lobot 0.10.3 → 1.0.pre

data/chef/travis-cookbooks/messaging_broker/haproxy/recipes/app_lb.rb

@@ -0,0 +1,50 @@
+#
+# Cookbook Name:: haproxy
+# Recipe:: app_lb
+#
+# Copyright 2011, Opscode, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+pool_members = search("node", "role:#{node['haproxy']['app_server_role']} AND chef_environment:#{node.chef_environment}") || []
+
+# load balancer is in the pool
+if node.run_list.roles.include?(node['haproxy']['app_server_role'])
+  pool_members << node
+end
+
+package "haproxy" do
+  action :install
+end
+
+template "/etc/default/haproxy" do
+  source "haproxy-default.erb"
+  owner "root"
+  group "root"
+  mode 0644
+end
+
+service "haproxy" do
+  supports :restart => true, :status => true, :reload => true
+  action [:enable, :start]
+end
+
+template "/etc/haproxy/haproxy.cfg" do
+  source "haproxy-app_lb.cfg.erb"
+  owner "root"
+  group "root"
+  mode 0644
+  variables :pool_members => pool_members.uniq
+  notifies :restart, "service[haproxy]"
+end

data/chef/travis-cookbooks/messaging_broker/haproxy/recipes/default.rb

@@ -0,0 +1,42 @@
+#
+# Cookbook Name:: haproxy
+# Recipe:: default
+#
+# Copyright 2009, Opscode, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+package "haproxy" do
+  action :install
+end
+
+template "/etc/default/haproxy" do
+  source "haproxy-default.erb"
+  owner "root"
+  group "root"
+  mode 0644
+end
+
+service "haproxy" do
+  supports :restart => true, :status => true, :reload => true
+  action [:enable, :start]
+end
+
+template "/etc/haproxy/haproxy.cfg" do
+  source "haproxy.cfg.erb"
+  owner "root"
+  group "root"
+  mode 0644
+  notifies :restart, "service[haproxy]"
+end

data/chef/travis-cookbooks/messaging_broker/haproxy/templates/default/haproxy-app_lb.cfg.erb

@@ -0,0 +1,34 @@
+global
+        log 127.0.0.1   local0
+        log 127.0.0.1   local1 notice
+        #log loghost    local0 info
+        maxconn 4096
+        #debug
+        #quiet
+        user haproxy
+        group haproxy
+
+defaults
+        log     global
+        mode    http
+        option  httplog
+        option  dontlognull
+        retries 3
+        redispatch
+        maxconn 2000
+        contimeout      5000
+        clitimeout      50000
+        srvtimeout      50000
+        
+# Set up application listeners here.
+listen application 0.0.0.0:80
+  balance roundrobin
+  <% @pool_members.each do |member| -%>
+  <% server_ip = member.has_key?("ec2") ? member["ec2"]["public_ipv4"] : member["ipaddress"] -%>
+  server <%= member["hostname"] %> <%= server_ip %>:<%= node["haproxy"]["member_port"] %> weight 1 maxconn 1 check 
+  <% end -%>
+<% if node["haproxy"]["enable_admin"] -%>
+listen admin 0.0.0.0:22002
+  mode http
+  stats uri /
+<% end -%>

data/chef/travis-cookbooks/messaging_broker/haproxy/templates/default/haproxy-default.erb

@@ -0,0 +1,4 @@
+# Set ENABLED to 1 if you want the init script to start haproxy.
+ENABLED=1
+# Add extra flags here.
+#EXTRAOPTS="-de -m 16"

data/chef/travis-cookbooks/messaging_broker/haproxy/templates/default/haproxy.cfg.erb

@@ -0,0 +1,27 @@
+global
+        log 127.0.0.1   local0
+        log 127.0.0.1   local1 notice
+        #log loghost    local0 info
+        maxconn 4096
+        #debug
+        #quiet
+        user haproxy
+        group haproxy
+
+defaults
+        log     global
+        mode    http
+        option  httplog
+        option  dontlognull
+        retries 3
+        redispatch
+        maxconn 2000
+        contimeout      5000
+        clitimeout      50000
+        srvtimeout      50000
+        
+# Set up application listeners here.
+listen application 0.0.0.0:8400
+  balance roundrobin
+  server localhost 127.0.0.1:4000 weight 1 maxconn 5 check 
+  server localhost 127.0.0.1:4001 weight 1 maxconn 5 check 

data/chef/travis-cookbooks/messaging_broker/iptables/definitions/iptables_rule.rb

@@ -0,0 +1,35 @@
+#
+# Cookbook Name:: iptables
+# Definition:: iptables_rule
+#
+# Copyright 2008-2009, Opscode, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+define :iptables_rule, :enable => true, :source => nil, :variables => {} do
+  template_source = params[:source] ? params[:source] : "#{params[:name]}.erb"
+  
+  template "/etc/iptables.d/#{params[:name]}" do
+    source template_source
+    mode 0644
+    variables params[:variables]
+    backup false
+    notifies :run, resources(:execute => "rebuild-iptables")
+    if params[:enable]
+      action :create
+    else
+      action :delete
+    end
+  end
+end

data/chef/travis-cookbooks/messaging_broker/iptables/files/default/rebuild-iptables

@@ -0,0 +1,284 @@
+#!/usr/bin/perl -w
+our $ID = q$Id: rebuild-iptables 344 2006-10-04 02:48:30Z digant $;
+
+#
+# rebuild-iptables -- Construct an iptables rules file from fragments.
+#
+# Written by Russ Allbery <rra@stanford.edu>
+# Adapted by Digant C Kasundra <digant@stanford.edu>
+# Adapted by Joe Williams (2011) <joe@joetify.com>
+# Copyright 2005, 2006 Board of Trustees, Leland Stanford Jr. University
+#
+# Constructs an iptables rules file from the prefix, standard, and suffix
+# files in the iptables configuration area, adding any additional modules
+# specified in the command line, and prints the resulting iptables rules to
+# standard output (suitable for saving into /var/lib/iptables or some other
+# appropriate location on the system).
+
+##############################################################################
+# Modules and declarations
+##############################################################################
+
+require 5.006;
+use strict;
+
+use Getopt::Long qw(GetOptions);
+
+# Path to the iptables template area.
+our $TEMPLATE = '/etc/iptables.d';
+
+##############################################################################
+# Installation
+##############################################################################
+
+# Return the prefix
+sub prefix {
+  my $data;
+  ( $data = <<'END_OF_PREFIX' ) =~ s/^\s+//gm;
+        *filter
+        :INPUT ACCEPT
+    :FORWARD ACCEPT
+    :OUTPUT ACCEPT
+    :FWR -
+    -A INPUT -j FWR
+    -A FWR -i lo -j ACCEPT
+END_OF_PREFIX
+
+  return $data;
+}
+
+# Return the suffix
+sub suffix {
+  my $data;
+  ( $data = <<'END_OF_SUFFIX' ) =~ s/^\s+//gm;
+        # Rejects all remaining connections with port-unreachable errors.
+
+        -A FWR -p tcp -m tcp --tcp-flags SYN,RST,ACK SYN -j REJECT --reject-with icmp-port-unreachable
+        -A FWR -p udp -j REJECT --reject-with icmp-port-unreachable
+        COMMIT
+END_OF_SUFFIX
+
+  return $data;
+}
+
+sub snat {
+  my $data = "";
+  if ( -f "/etc/iptables.snat" ) {
+    open( SNAT, "<", "/etc/iptables.snat" )
+      or die "$0: cannot open /etc/iptables.snat: $!\n";
+    while (<SNAT>) {
+      $data = $data . $_;
+    }
+    close(SNAT);
+  }
+  return $data;
+}
+
+# Read in a file, processing includes as required.  Returns the contents of
+# the file as an array.
+sub read_iptables {
+  my ($file) = @_;
+  my @data;
+  $file = $TEMPLATE . '/' . $file unless $file =~ m%^\.?/%;
+  local *MODULE;
+  open( MODULE, '<', $file ) or die "$0: cannot open $file: $!\n";
+  local $_;
+  while (<MODULE>) {
+    if (/^\s*include\s+(\S+)$/) {
+      my $included = $1;
+      $included = $TEMPLATE . '/' . $included
+        unless $included =~ m%^\.?/%;
+      if ( $file eq $included ) {
+        die "$0: include loop in $file, line $.\n";
+      }
+      push( @data, "\n" );
+      push( @data, read_iptables($included) );
+      push( @data, "\n" );
+    } elsif (/^\s*include\s/) {
+      die "$0: malformed include line in $file, line $.\n";
+    } else {
+      push( @data, $_ );
+    }
+  }
+  close MODULE;
+  return @data;
+}
+
+# Write a file carefully.
+sub write_iptables {
+  my ( $file, @data ) = @_;
+  open( NEW, "> $file.new" ) or die "$0: cannot create $file.new: $!\n";
+  print NEW @data or die "$0: cannot write to $file.new: $!\n";
+  close NEW       or die "$0: cannot flush $file.new: $!\n";
+  rename( "$file.new", $file )
+    or die "$0: cannot install new $file: $!\n";
+}
+
+# Install iptables on a Red Hat system.  Takes the array containing the new
+# iptables data.
+sub install_redhat {
+  my (@data) = @_;
+  write_iptables( '/etc/sysconfig/iptables', @data );
+  system( "/sbin/service", "iptables", "restart" );
+}
+
+# Install iptables on a Debian system.  Take the array containing the new
+# iptables data.
+sub install_debian {
+  my (@data) = @_;
+  unless ( -d '/etc/iptables' ) {
+    mkdir( '/etc/iptables', 0755 )
+      or die "$0: cannot mkdir /etc/iptables: $!\n";
+  }
+  write_iptables( "/etc/iptables/general", @data );
+  system("/sbin/iptables-restore < /etc/iptables/general") == 0
+    or die "rebuild-iptables: iptables-restore failed! - $?"
+}
+
+##############################################################################
+# Main routine
+##############################################################################
+
+# Fix things up for error reporting.
+$| = 1;
+my $fullpath = $0;
+$0 =~ s%.*/%%;
+
+# Parse command-line options.
+my ( $help, $version );
+Getopt::Long::config( 'bundling', 'no_ignore_case' );
+GetOptions(
+  'h|help'    => \$help,
+  'v|version' => \$version
+) or exit 1;
+if ($help) {
+  print "Feeding myself to perldoc, please wait....\n";
+  exec( 'perldoc', '-t', $fullpath );
+} elsif ($version) {
+  my $version = join( ' ', ( split( ' ', $ID ) )[ 1 .. 3 ] );
+  $version =~ s/,v\b//;
+  $version =~ s/(\S+)$/($1)/;
+  $version =~ tr%/%-%;
+  print $version, "\n";
+  exit;
+}
+my @modules;
+
+if ( -d '/etc/iptables.d' ) {
+  @modules = </etc/iptables.d/*>;
+}
+
+# Concatenate everything together.
+my @data;
+push( @data, prefix() );
+push( @data, "\n" );
+for my $module (@modules) {
+  push( @data, read_iptables($module) );
+  push( @data, "\n" );
+}
+push( @data, suffix() );
+push( @data, snat() );
+
+if ( -f '/etc/debian_version' ) {
+  install_debian(@data);
+} elsif ( -f '/etc/redhat-release' ) {
+  install_redhat(@data);
+} else {
+  die "$0: cannot figure out whether this is Red Hat or Debian\n";
+}
+
+exit 0;
+__END__
+
+##############################################################################
+# Documentation
+##############################################################################
+
+=head1 NAME
+
+rebuild-iptables - Construct an iptables rules file from fragments
+
+=head1 SYNOPSIS
+
+rebuild-iptables [B<-hv>]
+
+=head1 DESCRIPTION
+
+B<rebuild-iptables> constructs an iptables configuration file by concatenating
+various modules found in F</etc/iptables.d>.  The resulting iptables
+configuration file is written to the appropriate file for either Red Hat or
+Debian (determined automatically) and iptables is restarted.
+
+Each module is just a text file located in the directory mentioned above that
+contains one or more iptables configuration lines (basically the arguments to
+an B<iptables> invocation), possibly including comments.
+
+Along with the modules in the directory specified, a standard prefix and suffix
+is added.
+
+Normally, the contents of each module are read in verbatim, but a module may
+also contain the directive:
+
+    include <module>
+
+on a separate line, where <module> is the path to another module to include,
+specified the same way as modules given on the command line (hence, either a
+file name relative to F</afs/ir/service/jumpstart/data/iptables> or an
+absolute path).  Such a line will be replaced with the contents of the named
+file.  Be careful when using this directive to not create loops; files
+including themselves will be detected, but more complex loops will not and
+will result in infinite output.
+
+=head1 OPTIONS
+
+=over 4
+
+=item B<-h>, B<--help>
+
+Print out this documentation (which is done simply by feeding the script to
+C<perldoc -t>).
+
+=item B<-v>, B<--version>
+
+Print out the version of B<rebuild-iptables> and exit.
+
+=back
+
+=head1 FILES
+
+=over 4
+
+=item F</etc/iptables.d>
+
+The default module location.
+
+=item F</etc/debian_version>
+
+If this file exists, the system is assumed to be a Debian system for
+determining the installation location when B<-i> is used.
+
+=item F</etc/iptables/general>
+
+The install location of the generated configuration file on Debian.
+
+=item F</etc/redhat-release>
+
+If this file exists, the system is assumed to be a Red Hat system for
+determining the installation location when B<-i> is used.
+
+=item F</etc/sysconfig/iptables>
+
+The install location of the generated configuration file on Red Hat.
+
+=back
+
+=head1 AUTHOR
+
+Russ Allbery <rra@stanford.edu>
+Digant C Kasundra <digant@stanford.edu>
+
+=head1 SEE ALSO
+
+iptables(8)
+
+=cut