['<%= chefuser %>']"
+
+CLIENT_TEMPLATE = "chef_server_url  'https://<%= MU.mu_public_addr %>:7443/organizations/<%= user %>'
+validation_client_name 'mu-validator'
+log_location   STDOUT
+node_name 'MU-MASTER'
+verify_api_cert false
+ssl_verify_mode :verify_none
+"
+
+PIVOTAL_TEMPLATE = "node_name 'pivotal'
+chef_server_url 'https://<%= MU.mu_public_addr %>:7443'
+chef_server_root 'https://<%= MU.mu_public_addr %>:7443'
+no_proxy '<%= MU.mu_public_addr %>'
+client_key '/etc/opscode/pivotal.pem'
+ssl_verify_mode :verify_none
+"
+
+$CHANGES = []
+
+
+$MENU_MAP = {}
+def assignMenuEntries
+  count = 1
+  $CONFIGURABLES.each_pair { |key, data|
+    next if !AMROOT and data['rootonly']
+    if data.has_key?("subtree")
+      letters = ("a".."z").to_a
+      lettercount = 0
+      data["subtree"].each_pair { |subkey, subdata|
+        next if !AMROOT and subdata['rootonly']
+        $CONFIGURABLES[key]["subtree"][subkey]["menu"] = count.to_s+letters[lettercount]
+        $MENU_MAP[count.to_s+letters[lettercount]] = $CONFIGURABLES[key]["subtree"][subkey]
+        lettercount = lettercount + 1
+      }
+    end
+    $MENU_MAP[count.to_s] = $CONFIGURABLES[key]
+    $CONFIGURABLES[key]["menu"] = count.to_s
+    count = count + 1
+  }
+  $MENU_MAP.freeze
+end
+
+def trySSHKeyWithGit(repo, keypath = nil)
+  cfgbackup = nil
+  deletekey = false
+  repo.match(/^([^@]+?)@([^:]+?):/)
+  ssh_user = Regexp.last_match(1)
+  ssh_host = Regexp.last_match(2)
+  if keypath.nil?
+    response = nil
+    puts "Would you like to provide a private ssh key for #{repo} and try again?"
+    begin
+      response = Readline.readline("Y/N> ".bold, false)
+    end while !response and !response.match(/^(y|n)$/i)
+    if response == "y" or response == "Y"
+      Dir.mkdir("#{HOMEDIR}/.ssh", 0700) if !Dir.exists?("#{HOMEDIR}/.ssh")
+      keynamestr = repo.gsub(/[^a-z0-9\-]/i, "-") + Process.pid.to_s
+      keypath = "#{HOMEDIR}/.ssh/#{keynamestr}"
+      puts "Paste a complete SSH private key for #{ssh_user.bold}@#{ssh_host.bold} below, then ^D"
+      system("cat > #{keypath}")
+      File.chmod(0600, keypath)
+      puts "Key saved to "+keypath.bold
+      deletekey = true
+    else
+      return false
+    end
+  end
+
+  if File.exists?("#{HOMEDIR}/.ssh/config")
+    FileUtils.cp("#{HOMEDIR}/.ssh/config", "#{HOMEDIR}/.ssh/config.bak.#{Process.pid.to_s}")
+    cfgbackup = "#{HOMEDIR}/.ssh/config.bak.#{Process.pid.to_s}"
+  end
+  File.open("#{HOMEDIR}/.ssh/config", "a", 0600){ |f|
+    f.puts "Host "+ssh_host
+    f.puts "  User "+ssh_user
+    f.puts "  IdentityFile "+keypath
+    f.puts "  StrictHostKeyChecking no"
+  }
+
+  puts "/usr/bin/git clone #{repo}"
+  output = %x{/usr/bin/git clone #{repo} 2>&1}
+  if $?.exitstatus == 0
+    puts "Successfully cloned #{repo}".green.on_black
+    return true
+  else
+    puts output.red.on_black
+    if cfgbackup
+      puts "Restoring #{HOMEDIR}/.ssh/config"
+      File.rename(cfgbackup, "#{HOMEDIR}/.ssh/config")
+    end
+    if deletekey
+      puts "Removing #{keypath}"
+      File.unlink(keypath)
+    end
+  end
+  return false
+end
+
+def cloneGitRepo(repo)
+  puts "Testing ability to check out Git repository #{repo.bold}"
+  fullrepo = repo
+  if !repo.match(/@|:\/\//) # we try ssh first
+    fullrepo = "git@github.com:"+repo 
+    puts "Doesn't look like a full URL, trying SSH to #{fullrepo}"
+  end
+  cwd = Dir.pwd
+  Dir.mktmpdir("mu-git-test-") { |dir|
+    Dir.chdir(dir)
+    puts "/usr/bin/git clone #{fullrepo}"
+    output = %x{/usr/bin/git clone #{fullrepo} 2>&1}
+    if $?.exitstatus == 0
+      puts "Successfully cloned #{fullrepo}".green.on_black
+      Dir.chdir(cwd)
+      return fullrepo
+    elsif $?.exitstatus != 0 and output.match(/permission denied/i)
+      puts ""
+      puts output.red.on_black
+      if $opts[:ssh_keys_given]
+        $opts[:ssh_keys].each { |keypath|
+          if trySSHKeyWithGit(fullrepo, keypath)
+            Dir.chdir(cwd)
+            return fullrepo
+          end
+        }
+      end
+      if !$opts[:noninteractive]
+        if trySSHKeyWithGit(fullrepo)
+          Dir.chdir(cwd)
+          return fullrepo
+        end
+      end
+    end
+    if !repo.match(/@|:\/\//)
+      fullrepo = "git://github.com/"+repo 
+      puts ""
+      puts "No luck there, trying #{fullrepo}".bold
+      puts "/usr/bin/git clone #{fullrepo}"
+      output = %x{/usr/bin/git clone #{fullrepo} 2>&1}
+      if $?.exitstatus == 0
+        puts "Successfully cloned #{fullrepo}".green.on_black
+        Dir.chdir(cwd)
+        return fullrepo
+      else
+        puts output.red.on_black
+        fullrepo = "https://github.com/"+repo 
+        puts "Final attempt, trying #{fullrepo}"
+        puts "/usr/bin/git clone #{fullrepo}"
+        output = %x{/usr/bin/git clone #{fullrepo} 2>&1}
+        if $?.exitstatus == 0
+          puts "Successfully cloned #{fullrepo}".green.on_black
+          Dir.chdir(cwd)
+          return fullrepo
+        else
+          puts output.red.on_black
+        end
+      end
+    else
+      puts "No other methods I can think to try, giving up on #{repo.bold}".red.on_black
+    end
+  }
+  Dir.chdir(cwd)
+  nil
+end
+
+# Rustle up some sensible default values, if this is our first time
+def setDefaults
+  ips = []
+  if $IN_AWS
+    ["public-ipv4", "local-ipv4"].each { |addr|
+      begin
+      Timeout.timeout(2) do
+        ip = open("http://169.254.169.254/latest/meta-data/#{addr}").read
+        ips << ip if !ip.nil? and ip.size > 0
+      end
+      rescue OpenURI::HTTPError, Timeout::Error, SocketError
+        # these are ok to ignore
+      end
+    }
+  elsif $IN_GOOGLE
+    base_url = "http://metadata.google.internal/computeMetadata/v1"
+    begin
+      Timeout.timeout(2) do
+# TODO iterate across multiple interfaces/access-configs
+        ip = open("#{base_url}/instance/network-interfaces/0/ip", "Metadata-Flavor" => "Google").read
+        ips << ip if !ip.nil? and ip.size > 0
+        ip = open("#{base_url}/instance/network-interfaces/0/access-configs/0/external-ip", "Metadata-Flavor" => "Google").read
+        ips << ip if !ip.nil? and ip.size > 0
+      end
+    rescue OpenURI::HTTPError, Timeout::Error, SocketError => e
+      # This is fairly normal, just handle it gracefully
+    end
+  end
+
+  ips.concat(Socket.ip_address_list.delete_if { |i| !i.ipv4? or i.ip_address.match(/^(0\.0\.0\.0$|169\.254\.|127\.0\.)/) }.map { |a| a.ip_address })
+
+  $CONFIGURABLES["allow_invade_foreign_vpcs"]["default"] = false
+  $CONFIGURABLES["public_address"]["default"] = ips.first
+  $CONFIGURABLES["hostname"]["default"] = Socket.gethostname
+  $CONFIGURABLES["banner"]["default"] = "Mu Master at #{$CONFIGURABLES["public_address"]["default"]}"
+  if $CONFIGURABLES["mu_admin_email"]["value"]
+    $CONFIGURABLES["jenkins"]["subtree"]["admin_email"]["default"] = $CONFIGURABLES["mu_admin_email"]["value"]
+  end
+  if $IN_AWS
+    aws = JSON.parse(open("http://169.254.169.254/latest/dynamic/instance-identity/document").read)
+    iam = nil
+    begin
+      iam = open("http://169.254.169.254/latest/meta-data/iam/security-credentials").read
+    rescue OpenURI::HTTPError, SocketError
+    end
+    $CONFIGURABLES["aws"]["subtree"]["account_number"]["default"] = aws["accountId"]
+    $CONFIGURABLES["aws"]["subtree"]["region"]["default"] = aws["region"]
+    if iam and iam.size > 0
+      # XXX can we think of a good way to test our permission set?
+      $CONFIGURABLES["aws"]["subtree"]["access_key"]["desc"] = $CONFIGURABLES["aws"]["subtree"]["access_key"]["desc"] + ". Not necessary if IAM Profile #{iam.bold} has sufficient API access."
+      $CONFIGURABLES["aws"]["subtree"]["access_secret"]["desc"] = $CONFIGURABLES["aws"]["subtree"]["access_key"]["desc"] + ". Not necessary if IAM Profile #{iam.bold} has sufficient API access."
+    end
+  end
+  $CONFIGURABLES["aws"]["subtree"]["log_bucket_name"]["default"] = $CONFIGURABLES["hostname"]["default"]
+  $CONFIGURABLES["google"]["subtree"]["log_bucket_name"]["default"] = $CONFIGURABLES["hostname"]["default"]
+end
+
+
+def runValueCallback(desc, val)
+  if desc['array']
+    if desc["callback"]
+      newval = []
+      val.each { |v|
+        v = send(desc["callback"].to_sym, v)
+        newval << v if !v.nil?
+      }
+      val = newval
+    end
+  elsif desc["callback"]
+    val = send(desc["callback"].to_sym, val)
+  end
+  val
+end
+
+def importCLIValues
+  $CONFIGURABLES.each_pair { |key, data|
+    next if !AMROOT and data['rootonly']
+    if data.has_key?("subtree")
+      data["subtree"].each_pair { |subkey, subdata|
+        next if !AMROOT and subdata['rootonly']
+        if $opts[(subdata['cli-opt'].gsub(/-/, "_")+"_given").to_sym]
+          newval = runValueCallback(subdata, $opts[subdata['cli-opt'].gsub(/-/, "_").to_sym])
+          subdata["value"] = newval if !newval.nil?
+          $CHANGES.concat(subdata['changes']) if subdata['changes']
+        end
+      }
+    else
+      if $opts[(data['cli-opt'].gsub(/-/, "_")+"_given").to_sym]
+        newval = runValueCallback(data, $opts[data['cli-opt'].gsub(/-/, "_").to_sym])
+        data["value"] = newval if !newval.nil?
+        $CHANGES.concat(data['changes']) if data['changes']
+      end
+    end
+  }
+end
+
+# Load values from our existing configuration into the $CONFIGURABLES hash
+def importCurrentValues
+  require File.realpath(File.expand_path(File.dirname(__FILE__)+"/mu-load-config.rb"))
+  $CONFIGURABLES.each_key { |key|
+    next if !$MU_CFG.has_key?(key)
+    if $CONFIGURABLES[key].has_key?("subtree")
+      # It's a sub-tree. I'm too lazy to write a recursive thing for this, just
+      # cover the simple case that we actually care about for now.
+      $CONFIGURABLES[key]["subtree"].keys.each { |subkey|
+        next if !$MU_CFG[key].has_key?(subkey)
+        $CONFIGURABLES[key]["subtree"][subkey]["value"] = $MU_CFG[key][subkey]
+      }
+    else
+      $CONFIGURABLES[key]["value"] = $MU_CFG[key]
+    end
+  }
+end
+
+def printVal(data)
+  valid = true
+  valid = validate(data["value"], data, false) if data["value"]
+  if !valid
+    print " "+data["value"].to_s.red.on_black
+    print " (consider default of #{data["default"].to_s.bold})" if data["default"]
+  elsif !data["value"].nil?
+    print " - "+data["value"].to_s.green.on_black
+  elsif data["required"]
+    print " - "+"REQUIRED".red.on_black
+  elsif !data["default"].nil?
+    print " - "+data["default"].to_s.yellow.on_black+" (DEFAULT)"
+  end
+end
+
+# Converts the current $CONFIGURABLES object to a Hash suitable for merging
+# with $MU_CFG.
+def setConfigTree
+  cfg = {}
+  $CONFIGURABLES.each_pair { |key, data|
+    next if !AMROOT and data['rootonly']
+    if data.has_key?("subtree")
+      data["subtree"].each_pair { |subkey, subdata|
+        next if !AMROOT and subdata['rootonly']
+        if !subdata["value"].nil?
+          cfg[key] ||= {}
+          cfg[key][subkey] = subdata["value"]
+        elsif !subdata["default"].nil? and !$HAVE_GLOBAL_CONFIG or ($MU_CFG and (!$MU_CFG[key] or !$MU_CFG[key][subkey]))
+          cfg[key] ||= {}
+          cfg[key][subkey] = subdata["default"]
+        end
+      }
+    elsif !data["value"].nil?
+      cfg[key] = data["value"]
+    elsif !data["default"].nil? and !$HAVE_GLOBAL_CONFIG or ($MU_CFG and !$MU_CFG[key])
+      cfg[key] = data["default"]
+    end
+  }
+  cfg
+end
+
+def displayCurrentOpts
+  count = 1
+  optlist = []
+  $CONFIGURABLES.each_pair { |key, data|
+    next if !AMROOT and data['rootonly']
+    print data["menu"].bold+") "+data["title"]
+    if data.has_key?("subtree")
+      puts ""
+      data["subtree"].each_pair { |subkey, subdata|
+        next if !AMROOT and subdata['rootonly']
+        print "  "+subdata["menu"].bold+". "+subdata["title"]
+        printVal(subdata)
+        puts ""
+      }
+    else
+      printVal(data)
+      puts ""
+    end
+    count = count + 1
+  }
+  optlist
+end
+
+###############################################################################
+
+trap("INT"){ puts "" ; exit }
+importCurrentValues if !$INITIALIZE or $HAVE_GLOBAL_CONFIG
+importCLIValues
+setDefaults
+assignMenuEntries # populates and freezes $MENU_MAP
+
+def ask(desc)
+  puts ""
+  puts (desc['required'] ? "REQUIRED".red.on_black : "OPTIONAL".yellow.on_black)+" - "+desc["desc"]
+  puts "Enter one or more values, separated by commas".yellow.on_black if desc['array']
+  puts "Enter 0 or false, 1 or true".yellow.on_black if desc['boolean']
+  prompt = desc["title"].bold + "> "
+  current = desc['value'] || desc['default']
+  if current
+    current = current.join(", ") if desc['array'] and current.is_a?(Array)
+    Readline.pre_input_hook = -> do
+      Readline.insert_text current.to_s
+      Readline.redisplay
+      Readline.pre_input_hook = nil
+    end
+  end
+  val = Readline.readline(prompt, false)
+  if desc['array'] and !val.nil?
+    val = val.strip.split(/\s*,\s*/)
+  end
+  if desc['boolean']
+    val = false if ["0", "false", "FALSE"].include?(val)
+    val = true if ["1", "true", "TRUE"].include?(val)
+  end
+  val = runValueCallback(desc, val)
+  val = current if val.nil? and desc['value']
+  val
+end
+
+def validate(newval, reqs, addnewline = true)
+  ok = true
+  def validate_individual_value(newval, reqs, addnewline)
+    ok = true
+    if reqs['boolean'] and newval != true and newval != false and newval != nil
+      puts "\nInvalid value '#{newval.bold}' for #{reqs['title'].bold} (must be true or false)".light_red.on_black
+      puts "\n\n" if addnewline
+      ok = false
+    elsif reqs['pattern']
+      if newval.nil?
+        puts "\nSupplied value for #{reqs['title'].bold} did not pass validation".light_red.on_black
+        puts "\n\n" if addnewline
+        ok = false
+      elsif reqs['negate_pattern'] 
+        if newval.to_s.match(reqs['pattern'])
+          puts "\nInvalid value '#{newval.bold}' for #{reqs['title'].bold} (must NOT match #{reqs['pattern']})".light_red.on_black
+          puts "\n\n" if addnewline
+          ok = false
+        end
+      elsif !newval.to_s.match(reqs['pattern'])
+        puts "\nInvalid value '#{newval.bold}' #{reqs['title'].bold} (must match #{reqs['pattern']})".light_red.on_black
+        puts "\n\n" if addnewline
+        ok = false
+      end
+    end
+    ok
+  end
+
+  if reqs['array']
+    if !newval.is_a?(Array)
+      puts "\nInvalid value '#{newval.bold}' for #{reqs['title'].bold} (should be an array)".light_red.on_black
+      puts "\n\n" if addnewline
+      ok = false
+    else
+      newval.each { |v|
+        ok = false if !validate_individual_value(v, reqs, addnewline)
+      }
+    end
+  else
+    ok = false if !validate_individual_value(newval, reqs, addnewline)
+  end
+  ok
+end
+
+answer = nil
+changed = false
+
+def entireConfigValid?
+  ok = true
+  $CONFIGURABLES.each_pair { |key, data|
+    next if !AMROOT and data['rootonly']
+    if data.has_key?("subtree")
+      data["subtree"].each_pair { |subkey, subdata|
+        next if !AMROOT and subdata['rootonly']
+        next if !data["value"]
+        ok = false if !validate(data["value"], data, false)
+      }
+    else
+      next if !data["value"]
+      ok = false if !validate(data["value"], data, false)
+    end
+  }
+  ok
+end
+
+def menu
+  begin
+    optlist = displayCurrentOpts
+    begin
+      print "Enter an option to change, "+"O".bold+" to save this config, or "+"^D".bold+" to quit.\n> "
+      answer = gets
+      if answer.nil?
+        puts ""
+        exit 0
+      end
+      answer.strip!
+    rescue EOFError
+      puts ""
+      exit 0
+    end
+    if $MENU_MAP.has_key?(answer) and !$MENU_MAP[answer].has_key?("subtree")
+      newval = ask($MENU_MAP[answer])
+      if !validate(newval, $MENU_MAP[answer])
+        sleep 1
+        next
+      end
+      $MENU_MAP[answer]['value'] = newval == "" ? nil : newval
+      $CHANGES.concat($MENU_MAP[answer]['changes']) if $MENU_MAP[answer].include?("changes")
+      if $MENU_MAP[answer]['title'] == "Local Hostname"
+        $CONFIGURABLES["aws"]["subtree"]["log_bucket_name"]["default"] = newval
+      elsif $MENU_MAP[answer]['title'] == "Public Address"
+        $CONFIGURABLES["banner"]["default"] = "Mu Master at #{newval}"
+      elsif $MENU_MAP[answer]['title'] == "Mu Admin Email"
+        $CONFIGURABLES["jenkins"]["subtree"]["admin_email"]["default"] = newval
+      end
+      changed = true
+      puts ""
+    elsif !["", "0", "O", "o"].include?(answer)
+      puts "\nInvalid option '#{answer.bold}'".light_red.on_black+"\n\n"
+      sleep 1
+    else
+      answer = nil if !entireConfigValid?
+    end
+  end while answer != "0" and answer != "O" and answer != "o"
+end
+
+if !$opts[:noninteractive]
+  menu
+else
+  if !entireConfigValid?
+    puts "Configuration had validation errors, exiting.\nRe-invoke #{$0} to correct."
+    exit 1
+  end
+end
+
+if AMROOT
+  $MU_CFG['multiuser'] = true
+  saveMuConfig($MU_CFG)
+end
+
+def set389DSCreds
+  require 'mu'
+  credlist = {
+    "bind_creds" => {
+      "user" => "CN=mu_bind_creds,#{$MU_CFG["ldap"]['user_ou']}"
+    },
+    "join_creds" => {
+      "user" => "CN=mu_join_creds,#{$MU_CFG["ldap"]['user_ou']}"
+    },
+    "cfg_directory_adm" => {
+      "user" => "admin"
+    },
+    "root_dn_user" => {
+      "user" => "CN=root_dn_user"
+    }
+  }
+  credlist.each_pair { |creds, cfg|
+    begin
+      data = nil
+      if $MU_CFG["ldap"].has_key?(creds)
+        data = MU::Groomer::Chef.getSecret(
+          vault: $MU_CFG["ldap"][creds]["vault"],
+          item: $MU_CFG["ldap"][creds]["item"]
+        )
+        MU::Groomer::Chef.grantSecretAccess("MU-MASTER", $MU_CFG["ldap"][creds]["vault"], $MU_CFG["ldap"][creds]["item"])
+      else
+        data = MU::Groomer::Chef.getSecret(vault: "mu_ldap", item: creds)
+        MU::Groomer::Chef.grantSecretAccess("MU-MASTER", "mu_ldap", creds)
+      end
+    rescue MU::Groomer::Chef::MuNoSuchSecret
+      user = cfg["user"]
+      pw = Password.pronounceable(14..16)
+      if $MU_CFG["ldap"].has_key?(creds)
+        data = {
+          $MU_CFG["ldap"][creds]["username_field"] => user,
+          $MU_CFG["ldap"][creds]["password_field"] => pw
+        }
+        MU::Groomer::Chef.saveSecret(
+          vault: $MU_CFG["ldap"][creds]["vault"],
+          item: $MU_CFG["ldap"][creds]["item"],
+          data: data,
+          permissions: "name:MU-MASTER"
+        )
+      else
+        MU::Groomer::Chef.saveSecret(
+          vault: "mu_ldap",
+          item: creds,
+          data: { "username" => user, "password" => pw },
+          permissions: "name:MU-MASTER"
+        )
+      end
+    end
+  }
+end
+
+if AMROOT
+  cur_chef_version = `/bin/rpm -q chef`.sub(/^chef-(\d+\.\d+\.\d+-\d+)\..*/, '\1').chomp
+  pref_chef_version = File.read("#{MU_BASE}/var/mu-chef-client-version").chomp
+  if cur_chef_version != pref_chef_version
+    puts "Updating MU-MASTER's Chef Client to '#{pref_chef_version}'"
+    chef_installer = open("https://omnitruck.chef.io/install.sh").read
+    File.open("#{HOMEDIR}/chef-install.sh", File::CREAT|File::TRUNC|File::RDWR, 0644){ |f|
+      f.puts chef_installer
+    }
+    system("/bin/rm -rf /opt/chef ; sh #{HOMEDIR}/chef-install.sh -v #{pref_chef_version}");
+    # This will go fix gems, permissions, etc
+    system("/opt/chef/bin/chef-apply #{MU_BASE}/lib/cookbooks/mu-master/recipes/init.rb");
+  end
+end
+
+if $INITIALIZE
+  %x{/sbin/service iptables stop} # Chef run will set up correct rules later
+  $MU_SET_DEFAULTS = setConfigTree
+  require File.realpath(File.expand_path(File.dirname(__FILE__)+"/mu-load-config.rb"))
+else
+  if AMROOT
+    $NEW_CFG = $MU_CFG.merge(setConfigTree)
+  else
+    $NEW_CFG = setConfigTree
+  end
+  saveMuConfig($NEW_CFG)
+  $MU_CFG = $MU_CFG.merge(setConfigTree)
+  require File.realpath(File.expand_path(File.dirname(__FILE__)+"/mu-load-config.rb"))
+end
+begin
+  require 'mu'
+rescue MU::MuError => e
+  puts "Correct the above error before proceeding. To retry, run:\n\n#{$0.bold} #{ARGV.join(" ").bold}"
+  exit 1
+rescue LoadError
+  system("cd #{MU_BASE}/lib/modules && umask 0022 && /usr/local/ruby-current/bin/bundle install")
+  require 'mu'
+end
+
+if AMROOT and ($INITIALIZE or $CHANGES.include?("hostname"))
+  system("/bin/hostname #{$MU_CFG['hostname']}")
+end
+
+# Do some more basic-but-Chef-dependent configuration *before* we meddle with
+# the Chef Server configuration, which depends on some of this (SSL certs and
+# local firewall ports).
+if AMROOT and ($INITIALIZE or $CHANGES.include?("chefartifacts"))
+  MU.log "Purging and re-uploading all Chef artifacts", MU::NOTICE
+  %x{/sbin/service iptables stop} if $INITIALIZE
+  output = %x{MU_INSTALLDIR=#{MU_BASE} MU_LIBDIR=#{MU_BASE}/lib MU_DATADIR=#{MU_BASE}/var #{MU_BASE}/lib/bin/mu-upload-chef-artifacts}
+  if $?.exitstatus != 0
+    puts output
+    MU.log "mu-upload-chef-artifacts failed, can't proceed", MU::ERR
+    %x{/sbin/service iptables start} if $INITIALIZE
+    exit 1
+  end
+  %x{/sbin/service iptables start} if $INITIALIZE
+end
+
+if $INITIALIZE and AMROOT
+  MU.log "Force open key firewall holes", MU::NOTICE
+  system("chef-client -o 'recipe[mu-master::firewall-holes]'")
+end
+
+if AMROOT
+  MU.log "Checking internal SSL signing authority and certificates", MU::NOTICE
+  if !system("chef-client -o 'recipe[mu-master::ssl-certs]'") and $INITIALIZE
+    MU.log "Got bad exit code trying to run recipe[mu-master::ssl-certs]', aborting", MU::ERR
+    exit 1
+  end
+end
+
+def updateChefRbs
+  user = AMROOT ? "mu" : Etc.getpwuid(Process.uid).name
+  chefuser = user.gsub(/\./, "")
+  templates = { HOMEDIR+"/.chef/knife.rb" => KNIFE_TEMPLATE }
+  if AMROOT
+    templates["/etc/chef/client.rb"] = CLIENT_TEMPLATE
+    templates["/etc/opscode/pivotal.rb"] = PIVOTAL_TEMPLATE
+  end
+  templates.each_pair { |file, template|
+    erb = ERB.new(template)
+    processed = erb.result(binding)
+    tmpfile = file+".tmp."+Process.pid.to_s
+    File.open(tmpfile, File::CREAT|File::TRUNC|File::RDWR, 0644){ |f|
+      f.puts processed
+    }
+    if !File.size?(file) or File.read(tmpfile) != File.read(file)
+      File.rename(tmpfile, file)
+      MU.log "Updated #{file}", MU::NOTICE
+      $CHANGES << "chefcerts"
+    else
+      File.unlink(tmpfile)
+    end
+  }
+end
+
+
+if AMROOT
+  erb = ERB.new(File.read("#{MU_BASE}/lib/cookbooks/mu-master/templates/default/chef-server.rb.erb"))
+  updated_server_cfg = erb.result(binding)
+  cfgpath = "/etc/opscode/chef-server.rb"
+  tmpfile = "/etc/opscode/chef-server.rb.#{Process.pid}"
+  File.open(tmpfile, File::CREAT|File::TRUNC|File::RDWR, 0644){ |f|
+    f.puts updated_server_cfg
+  }
+  if !File.size?(cfgpath) or File.read(tmpfile) != File.read(cfgpath)
+    File.rename(tmpfile, cfgpath)
+    # Opscode can't seem to get things right with their postgres socket
+    Dir.mkdir("/var/run/postgresql", 0755) if !Dir.exists?("/var/run/postgresql")
+    if File.exists?("/tmp/.s.PGSQL.5432") and !File.exists?("/var/run/postgresql/.s.PGSQL.5432")
+      File.symlink("/tmp/.s.PGSQL.5432", "/var/run/postgresql/.s.PGSQL.5432")
+    elsif !File.exists?("/tmp/.s.PGSQL.5432") and File.exists?("/var/run/postgresql/.s.PGSQL.5432")
+      File.symlink("/var/run/postgresql/.s.PGSQL.5432", "/tmp/.s.PGSQL.5432")
+    end
+    MU.log "Chef Server config was modified, reconfiguring...", MU::NOTICE
+    # XXX Some undocumented port Chef needs only on startup is being blocked by
+    # iptables. Something rabbitmq-related. Dopey workaround.
+    %x{/sbin/service iptables stop}
+    system("/opt/opscode/bin/chef-server-ctl reconfigure")
+    system("/opt/opscode/bin/chef-server-ctl restart")
+    %x{/sbin/service iptables start}
+    updateChefRbs
+    $CHANGES << "chefcerts"
+  else
+    File.unlink(tmpfile)
+    updateChefRbs
+  end
+else
+  updateChefRbs
+end
+
+if $IN_AWS and AMROOT
+  system("#{MU_BASE}/lib/bin/mu-aws-setup --dns --sg --logs --ephemeral")
+# XXX --ip? Do we really care?
+end
+if $IN_GOOGLE and AMROOT
+  system("#{MU_BASE}/lib/bin/mu-gcp-setup --sg --logs")
+end
+
+if $INITIALIZE or $CHANGES.include?("chefcerts")
+  system("rm -f #{HOMEDIR}/.chef/trusted_certs/* ; knife ssl fetch -c #{HOMEDIR}/.chef/knife.rb")
+  if AMROOT
+    system("rm -f /etc/chef/trusted_certs/* ; knife ssl fetch -c /etc/chef/client.rb")
+  end
+end
+
+# knife ssl fetch isn't bright enough to nab our intermediate certs, which
+# ironically becomes a problem when we use one from the real world. Jam it
+# into knife and chef-client's faces thusly:
+if $MU_CFG['ssl'] and $MU_CFG['ssl']['chain'] and File.size?($MU_CFG['ssl']['chain'])
+  cert = File.basename($MU_CFG['ssl']['chain'])
+  FileUtils.cp($MU_CFG['ssl']['chain'], HOMEDIR+"/.chef/trusted_certs/#{cert}")
+  File.chmod(0600, HOMEDIR+"/.chef/trusted_certs/#{cert}")
+  if AMROOT
+    File.chmod(0644, $MU_CFG['ssl']['chain'])
+    FileUtils.cp($MU_CFG['ssl']['chain'], "/etc/chef/trusted_certs/#{cert}")
+  end
+end
+
+if $MU_CFG['repos'] and $MU_CFG['repos'].size > 0
+  $MU_CFG['repos'].each { |repo|
+    repo.match(/\/([^\/]+?)(\.git)?$/)
+    shortname = Regexp.last_match(1)
+    repodir = MU.dataDir + "/" + shortname
+    if !Dir.exists?(repodir)
+      MU.log "Cloning #{repo} into #{repodir}", MU::NOTICE
+      Dir.chdir(MU.dataDir)
+      system("/usr/bin/git clone #{repo}")
+      $CHANGES << "chefartifacts"
+    end
+  }
+end
+
+if !AMROOT
+  exit
+end
+
+begin
+  MU::Groomer::Chef.getSecret(vault: "secrets", item: "consul")
+rescue MU::Groomer::Chef::MuNoSuchSecret
+  data = {
+    "private_key" => File.read("#{MU_BASE}/var/ssl/consul.key"),
+    "certificate" => File.read("#{MU_BASE}/var/ssl/consul.crt"),
+    "ca_certificate" => File.read("#{MU_BASE}/var/ssl/Mu_CA.pem")
+  }
+  MU::Groomer::Chef.saveSecret(
+    vault: "secrets",
+    item: "consul",
+    data: data,
+    permissions: "name:MU-MASTER"
+  )
+end
+if $INITIALIZE or $CHANGES.include?("vault")
+  MU.log "Setting up Hashicorp Vault", MU::NOTICE
+  system("chef-client -o 'recipe[mu-master::vault]'")
+end
+
+if $MU_CFG['ldap']['type'] == "389 Directory Services" 
+  begin
+    MU::Master::LDAP.listUsers
+  rescue Exception => e # XXX lazy exception handling is lazy
+    $CHANGES << "389ds"
+  end
+  if $INITIALIZE or $CHANGES.include?("389ds")
+    File.unlink("/root/389ds.tmp/389-directory-setup.inf") if File.exists?("/root/389ds.tmp/389-directory-setup.inf")
+    MU.log "Configuring 389 Directory Services", MU::NOTICE
+    set389DSCreds
+    system("chef-client -o 'recipe[mu-master::389ds]'")
+    exit 1 if $? != 0
+    MU::Master::LDAP.initLocalLDAP
+    system("chef-client -o 'recipe[mu-master::sssd]'")
+    exit 1 if $? != 0
+  end
+end
+
+if $MU_CFG['jenkins'] and $MU_CFG['jenkins']['enable']
+  MU::Groomer::Chef.loadChefLib
+  chef_node = ::Chef::Node.load("MU-MASTER")
+  begin
+    data = MU::Groomer::Chef.getSecret(vault: "jenkins", item: "admin")
+    MU::Groomer::Chef.grantSecretAccess("MU-MASTER", "jenkins", "admin")
+  rescue MU::Groomer::Chef::MuNoSuchSecret
+    MU.log "Saving keys for Jenkins admin user '#{$MU_CFG['jenkins']['admin_user']}' into Vault jenkins:admin", MU::NOTICE
+    if !File.exists?("#{HOMEDIR}/.ssh/mu-jenkins-admin.pub") and !File.exists?("#{HOMEDIR}/.ssh/mu-jenkins-admin.pub")
+      system("/usr/bin/ssh-keygen -N '' -f #{HOMEDIR}/.ssh/mu-jenkins-admin")
+    end
+    public_key = File.read("#{HOMEDIR}/.ssh/mu-jenkins-admin.pub").chomp
+    private_key = File.read("#{HOMEDIR}/.ssh/mu-jenkins-admin").chomp
+    MU::Groomer::Chef.saveSecret(
+      vault: "jenkins",
+      item: "admin",
+      data: {
+        "username": $MU_CFG['jenkins']['admin_user'],
+        "private_key": private_key,
+        "public_key": public_key
+      }
+    )
+  end
+end
+
+# Figure out if our run list is dumb
+MU.log "Verifying MU-MASTER's Chef run list", MU::NOTICE
+MU::Groomer::Chef.loadChefLib
+chef_node = ::Chef::Node.load("MU-MASTER")
+run_list = ["role[mu-master]"]
+run_list << "role[mu-master-jenkins]" if $MU_CFG['jenkins']['enable']
+run_list.concat($MU_CFG['master_runlist_extras']) if $MU_CFG['master_runlist_extras'].is_a?(Array)
+set_runlist = false
+run_list.each { |rl|
+  set_runlist = true if !chef_node.run_list?(rl)
+}
+if set_runlist
+  MU.log "Updating MU-MASTER run_list", MU::NOTICE, details: run_list
+  chef_node.run_list(run_list)
+  chef_node.save
+  $CHANGES << "chefrun"
+else
+  MU.log "Chef run list looks correct", MU::NOTICE, details: run_list
+end
+
+# TODO here are some things we don't do yet but should
+# accommodate running as a non-root user
+
+if $INITIALIZE
+  MU::Config.emitSchemaAsRuby
+  MU.log "Generating YARD documentation in /var/www/html/docs (see http://#{$MU_CFG['public_address']}/docs/frames.html)"
+  File.umask(0022)
+  system("cd #{MU.myRoot} && umask 0022 && env -i PATH=#{ENV['PATH']} HOME=#{HOMEDIR} /usr/local/ruby-current/bin/yard doc modules -m markdown -o /var/www/html/docs && chcon -R -h -t httpd_sys_script_exec_t /var/www/html/")
+end
+
+
+MU.log "Running chef-client on MU-MASTER", MU::NOTICE
+system("chef-client -o '#{run_list.join(",")}'")
+
+
+if !File.exists?("#{MU_BASE}/var/users/mu/email") or !File.exists?("#{MU_BASE}/var/users/mu/realname")
+  MU.log "Finalizing the 'mu' Chef/LDAP account", MU::NOTICE
+  MU.setLogging(MU::Logger::SILENT)
+  MU::Master.manageUser(
+    "mu",
+    name: $MU_CFG['mu_admin_name'],
+    email: $MU_CFG['mu_admin_email'],
+    admin: true,
+    password: MU.generateWindowsPassword # we'll just overwrite this and do it with mu-user-manage below, which can do smart things with Scratchpad
+  )
+  MU.setLogging(MU::Logger::NORMAL)
+  sleep 3 # avoid LDAP lag for mu-user-manage
+end
+
+output = %x{/opt/chef/bin/knife vault show scratchpad 2>&1}
+if $?.exitstatus != 0 or output.match(/is not a chef-vault/)
+  MU::Groomer::Chef.saveSecret(
+    vault: "scratchpad",
+    item: "placeholder",
+    data: { "secret" => "DO NOT DELETE", "timestamp" => "9999999999" },
+    permissions: "name:MU-MASTER"
+  )
+end
+
+MU.log "Regenerating documentation in /var/www/html/docs"
+%x{#{MU_BASE}/lib/bin/mu-gen-docs}
+
+if $INITIALIZE
+  MU.log "Setting initial password for admin user 'mu', for logging into Nagios and other built-in services.", MU::NOTICE
+  puts %x{#{MU_BASE}/lib/bin/mu-user-manage -g mu}
+  MU.log "If Scratchpad web interface is not accessible, try the following:", MU::NOTICE
+  puts "#{MU_BASE}/lib/bin/mu-user-manage -g --no-scratchpad mu".bold
+end
+
+if !ENV['PATH'].match(/(^|:)#{Regexp.quote(MU_BASE)}\/bin(:|$)/)
+  MU.log "I added some entries to your $PATH, run this to import them:", MU::NOTICE
+  puts "source #{HOMEDIR}/.bashrc".bold
+end