taperole 1.4.3 → 1.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 52571d14e976b6967ecd19947b5da42e6f440f3f
-  data.tar.gz: 225873fdc0a01cc94a31e530d4f27db88afca460
+  metadata.gz: 1372e1110daa93edadf03db73b31b30ff6b462d9
+  data.tar.gz: 8f81436b6a573bb255cc5da1f9c5279a63b2f60a
 SHA512:
-  metadata.gz: 55efbdb575e225cb4c9154fe35d902d63e7249f028c238eb1b559f2f415b199d175f184f0f0b22a187832e961f0bd09a65d6e553e6588c85144f7c9d72f6b21c
-  data.tar.gz: 7ba362c159e23f8a1c167ec31f4bfc9e16ea5653d5d0208eefa0baa595c20ff4ab8fc5a633304d31f3b6512a32392fe416ce74d8dc4834a488fda7ca2c7ef0de
+  metadata.gz: 4d1a4b5893e8ff6d5d7bb8bb3399239ba7acb8241ebcac35365a84f3b0af249ea55e329381270327cb279577f0b7939a7ef38c86bbad9faaa68b28d9a74bc6d1
+  data.tar.gz: 3dbc60ec192fed213447511417a05e57517b2c21fabfb0d00459353a44733260ec4788c77ece0b289fcf9ffd09a4c81fbcc310fdf4d44f28b0f897779f064c47

data/CHANGELOG.md

@@ -1,3 +1,9 @@
+### 1.5.0
+* Self-signed SSL is now on by default
+* Port 80 redirects to 443
+* You can now build custom playbooks with then `tape ansible playbook -b playbook.yml` command
+* Dev Keys folder is working again!
+
 ### 1.4.3
 * Update nodesource ansible galaxy role
 * Install latest version of node 4.x

data/Vagrantfile

@@ -11,7 +11,7 @@ Vagrant.configure 2 do |config|
   # config.vm.network(:private_network, :ip => private_ip)
 
 # TODO free me from the bonds of this ip
-  config.vm.network 'forwarded_port', guest: 80, host: 8080
+  config.vm.network 'forwarded_port', guest: 443, host: 8080
   config.vm.network 'private_network', type: 'dhcp'
 
   config.ssh.insert_key = false

data/bin/tape

@@ -27,6 +27,11 @@ opt_parser = OptionParser.new do |opts|
       options.port = p
     end
 
+  opts.on('-bBOOK', "--book=PLAYBOOK",
+    String, "A custom playbook to run") do |p|
+      options.book = p
+    end
+
   opts.on("-h", "--help", "Show this help") do
     STDERR.puts opts
     exit 0

data/lib/tape/ansible_runner.rb

@@ -23,7 +23,7 @@ class AnsibleRunner < ExecutionModule
          "Restarts Nginx"
   action :configure_deployer_user,
          proc { ansible '-t deployer' },
-         "Ensures the deployer user is present and configures his SSH keys"
+         "Ensures the deployer user is present and configures its SSH keys"
   action :reset_db,
          proc { ansible '-t db_reset -e force_db_reset=true' },
          "wipes and re-seeds the DB"
@@ -43,6 +43,9 @@ class AnsibleRunner < ExecutionModule
   action :everything,
          proc { valid_preconfigs ? ansible : puts("Not a Rails or JS app") },
          "This does it all."
+  action :playbook,
+         proc { ansible_custom_playbook },
+         "Run a custom playbook"
 
   def initialize(*args)
     super
@@ -83,6 +86,10 @@ class AnsibleRunner < ExecutionModule
     exec_ansible("#{tapefiles_dir}/deploy.yml", cmd_str)
   end
 
+  def ansible_custom_playbook(cmd_str = '')
+    exec_ansible("#{tapefiles_dir}/#{opts.book}", cmd_str)
+  end
+
   def exec_ansible(playbook, args)
     enforce_roles_path!
     cmd = "ANSIBLE_CONFIG=#{local_dir}/.tape/ansible.cfg ansible-playbook -i #{inventory_file} #{playbook} #{args} #{hosts_flag} -e tape_dir=#{tape_dir}"

data/roles/backend_checkout/tasks/main.yml

@@ -1,3 +1,16 @@
+- name: Check if there are commited changes on {{ be_app_branch }}
+  remote_user: "{{ deployer_user.name }}"
+  command: bash -lc "git fetch origin && git diff --name-only origin/{{ be_app_branch }}"
+  args:
+    chdir: "{{be_app_path}}"
+  register: changes_on_remote
+  tags: [be_deploy]
+
+- name: Inform User if there are no changes
+  debug: msg={{no_changes_found_error.split('\n')}}
+  when: changes_on_remote.stdout_lines == []
+  tags: [be_deploy]
+
 - name: Check out application
   remote_user: "{{ deployer_user.name }}"
   git: dest={{ be_app_path }}

data/roles/deployer_user/tasks/keys.yml

@@ -9,15 +9,9 @@
   command: "cp /root/.ssh/authorized_keys /home/{{ deployer_user.name }}/.ssh/authorized_keys"
 
 - name: Ensure devs keys are present
-  authorized_key: key=
+  authorized_key: key={{ lookup('file', item) }}
                   manage_dir=yes
                   state=present
                   user=deployer
   with_fileglob:
-    - "{{tapefiles_dir}}/dev_keys/*"
-
-- name: Ensure DO pubkey is present
-  authorized_key: key="{{ lookup('file', 'id_rsa_digital_ocean.pub') }}"
-                  manage_dir=yes
-                  state=present
-                  user=deployer
+    - "./dev_keys/*"

data/roles/deployer_user/tasks/main.yml

@@ -12,7 +12,7 @@
 # It's possible for the deployer's homedir to get created on accident by
 # a deploy script or something getting run before this.  This just ensures
 # the env is sane moving forward
-- name: Ensure deployer user owns his own homedir
+- name: Ensure deployer user owns its own homedir
   file: path=/home/deployer state=directory owner=deployer
 
 - include: keys.yml

data/roles/frontend_deploy/tasks/main.yml

@@ -1,3 +1,16 @@
+- name: Check if there are commited changes on {{ fe_app_branch }}
+  remote_user: "{{ deployer_user.name }}"
+  command: bash -lc "git fetch origin && git diff --name-only origin/{{ fe_app_branch }}"
+  args:
+    chdir: "{{fe_app_path}}"
+  register: changes_on_remote
+  tags: [fe_deploy]
+
+- name: Inform User if there are no changes
+  debug: msg={{no_changes_found_error.split('\n')}}
+  when: changes_on_remote.stdout_lines == []
+  tags: [fe_deploy]
+
 - name: clone the FE app
   when: fe_app_repo is defined
   remote_user: "{{ deployer_user.name }}"

data/roles/nginx/tasks/main.yml

@@ -10,6 +10,22 @@
   file: path=/etc/nginx/sites-enabled/default state=absent
   tags: [nginx]
 
+- name: Create /etc/nginx/ssl
+  file: path=/etc/nginx/ssl state=directory
+  tags: [nginx]
+
+- name: Create self signed SSL cert/key
+  command: bash -lc "openssl req -x509 -sha256 -nodes -newkey rsa:2048 -keyout self-signed.key -out self-signed.crt -subj '/CN=localhost'"
+  args:
+    chdir: /etc/nginx/ssl
+  tags: [nginx]
+
+- name: Create Diffie Hellman Ephemeral Parameters (this will take some time)
+  command: bash -lc "openssl dhparam -out dhparam.pem 2048"
+  args:
+    chdir: /etc/nginx/ssl
+  tags: [nginx]
+
 - name: Configure App nginx
   template: src=nginx_unicorn.j2 dest=/etc/nginx/sites-enabled/{{ app_name }}
   tags: [nginx]

data/roles/nginx/templates/nginx_unicorn.j2

@@ -3,12 +3,37 @@ upstream unicorn {
   server unix:{{unicorn_sockfile}} fail_timeout=0;
 }
 {% endif %}
+server {
+  listen 80;
+  return 301 https://$host$request_uri;
+}
+
 
 server {
-  listen 80 default deferred;
+  listen 443 default deferred;
 
   # server_name example.com;
 
+  ssl on;
+  ssl_certificate /etc/nginx/ssl/self-signed.crt;
+  ssl_certificate_key /etc/nginx/ssl/self-signed.key;
+  ssl_dhparam /etc/nginx/ssl/dhparam.pem;
+
+  ssl_prefer_server_ciphers on;
+  ssl_session_cache shared:SSL:10m;
+  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+
+  ssl_stapling on;
+  ssl_stapling_verify on;
+  resolver 8.8.8.8 8.8.4.4 valid=300s;
+  resolver_timeout 5s;
+
+  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
+
+  add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
+  add_header X-Frame-Options "DENY";
+  add_header Public-Key-Pins 'pin-sha256="klO23nT2ehFDXCfx3eHTDRESMz3asj1muO+4aIdjiuY="; pin-sha256="633lt352PKRXbOwf4xSEa1M517scpD3l5f79xMD9r9Q="; max-age=2592000; includeSubDomains';
+
 {% if fe_app_repo is defined%}
   root {{ fe_app_path }}/dist;
 {% else %}

data/taperole.gemspec

@@ -1,6 +1,6 @@
 Gem::Specification.new do |spec|
   spec.name = "taperole"
-  spec.version = '1.4.3'
+  spec.version = '1.5.0'
   spec.authors = ['Jack Forrest', 'Smashing Boxes', 'Brandon Mathis']
   spec.description = "General purpose server provisioning and application deployment toolkit"
   spec.email = ['jack@smashingboxes.com', 'brandon@sbox.es']

data/templates/base/deploy.example.yml

@@ -1,10 +1,6 @@
 ---
 - hosts: omnibox
 
-  tags:
-    - be_deploy
-    - fe_deploy
-
   vars_files:
     - "{{tape_dir}}/vars/defaults.yml"
     - tape_vars.yml

data/templates/static_html/deploy.example.yml

@@ -1,10 +1,6 @@
 ---
 - hosts: omnibox
 
-  tags:
-    - be_deploy
-    - fe_deploy
-
   vars_files:
     - "{{tape_dir}}/vars/defaults.yml"
     - tape_vars.yml

data/vars/defaults.yml

@@ -36,3 +36,8 @@ fe_build_command: gulp build
 allowed_ports:
   - 80
   - 443
+
+no_changes_found_error: |
+  ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️
+  No Changes detected on remote branch proceeding with deploy anyway
+  ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️ ‼️

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: taperole
 version: !ruby/object:Gem::Version
-  version: 1.4.3
+  version: 1.5.0
 platform: ruby
 authors:
 - Jack Forrest
@@ -10,7 +10,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-12 00:00:00.000000000 Z
+date: 2016-03-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: slack-notifier
@@ -69,7 +69,6 @@ files:
 - roles/delayed_job/tasks/main.yml
 - roles/delayed_job/templates/dj_monit_config.j2
 - roles/delayed_job/templates/dj_monit_runner.j2
-- roles/deployer_user/files/id_rsa_digital_ocean.pub
 - roles/deployer_user/tasks/keys.yml
 - roles/deployer_user/tasks/main.yml
 - roles/frontend_deploy/handlers/main.yml

data/roles/deployer_user/files/id_rsa_digital_ocean.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDlxLbugDNrEg0fjchsaBG6XYLTOh5u3miY8gYMR0xQXFGsxipsyzYd2HSdSp1SPJyGs6aIXVfbeMsQVvDbWQcJTZYYviO2Rj6olf13gjA094CAlDCyTVgRYddiTrirFZiMCzLJrXfyGKiQcQ50BhpYYcO8QwPkwDo6Fs6AhuVMxlYc7MqHTxUwiuVsiC3xbgVnGszB8fI3v0531KOl7tJAxI1M53uexH3rQrEdpRwNqQAXoH9a8HQTaxvtSip1HrNvUumStt1Pu8tP6b3KwuHPwTnJtc2fXYatLjfbAf9KSCCPFhLfwVdAGTI/De6GU4D9lh39sFt2E63qV7mnSn+f