cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-tools/recipes/nrpe.rb

@@ -0,0 +1,115 @@
+# Cookbook Name:: mu-tools
+# Recipe:: nrpe
+#
+# Copyright:: Copyright (c) 2016 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#	  http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+
+if !node['application_attributes']['skip_recipes'].include?('nrpe')
+  case node['platform_family']
+    when "rhel"
+    package ['nrpe', 'nagios-plugins-disk', 'nagios-plugins-nrpe', 'nagios-plugins-ssh'] 
+    master_ips = get_mu_master_ips
+    master_ips << "127.0.0.1"
+    master_ips.uniq!
+  
+    include_recipe "mu-tools::set_local_fw"
+  
+    template "/etc/nagios/nrpe.cfg" do
+      source "nrpe.cfg.erb"
+      mode 0644
+      variables(
+        :master_ips => master_ips
+      )
+      notifies :restart, "service[nrpe]", :delayed
+    end
+  
+    service "nrpe" do
+      action [:enable, :start]
+    end
+  
+    directory "/etc/nagios/nrpe.d" do
+      owner "nrpe"
+      group "nrpe"
+      mode 0755
+    end
+  
+    case elversion
+    when 7
+      %w{nrpe_file.pp nrpe_file.te nrpe_check_disk.te nrpe_check_disk.pp}.each { |f|
+        cookbook_file "#{Chef::Config[:file_cache_path]}/#{f}" do
+          source f
+        end
+      }
+  
+      execute "Allow NRPE checks through SELinux" do
+        command "/usr/sbin/semodule -i nrpe_file.pp"
+        cwd Chef::Config[:file_cache_path]
+        not_if "/usr/sbin/semodule -l | grep nrpe_file"
+        notifies :restart, "service[nrpe]", :delayed
+      end
+  
+      execute "Allow NRPE check_disk through SELinux" do
+        command "/usr/sbin/semodule -i nrpe_check_disk.pp"
+        cwd Chef::Config[:file_cache_path]
+        not_if "/usr/sbin/semodule -l | grep nrpe_check_disk"
+        notifies :restart, "service[nrpe]", :delayed
+      end
+    when 6
+      if node['platform'] != 'amazon'
+        cookbook_file "nrpe_disk.pp" do
+          path "#{Chef::Config[:file_cache_path]}/nrpe_disk.pp"
+        end
+    
+        execute "Allow NRPE disk checks through SELinux" do
+          command "/usr/sbin/semodule -i nrpe_disk.pp"
+          cwd Chef::Config[:file_cache_path]
+          not_if "/usr/sbin/semodule -l | grep nrpe_disk"
+          notifies :restart, "service[nrpe]", :delayed
+        end
+      end
+    end
+  
+    service "nrpe" do
+      action [:enable, :start]
+    end
+  
+    nrpe_check "check_disk" do
+      command "#{node['nrpe']['plugin_dir']}/check_disk"
+      warning_condition '15%'
+      critical_condition '5%'
+      action :add
+      notifies :run, 'execute[selinux permissions]', :immediately if node['platform'] != 'amazon'
+      notifies :restart, "service[nrpe]", :delayed
+    end
+  
+    # execute "chmod o+r /etc/nagios/nrpe.d/check_disk.cfg"
+    # file "/etc/nagios/nrpe.d/check_disk.cfg" do
+      # mode 0640
+      # owner "nagios"
+      # group "nagios"
+    # end
+  
+    # don't run this every time so it won't restart the NRPE service on every chef run
+    if node['platform'] != 'amazon'
+      execute "selinux permissions" do
+        command "/usr/bin/chcon -R -t nrpe_etc_t /etc/nagios/nrpe.d/"
+        notifies :restart, "service[nrpe]", :delayed
+        action :nothing
+      end
+    end
+
+    service "nrpe" do
+      action [:enable, :start]
+    end
+  end
+end

data/cookbooks/mu-tools/recipes/python_pip.rb

@@ -0,0 +1,35 @@
+#
+# Cookbook Name::ecap-tools
+# Recipe:: python_pip
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#         http://egt-labs.com/ecap/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+#
+# Updates setup_tools and pip by way of pip, which seems to be required before putting pip to any real use
+# Requires an initial python and pip installation
+# For now, linux only.  Remove case statement if windows turns out to need it
+
+case node['platform']
+  when "windows"
+  else
+    bash "update-pip" do
+      code <<-EOF
+#                   easy_install --upgrade setuptools
+                    curl https://bootstrap.pypa.io/ez_setup.py | python
+                    pip install pip --upgrade
+      EOF
+    end
+end
+

data/cookbooks/mu-tools/recipes/retrieve_application.rb

@@ -0,0 +1,51 @@
+#
+# Cookbook Name:: mu-tools
+# Recipe:: retrieve_application
+#
+# This recipe implements the standard method for retrieving an application and placing it on the 
+# designated application_volume location.  It depends upon the application_attributes node structure
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+$project_id = node['application_attributes']['project']['id']
+$application_repo_password = node['application_attributes']['git']['password']
+$application_repo_name = node['application_attributes']['git']['repo_name']
+$application_repo_username = node['application_attributes']['git']['username']
+$application_repo = node['application_attributes']['git']['repo']
+$application_mount_device = node['application_attributes']['application_volume']['mount_device']
+$application_mount_directory = node['application_attributes']['application_volume']['mount_directory']
+$application_repo_branch = node['application_attributes']['git']['branch']
+
+ruby_block "Pull App from Repo" do
+  block do
+    #we can assume the app directory is present now, from create_application_volume
+    Dir.chdir($application_mount_directory)
+    git_clone = "git clone https://#{$application_repo_username}:#{$application_repo_password}@#{$application_repo}"
+    cmd = Mixlib::ShellOut.new(git_clone)
+    cmd.run_command
+    # `#{git_clone}`
+    unless $application_repo_branch == "master"
+      Chef::Log.info("Branching to #{$application_repo_branch}")
+      Dir.chdir("#{$application_mount_directory}/#{$application_repo_name}")
+      cmd = Mixlib::ShellOut.new("git checkout -b remotes/origin/#{$application_repo_branch}")
+      cmd.run_command
+      cmd = Mixlib::ShellOut.new("git pull origin #{$application_repo_branch}")
+      cmd.run_command
+      # `git checkout -b remotes/origin/#{$application_repo_branch}`
+      # `git pull origin #{$application_repo_branch}`
+    end
+  end
+  action :run
+end

data/cookbooks/mu-tools/recipes/rsyslog.rb

@@ -0,0 +1,65 @@
+#
+# Cookbook Name:: mu-tools
+# Recipe:: rsyslog
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if !node['application_attributes']['skip_recipes'].include?('rsyslog')
+  case node['platform_family']
+  when "rhel", "debian"
+    package "rsyslog"
+    package "rsyslog-gnutls"
+    execute "chcon -R -h -t var_log_t /Mu_Logs" do
+      action :nothing
+      only_if { ::Dir.exists?("/Mu_Logs") }
+    end
+    service "rsyslog" do
+      action [:enable, :start]
+      notifies :run, "execute[chcon -R -h -t var_log_t /Mu_Logs]", :immediately
+    end
+    if platform_family?("rhel")
+      $rsyslog_ssl_ca_path = "/etc/pki/Mu_CA.pem"
+      if !platform?("amazon")
+        package "policycoreutils-python"
+        execute "allow rsyslog to meddle with port 10514" do
+          command "/usr/sbin/semanage port -a -t syslogd_port_t -p tcp 10514"
+          not_if "/usr/sbin/semanage port -l | grep '^syslog.*10514'"
+        end
+      end
+  
+    elsif platform_family?("debian")
+      include_recipe "mu-utility::apt"
+      $rsyslog_ssl_ca_path = "/etc/ssl/Mu_CA.pem"
+      package "policycoreutils"
+    end
+
+    if node.name != "MU-MASTER" # XXX I'm sure we can come up with a smarter condition than this
+      master_ips = get_mu_master_ips
+# XXX This should prefer a master IP that's in our private subnet, and also
+# be able to tell which ones are private and which are public.
+      template "/etc/rsyslog.d/0-mu-log-client.conf" do
+        source "0-mu-log-client.conf.erb"
+        variables(
+          :syslog_server => master_ips.last,
+          :ssl_ca_path => $rsyslog_ssl_ca_path
+        )
+        notifies :restart, "service[rsyslog]", :delayed
+      end
+      cookbook_file "Mu_CA.pem" do
+        path $rsyslog_ssl_ca_path
+      end
+    end
+  end
+end

data/cookbooks/mu-tools/recipes/set_local_fw.rb

@@ -0,0 +1,57 @@
+#
+# Cookbook Name:: mu-tools
+# Recipe:: set_local_fw
+#
+# Copyright:: Copyright (c) 2016 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+
+master_ips = get_mu_master_ips
+case node['platform']
+when platform_family?('rhel')
+  include_recipe 'mu-firewall'
+
+  if elversion >= 7 # Can use firewalld, but not if iptables is already rigged
+    package "firewall-config" do
+      not_if "/bin/systemctl list-units | grep iptables.service"
+    end
+    execute "restart FirewallD" do # ...but only if iptables isn't live
+      command "/bin/firewall-cmd --reload"
+      action :nothing
+      not_if "/bin/systemctl list-units | grep iptables.service"
+      only_if { ::File.exists?("/bin/firewall-cmd") }
+    end
+  end
+
+  if elversion <= 6
+    firewall_rule "Allow loopback in" do
+      raw "-A INPUT -i lo -j ACCEPT"
+    end
+
+    firewall_rule "Allow loopback out" do
+      raw "-A OUTPUT -o lo -j ACCEPT"
+    end
+  end
+
+  opento = master_ips.map { |x| "#{x}/32"}
+
+  opento.uniq.each { |src|
+    [:tcp, :udp, :icmp].each { |proto|
+      firewall_rule "allow all #{src} #{proto.to_s} traffic" do
+        source src
+        protocol proto
+      end
+    }
+  }
+end

data/cookbooks/mu-tools/recipes/set_mu_hostname.rb

@@ -0,0 +1,81 @@
+#
+# Cookbook Name:: mu-tools
+# Recipe:: set_mu_hostname
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+if !node['application_attributes']['skip_recipes'].include?('set_mu_hostname')
+  $hostname = node.name
+  if !node['ad']['computer_name'].nil? and !node['ad']['computer_name'].empty?
+    $hostname = node['ad']['computer_name']
+  end rescue NoMethodError
+  $ipaddress = node['ipaddress']
+
+  if !platform_family?("windows")
+    sibs=get_sibling_nodes(node)
+
+    template "/etc/hosts" do
+      source "etc_hosts.erb"
+      variables(
+        hostname: $hostname,
+        ipaddress: $ipaddress,
+        nodes: sibs
+      )
+    end
+  end
+
+  case node['platform']
+    when "rhel", "centos", "amazon"
+      template "/etc/sysconfig/network" do
+        source "etc_sysconfig_network.erb"
+        notifies :run, "execute[set hostname]", :immediately if elversion != 7
+        variables(
+          hostname: $hostname,
+          platform: node['platform']
+        )
+      end
+
+      if elversion == 7 and File.exists?("/etc/cloud/cloud.cfg")
+        execute "sed -i '/ssh_pwauth/a preserve_hostname: true' /etc/cloud/cloud.cfg" do
+          not_if "grep 'preserve_hostname: true' /etc/cloud/cloud.cfg"
+        end
+
+        execute "hostnamectl set-hostname #{$hostname} --static && systemctl restart systemd-hostnamed" do
+          # not_if "hostnamectl | grep Static | grep #{$hostname.downcase}"
+          not_if "grep #{$hostname} /etc/hostname"
+        end
+
+        file "/etc/hostname" do
+          content $hostname
+        end
+      else
+        execute "set hostname" do
+          command "hostname #{$hostname}"
+          not_if "test \"`hostname`\" = \"#{$hostname}\" "
+        end
+      end
+    when "ubuntu"
+      execute "set hostname" do
+        command "hostname #{$hostname}"
+        not_if "test \"`hostname`\" = \"#{$hostname}\" "
+      end
+
+      file "/etc/hostname" do
+        content $hostname
+      end
+    else
+      Chef::Log.info("Unsupported platform #{node['platform']}")
+  end
+end

data/cookbooks/mu-tools/recipes/split_var_partitions.rb

@@ -0,0 +1,86 @@
+#
+# Cookbook Name:: mu-tools
+# Recipe:: default
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This recipe attempts to create a series of separate partitions to be mounted
+# in lieu of having /var be part of your root volume. It makes a lot of brittle
+# assumptions and is overall a dodgy procedure. If you find it useful, it is
+# recommended you only use this when building new baseline images, rather than
+# make it part of your regular build process.
+
+if !node['application_attributes']['skip_recipes'].include?('split_var_partitions')
+  log "*************** "+node['platform']
+  case node['platform']
+    when "redhat", "rhel", "centos", "amazon"
+
+      include_recipe "mu-tools::aws_api"
+      include_recipe "mu-tools::google_api"
+  
+      # Moving /var data around and setting up the mounts means interfering
+      # with a bunch of stuff writing /var. Make an attempt to turn the stuff
+      # off.
+      execute "make auditd stoppable" do
+        command "sed -i s/RefuseManualStop=yes/RefuseManualStop=no/ /usr/lib/systemd/system/auditd.service"
+        only_if "grep ^RefuseManualStop=yes /usr/lib/systemd/system/auditd.service"
+        action :nothing
+      end
+      services = ["rsyslog", "postfix", "acpid", "NetworkManager", "dbus", "auditd"]
+      services.each { |svc|
+        begin
+          resources("service[#{svc}]")
+        rescue Chef::Exceptions::ResourceNotFound
+          service svc do
+            action :nothing
+            ignore_failure true
+            if svc == "auditd"
+              notifies :run, "execute[make auditd stoppable]", :before
+            end
+          end
+        end
+      }
+
+      execute "umount /var/tmp" do
+        ignore_failure true
+        action :nothing
+      end
+      ["var_log_audit", "var_log", "var"].each { |volume|
+        mu_tools_disk node['application_attributes'][volume]['mount_directory'] do
+          device node['application_attributes'][volume]['mount_device']
+          size node['application_attributes'][volume]['volume_size_gb']
+          preserve_data true
+          reboot_after_create true
+          services.each { |svc|
+            notifies :stop, "service[#{svc}]", :before
+          }
+          notifies :run, "execute[umount /var/tmp]", :before if volume == "var"
+        end
+      }
+      ["var", "var_log", "var_log_audit"].each { |volume|
+        mu_tools_disk "properly mount #{volume}" do
+          mountpoint node['application_attributes'][volume]['mount_directory']
+          device node['application_attributes'][volume]['mount_device']
+          not_if "awk '{print $2}' < /etc/mtab | grep '^#{node['application_attributes'][volume]['mount_directory']}$'"
+        end
+      }
+      execute "restorecon -Rv /var" do
+        not_if "ls -aZ /var | grep ':var_t:'"
+      end
+  
+    else
+      Chef::Log.info("Unsupported platform #{node['platform']}")
+  end
+end

data/cookbooks/mu-tools/recipes/splunk-client.rb

@@ -0,0 +1,69 @@
+#
+# Cookbook Name:: mu-tools
+# Recipe:: splunk-client
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include_recipe "mu-splunk::client"
+
+if node['splunk']['discovery'] == "groupname"
+  splunk_servers = search(
+      :node,
+      "splunk_is_server:true AND splunk_groupname:#{node['splunk_groupname']}"
+  ).sort! do
+  |a, b|
+    a.name <=> b.name
+  end
+else
+  splunk_servers = search(# ~FC003
+      :node,
+      "splunk_is_server:true AND chef_environment:#{node.chef_environment}"
+  ).sort! do
+  |a, b|
+    a.name <=> b.name
+  end
+end
+
+splunk_auth_info = chef_vault_item(node['splunk']['auth']['data_bag'], node['splunk']['auth']['data_bag_item'])['auth']
+user, pw = splunk_auth_info.split(':')
+
+if node['platform_family'] != "windows"
+  deploy_guard = "#{splunk_dir}/etc/.setup_deploy_poll"
+  file deploy_guard do
+    content 'true\n'
+    owner 'root'
+    group 'root'
+    mode 00600
+    action :nothing
+  end
+else
+  deploy_guard = "#{splunk_dir}/etc/setup_deploy_poll"
+  file deploy_guard do
+    content 'true\n'
+    action :nothing
+  end
+end
+
+deploy_svr = splunk_servers.first
+if !deploy_svr.nil?
+  execute 'Splunk client poll for deploy server' do
+    command "\"#{splunk_cmd}\" set deploy-poll #{deploy_svr['splunk']['receiver_ip']}:8089 -auth #{user}:#{pw}"
+    not_if { ::File.exists?(deploy_guard) }
+    notifies :create, "file[#{deploy_guard}]", :immediately
+    notifies :restart, "service[splunk]", :delayed
+  end
+else
+  Chef::Log.info ("Configured to run a Splunk client, but no Splunk servers were found.")
+end

data/cookbooks/mu-tools/recipes/splunk-server.rb

@@ -0,0 +1,104 @@
+#
+# Cookbook Name:: mu-tools
+# Recipe:: splunk-server
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+[443, 8089, 9997].each { |port|
+  bash "Allow #{port} through iptables for Splunk" do
+    user "root"
+    not_if "/sbin/iptables -nL | egrep '^ACCEPT.*dpt:#{port}($| )'"
+    code <<-EOH
+			iptables -I INPUT -p tcp --dport #{port} -j ACCEPT
+			service iptables save
+    EOH
+  end
+}
+
+if !node['splunk']['splunkdb']['dev'].nil?
+  directory node['splunk']['splunkdb']['path'] do
+    recursive true
+  end
+  execute "mkfs.ext4 #{node['splunk']['splunkdb']['dev']}" do
+    not_if "tune2fs -l #{node['splunk']['splunkdb']['dev']}"
+  end
+  mount node['splunk']['splunkdb']['path'] do
+    device node['splunk']['splunkdb']['dev']
+    action [:mount, :enable]
+  end
+end
+
+include_recipe "mu-splunk::server"
+
+if node['splunk']['splunkdb']['path'] != "/opt/splunk/var/lib/splunk"
+  execute "set SPLUNK_DB path in splunk-launch.conf to #{node['splunk']['splunkdb']['path']}" do
+    command "sed -i 's/^ *SPLUNK_DB//' /opt/splunk/etc/splunk-launch.conf ; echo 'SPLUNK_DB=#{node['splunk']['splunkdb']['path']}' >> /opt/splunk/etc/splunk-launch.conf; chown splunk:splunk #{node['splunk']['splunkdb']['path']}"
+    not_if "grep '^SPLUNK_DB=#{node['splunk']['splunkdb']['path']}'"
+    notifies :restart, "service[splunk]", :immediately
+  end
+end
+
+if node['splunk']['minfreespace'] != 5000
+  server_conf = "/opt/splunk/etc/system/local/server.conf"
+  execute "set minFreeSpace in #{server_conf}" do
+    command "echo '[diskUsage]' >> #{server_conf}; echo 'minFreeSpace = #{node['splunk']['minfreespace']}' >> #{server_conf}"
+    not_if "grep '^minFreeSpace = #{node['splunk']['minfreespace']}$' #{server_conf}"
+    notifies :restart, "service[splunk]", :immediately
+  end
+end
+
+file "/opt/splunk/etc/.ui_login"
+
+remote_directory "/opt/splunk/etc/deployment-apps/" do
+  files_mode "0644"
+  files_owner "splunk"
+  mode "0744"
+  owner "splunk"
+  source "splunk-apps"
+end
+
+cookbook_file "/opt/splunk/etc/system/local/serverclass.conf" do
+  source "serverclass.conf"
+  mode "0644"
+end
+
+if node['splunk']['license'] != nil
+  directory "/opt/splunk/etc/licenses/enterprise" do
+    owner "splunk"
+    group "splunk"
+    mode 00644
+    action :create
+  end
+
+  if !node['splunk']['license_cookbook'].nil? and !node['splunk']['license_cookbook'].empty?
+    cookbook_file "/opt/splunk/etc/licenses/enterprise/Splunk.license" do
+      source "splunk.license"
+      cookbook node['splunk']['license_cookbook']
+      notifies :restart, "service[splunk]", :immediately
+    end
+  end rescue NoMethodError
+end
+
+#splunk_auth_info = chef_vault_item(node['splunk'][:auth][:data_bag], node['splunk'][:auth][:data_bag_item])['auth']
+#admin_user, admin_pw = splunk_auth_info.split(':')
+#
+#node[:deployment][:admins].each_pair { |name, data|
+#	execute "add #{data['email']} as Splunk power user" do
+#		user "splunk"
+#		command "/opt/splunk/bin/splunk add user #{data['email']} -password changeme -role admin -email #{data['email']} -full-name '#{name}' -auth #{admin_user}:#{admin_pw}"
+#		not_if "grep ^:#{data['email']}: /opt/splunk/etc/passwd"
+#	end
+#}
+

data/cookbooks/mu-tools/recipes/store_inspec_attr.rb

@@ -0,0 +1,8 @@
+# Run this recipe at the end of any deploy that will be tested with inspec
+# Required to produce node attributes for inspec to look at
+
+ruby_block "Save node attributes" do
+  block do
+      IO.write("/tmp/chef_node.json", node.to_json)
+  end
+end