freighthop 0.2.1 → 0.3.0

data/modules/apache/tests/vhost.pp

@@ -0,0 +1,237 @@
+## Default vhosts, and custom vhosts
+# NB: Please see the other vhost_*.pp example files for further
+# examples.
+
+# Base class. Declares default vhost on port 80 and default ssl
+# vhost on port 443 listening on all interfaces and serving
+# $apache::docroot
+class { 'apache': }
+
+# Most basic vhost
+apache::vhost { 'first.example.com':
+  port    => '80',
+  docroot => '/var/www/first',
+}
+
+# Vhost with different docroot owner/group
+apache::vhost { 'second.example.com':
+  port          => '80',
+  docroot       => '/var/www/second',
+  docroot_owner => 'third',
+  docroot_group => 'third',
+}
+
+# Vhost with serveradmin
+apache::vhost { 'third.example.com':
+  port        => '80',
+  docroot     => '/var/www/third',
+  serveradmin => 'admin@example.com',
+}
+
+# Vhost with ssl (uses default ssl certs)
+apache::vhost { 'ssl.example.com':
+  port    => '443',
+  docroot => '/var/www/ssl',
+  ssl     => true,
+}
+
+# Vhost with ssl and specific ssl certs
+apache::vhost { 'fourth.example.com':
+  port     => '443',
+  docroot  => '/var/www/fourth',
+  ssl      => true,
+  ssl_cert => '/etc/ssl/fourth.example.com.cert',
+  ssl_key  => '/etc/ssl/fourth.example.com.key',
+}
+
+# Vhost with english title and servername parameter
+apache::vhost { 'The fifth vhost':
+  servername => 'fifth.example.com',
+  port       => '80',
+  docroot    => '/var/www/fifth',
+}
+
+# Vhost with server aliases
+apache::vhost { 'sixth.example.com':
+  serveraliases => [
+    'sixth.example.org',
+    'sixth.example.net',
+  ],
+  port          => '80',
+  docroot       => '/var/www/fifth',
+}
+
+# Vhost with alternate options
+apache::vhost { 'seventh.example.com':
+  port    => '80',
+  docroot => '/var/www/seventh',
+  options => [
+    'Indexes',
+    'MultiViews',
+  ],
+}
+
+# Vhost with AllowOverride for .htaccess
+apache::vhost { 'eighth.example.com':
+  port     => '80',
+  docroot  => '/var/www/eighth',
+  override => 'All',
+}
+
+# Vhost with access and error logs disabled
+apache::vhost { 'ninth.example.com':
+  port       => '80',
+  docroot    => '/var/www/ninth',
+  access_log => false,
+  error_log  => false,
+}
+
+# Vhost with custom access and error logs and logroot
+apache::vhost { 'tenth.example.com':
+  port            => '80',
+  docroot         => '/var/www/tenth',
+  access_log_file => 'tenth_vhost.log',
+  error_log_file  => 'tenth_vhost_error.log',
+  logroot         => '/var/log',
+}
+
+# Vhost with a cgi-bin
+apache::vhost { 'eleventh.example.com':
+  port        => '80',
+  docroot     => '/var/www/eleventh',
+  scriptalias => '/usr/lib/cgi-bin',
+}
+
+# Vhost with a proxypass configuration
+apache::vhost { 'twelfth.example.com':
+  port          => '80',
+  docroot       => '/var/www/twelfth',
+  proxy_dest    => 'http://internal.example.com:8080/twelfth',
+  no_proxy_uris => ['/login','/logout'],
+}
+
+# Vhost to redirect /login and /logout
+apache::vhost { 'thirteenth.example.com':
+  port            => '80',
+  docroot         => '/var/www/thirteenth',
+  redirect_source => [
+    '/login',
+    '/logout',
+  ],
+  redirect_dest   => [
+    'http://10.0.0.10/login',
+    'http://10.0.0.10/logout',
+  ],
+}
+
+# Vhost to permamently redirect
+apache::vhost { 'fourteenth.example.com':
+  port            => '80',
+  docroot         => '/var/www/fourteenth',
+  redirect_source => '/blog',
+  redirect_dest   => 'http://blog.example.com',
+  redirect_status => 'permanent',
+}
+
+# Vhost with a rack configuration
+apache::vhost { 'fifteenth.example.com':
+  port           => '80',
+  docroot        => '/var/www/fifteenth',
+  rack_base_uris => ['/rackapp1', '/rackapp2'],
+}
+
+# Vhost to redirect non-ssl to ssl
+apache::vhost { 'sixteenth.example.com non-ssl':
+  servername   => 'sixteenth.example.com',
+  port         => '80',
+  docroot      => '/var/www/sixteenth',
+  rewrites     => [
+    {
+      comment       => "redirect non-SSL traffic to SSL site",
+      rewrite_cond => ['%{HTTPS} off'],
+      rewrite_rule => ['(.*) https://%{HTTPS_HOST}%{REQUEST_URI}'],
+    }
+  ]
+}
+apache::vhost { 'sixteenth.example.com ssl':
+  servername => 'sixteenth.example.com',
+  port       => '443',
+  docroot    => '/var/www/sixteenth',
+  ssl        => true,
+}
+
+# Vhost to redirect non-ssl to ssl using old rewrite method
+apache::vhost { 'sixteenth.example.com non-ssl old rewrite':
+  servername   => 'sixteenth.example.com',
+  port         => '80',
+  docroot      => '/var/www/sixteenth',
+  rewrite_cond => '%{HTTPS} off',
+  rewrite_rule => '(.*) https://%{HTTPS_HOST}%{REQUEST_URI}',
+}
+apache::vhost { 'sixteenth.example.com ssl old rewrite':
+  servername => 'sixteenth.example.com',
+  port       => '443',
+  docroot    => '/var/www/sixteenth',
+  ssl        => true,
+}
+
+# Vhost to block repository files
+apache::vhost { 'seventeenth.example.com':
+  port    => '80',
+  docroot => '/var/www/seventeenth',
+  block   => 'scm',
+}
+
+# Vhost with special environment variables
+apache::vhost { 'eighteenth.example.com':
+  port    => '80',
+  docroot => '/var/www/eighteenth',
+  setenv  => ['SPECIAL_PATH /foo/bin','KILROY was_here'],
+}
+
+apache::vhost { 'nineteenth.example.com':
+  port     => '80',
+  docroot  => '/var/www/nineteenth',
+  setenvif => 'Host "^([^\.]*)\.website\.com$" CLIENT_NAME=$1',
+}
+
+# Vhost with additional include files
+apache::vhost { 'twentyieth.example.com':
+  port                => '80',
+  docroot             => '/var/www/twelfth',
+  additional_includes => ['/tmp/proxy_group_a','/tmp/proxy_group_b'],
+}
+
+# Vhost with alias for subdomain mapped to same named directory
+# http://example.com.loc => /var/www/example.com
+apache::vhost { 'subdomain.loc':
+  vhost_name      => '*',
+  port            => '80',
+  virtual_docroot => '/var/www/%-2+',
+  docroot         => '/var/www',
+  serveraliases   => ['*.loc',],
+}
+
+# Vhost with SSLProtocol,SSLCipherSuite, SSLHonorCipherOrder
+apache::vhost { 'securedomain.com':
+        priority              => '10',
+        vhost_name            => 'www.securedomain.com',
+        port                  => '443',
+        docroot               => '/var/www/secure',
+        ssl                   => true,
+        ssl_cert              => '/etc/ssl/securedomain.cert',
+        ssl_key               => '/etc/ssl/securedomain.key',
+        ssl_chain             => '/etc/ssl/securedomain.crt',
+        ssl_protocol          => '-ALL +SSLv3 +TLSv1',
+        ssl_cipher            => 'ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM',
+        ssl_honorcipherorder  => 'On',
+        add_listen            => 'false',
+}
+
+# Vhost with access log environment variables writing control
+apache::vhost { 'twentyfirst.example.com':
+  port               => '80',
+  docroot            => '/var/www/twentyfirst',
+  access_log_env_var => 'admin',
+}
+

data/modules/apache/tests/vhost_directories.pp

@@ -0,0 +1,30 @@
+# Base class. Declares default vhost on port 80 and default ssl
+# vhost on port 443 listening on all interfaces and serving
+# $apache::docroot
+class { 'apache': }
+
+# Example from README adapted.
+apache::vhost { 'readme.example.net':
+  docroot     => '/var/www/readme',
+  directories => [
+    { path => '/var/www/readme', 'ServerTokens' => 'prod' },
+    { path => '/usr/share/empty', 'allow' => 'from all' },
+  ],
+}
+
+# location test
+apache::vhost { 'location.example.net':
+  docroot     => '/var/www/location',
+  directories => [
+    { path => '/location', 'provider' => 'location', 'ServerTokens' => 'prod' }, 
+  ],
+}
+
+# files test, curedly disable access to accidental backup files.
+apache::vhost { 'files.example.net':
+  docroot     => '/var/www/files',
+  directories => [
+    { path => '~ (\.swp|\.bak|~)$', 'provider' => 'files', 'deny' => 'from all' }, 
+  ],
+}
+

data/modules/apache/tests/vhost_ip_based.pp

@@ -0,0 +1,25 @@
+## IP-based vhosts on any listen port
+# IP-based vhosts respond to requests on specific IP addresses.
+
+# Base class. Turn off the default vhosts; we will be declaring
+# all vhosts below.
+class { 'apache':
+  default_vhost => false,
+}
+
+# Listen on port 80 and 81; required because the following vhosts
+# are not declared with a port parameter.
+apache::listen { '80': }
+apache::listen { '81': }
+
+# IP-based vhosts
+apache::vhost { 'first.example.com':
+  ip       => '10.0.0.10',
+  docroot  => '/var/www/first',
+  ip_based => true,
+}
+apache::vhost { 'second.example.com':
+  ip       => '10.0.0.11',
+  docroot  => '/var/www/second',
+  ip_based => true,
+}

data/modules/apache/tests/vhost_ssl.pp

@@ -0,0 +1,23 @@
+## SSL-enabled vhosts
+# SSL-enabled vhosts respond only to HTTPS queries.
+
+# Base class. Turn off the default vhosts; we will be declaring
+# all vhosts below.
+class { 'apache':
+  default_vhost => false,
+}
+
+# Non-ssl vhost
+apache::vhost { 'first.example.com non-ssl':
+  servername => 'first.example.com',
+  port       => '80',
+  docroot    => '/var/www/first',
+}
+
+# SSL vhost at the same domain
+apache::vhost { 'first.example.com ssl':
+  servername => 'first.example.com',
+  port       => '443',
+  docroot    => '/var/www/first',
+  ssl        => true,
+}

data/modules/apache/tests/vhosts_without_listen.pp

@@ -0,0 +1,53 @@
+## Declare ip-based and name-based vhosts
+# Mixing Name-based vhost with IP-specific vhosts requires `add_listen =>
+# 'false'` on the non-IP vhosts
+
+# Base class. Turn off the default vhosts; we will be declaring
+# all vhosts below.
+class { 'apache':
+  default_vhost => false,
+}
+
+
+# Add two an IP-based vhost on 10.0.0.10, ssl and non-ssl
+apache::vhost { 'The first IP-based vhost, non-ssl':
+  servername => 'first.example.com',
+  ip         => '10.0.0.10',
+  port       => '80',
+  ip_based   => true,
+  docroot    => '/var/www/first',
+}
+apache::vhost { 'The first IP-based vhost, ssl':
+  servername => 'first.example.com',
+  ip         => '10.0.0.10',
+  port       => '443',
+  ip_based   => true,
+  docroot    => '/var/www/first-ssl',
+  ssl        => true,
+}
+
+# Two name-based vhost listening on 10.0.0.20
+apache::vhost { 'second.example.com':
+  ip      => '10.0.0.20',
+  port    => '80',
+  docroot => '/var/www/second',
+}
+apache::vhost { 'third.example.com':
+  ip      => '10.0.0.20',
+  port    => '80',
+  docroot => '/var/www/third',
+}
+
+# Two name-based vhosts without IPs specified, so that they will answer on either 10.0.0.10 or 10.0.0.20 . It is requried to declare
+# `add_listen => 'false'` to disable declaring "Listen 80" which will conflict
+# with the IP-based preceeding vhosts.
+apache::vhost { 'fourth.example.com':
+  port       => '80',
+  docroot    => '/var/www/fourth',
+  add_listen => false,
+}
+apache::vhost { 'fifth.example.com':
+  port       => '80',
+  docroot    => '/var/www/fifth',
+  add_listen => false,
+}

data/modules/freighthop/manifests/database/mysql/grant.pp

@@ -0,0 +1,11 @@
+define freighthop::database::mysql::grant(
+  $user
+) {
+  mysql_grant { "freighthop_mysql_grant_for_${user}":
+    ensure     => 'present',
+    options    => ['GRANT'],
+    privileges => ['ALL'],
+    table      => '*.*',
+    user       => "${user}@%",
+  }
+}

data/modules/freighthop/manifests/database/mysql.pp

@@ -1,20 +1,10 @@
 class freighthop::database::mysql(
-  $db_names,
+  $databases,
   $users,
 ) {
   include mysql::server
+  include mysql::client
 
-  mysql::db{$db_names:
-    user => "notorious",
-    password => "notorious",
-    host => "localhost",
-    grant => ['All']
-  }
-  mysql_grant { $users:
-    ensure     => 'present',
-    options    => ['GRANT'],
-    privileges => ['ALL'],
-    table      => '*.*',
-    user       => 'notorious@%',
-  }
-}
+  mysql_database { $databases: } ->
+  freighthop::database::mysql::grant { $users: }
+}

data/modules/freighthop/manifests/database/postgres.pp

@@ -1,5 +1,5 @@
 class freighthop::database::postgres(
-  $db_names,
+  $databases,
   $users,
 ) {
   include postgresql::server
@@ -19,7 +19,7 @@ class freighthop::database::postgres(
     auth_method => 'trust',
     order       => '0001',
   }
-  postgresql::server::database { $db_names: }
+  postgresql::server::database { $databases: }
   postgresql::server::role { $users:
     superuser     => true,
     createdb      => true,

data/modules/freighthop/manifests/database.pp

@@ -1,10 +1,10 @@
 class freighthop::database(
-  $flavors = []
+  $servers = []
 ) {
-  if (member($flavors, 'postgres')) {
+  if member($servers, 'postgres') {
     class { 'freighthop::database::postgres':}
   }
-  if (member($flavors, 'mysql')) {
+  if member($servers, 'mysql') {
     class { 'freighthop::database::mysql':}
   }
 }

data/modules/freighthop/manifests/init.pp

@@ -1,35 +1,18 @@
 class freighthop(
-  $ppas             = $freighthop::params::ppas,
-  $packages         = $freighthop::params::packages,
-  $languages        = $freighthop::params::languages,
-  $ruby_version     = $freighthop::params::ruby_version,
-  $app_name         = $freighthop::params::app_name,
-  $app_root         = $freighthop::params::app_root,
-  $web_root         = $freighthop::params::web_root,
-  $web_port         = $freighthop::params::web_port,
-  $server_name      = $freighthop::params::server_name,
-  $ssl_cert_path    = $freighthop::params::ssl_cert_path,
-  $ssl_key_path     = $freighthop::params::ssl_key_path,
-) inherits freighthop::params {
-
+  $ppas,
+  $packages,
+  $languages,
+) {
+  class { 'freighthop::params': } ->
   class { 'freighthop::packages':
     ppas      => $ppas,
     packages  => $packages,
-    languages => $languages,
   } ->
 
   class { 'freighthop::language':
     languages    => $languages,
-    ruby_version => $ruby_version
-  } ->
-
-  class { 'freighthop::web':
-    upstream_web_port => $web_port,
-    server_name       => $server_name,
-    web_root          => $web_root,
-    ssl_cert_path     => $ssl_cert_path,
-    ssl_key_path      => $ssl_key_path,
   } ->
 
+  class { 'freighthop::web': } ->
   class { 'freighthop::database':}
 }

data/modules/freighthop/manifests/language/ruby.pp

@@ -1,29 +1,9 @@
 class freighthop::language::ruby(
-  $version
+  $version = $freighthop::params::ruby_version
 ){
-  class { '::rbenv':
-    global_version => $version,
-  }
-
-  rbenv::version { $version: }
-
-  # The rbenv puppet module drops $RBENV_ROOT/version but the package from
-  # ppa:gds/govuk is an older version of rbenv that expects $RBENV_ROOT/global;
-  # this is a workaround that uses the installed CLI to fix it.
-  exec { 'fix-rbenv-global-version':
-    command     => "rbenv global ${version}",
-    unless      => "rbenv global | grep '${version}'",
-    environment => 'RBENV_ROOT=/usr/lib/rbenv',
-    require     => Rbenv::Version[$version]
-  }
-
-  Exec {
-    path => [
-      '/usr/local/bin',
-      '/usr/bin',
-      '/usr/sbin',
-      '/bin',
-      '/sbin',
-    ]
+  rbenv::install { 'vagrant': }
+  rbenv::compile { $version:
+    global => true,
+    user   => 'vagrant',
   }
 }

data/modules/freighthop/manifests/language.pp

@@ -1,11 +1,8 @@
 class freighthop::language(
   $languages,
-  $ruby_version
 ) {
   if (member($languages, 'ruby')) {
-    class { 'freighthop::language::ruby':
-      version => $ruby_version,
-    }
+    class { 'freighthop::language::ruby': }
   }
   if (member($languages, 'clojure')) {
     class { 'freighthop::language::clojure':

data/modules/freighthop/manifests/packages.pp

@@ -1,20 +1,10 @@
 class freighthop::packages(
   $ppas,
   $packages,
-  $languages,
 ) {
-  if (member($languages, 'ruby')) {
-    apt::ppa { 'ppa:gds/govuk': }
-    apt::ppa { 'ppa:phinze/rbenv': }
-  }
-  apt::ppa { $ppas: }
+  include apt
 
-  package { [
-    'build-essential',
-    'git-core',
-  ]:
-    ensure => installed,
-  }
+  apt::ppa { $ppas: }
 
   package { $packages:
     ensure  => installed,

data/modules/freighthop/manifests/params.pp

@@ -1,13 +1,21 @@
 class freighthop::params {
-  $packages         = []
-  $ppas             = []
-  $languages        = []
-  $ruby_version     = '1.9.3-p392'
-  $app_name         = $::hostname
-  $app_root         = "/srv/${app_name}"
-  $web_root         = "${app_root}/public"
-  $web_port         = 3000
-  $server_name      = $::fqdn
-  $ssl_cert_path    = "/etc/ssl/certs/${app_name}.pem"
-  $ssl_key_path     = "/etc/ssl/private/${app_name}.key"
+  $packages                = []
+  $ppas                    = []
+  $languages               = []
+  $ruby_version            = '1.9.3-p392'
+  $app_name                = $::hostname
+  $app_root                = "/srv/${app_name}"
+  $web_servers             = ['nginx']
+  $web_root                = "${app_root}/public"
+  $http_port               = 80
+  $https_port              = 443
+  $upstream_port           = 3000
+  $server_name             = $::fqdn
+  $ssl                     = true
+  $ssl_cert_path           = "/etc/ssl/certs/${app_name}.pem"
+  $ssl_key_path            = "/etc/ssl/private/${app_name}.key"
+  $uid                     = $::freighthop_uid
+  $gid                     = $::freighthop_gid
+  $passenger               = false
+  $passenger_buffer_upload = false
 }

data/modules/freighthop/manifests/web/apache.pp

@@ -0,0 +1,60 @@
+class freighthop::web::apache(
+  $ssl,
+  $ssl_cert_path,
+  $ssl_key_path,
+  $server_name,
+  $port                    = $freighthop::params::http_port,
+  $ssl_port                = $freighthop::params::https_port,
+  $upstream_port           = $freighthop::params::upstream_port,
+  $owner                   = $freighthop::params::uid,
+  $group                   = $freighthop::params::gid,
+  $web_root                = $freighthop::params::web_root,
+  $passenger               = $freighthop::params::passenger,
+  $passenger_buffer_upload = $freighthop::params::passenger_buffer_upload,
+) {
+  class { '::apache':
+    default_vhost => false,
+  }
+  apache::vhost { "${server_name} non-ssl":
+    servername    => $server_name,
+    docroot       => $web_root,
+    port          => $port,
+    docroot_owner => $owner,
+    docroot_group => $group,
+  }
+
+  if str2bool($ssl) {
+    apache::vhost { "${server_name} ssl":
+      servername => $server_name,
+      docroot    => $web_root,
+      port       => $ssl_port,
+      ssl        => true,
+      ssl_cert   => $ssl_cert_path,
+      ssl_key    => $ssl_key_path,
+    }
+  }
+
+  if str2bool($passenger) {
+    package { 'apt-transport-https':
+      ensure => installed
+    } ->
+    apt::source { 'phusion':
+      location => 'https://oss-binaries.phusionpassenger.com/apt/passenger',
+      key      => '561F9B9CAC40B2F7',
+      pin      => 1000,
+    } ->
+    package { 'passenger':
+      ensure => 'installed'
+    } ->
+    apache::mod { 'passenger':
+    } ->
+    file { '/etc/apache2/conf.d/passenger.conf':
+      ensure  => present,
+      owner   => 'root',
+      group   => 'root',
+      mode    => '0644',
+      content => template('freighthop/apache/passenger.conf.erb'),
+      notify  => Service['httpd'],
+    }
+  }
+}

data/modules/freighthop/manifests/web/nginx.pp

@@ -0,0 +1,22 @@
+class freighthop::web::nginx(
+  $ssl,
+  $ssl_cert_path,
+  $ssl_key_path,
+  $server_name,
+  $port          = $freighthop::params::http_port,
+  $ssl_port      = $freighthop::params::https_port,
+  $upstream_port = $freighthop::params::upstream_port,
+  $web_root      = $freighthop::params::web_root,
+) {
+  class {'::nginx':
+    confd_purge => true
+  }
+
+  file { '/etc/nginx/conf.d/vagrant-rails.conf':
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    content => template('freighthop/nginx/vagrant-rails.conf.erb'),
+    notify  => Service['nginx'],
+  }
+}