Merge tag '0.8.0'

Release 0.8.0

16 files changed, 159 insertions, 93 deletions

diff --git a/puppet/modules/site_couchdb/files/designs/identities/Identity.json b/puppet/modules/site_couchdb/files/designs/identities/Identity.json
index 2ac092ab..b1c567c1 100644
--- a/puppet/modules/site_couchdb/files/designs/identities/Identity.json
+++ b/puppet/modules/site_couchdb/files/designs/identities/Identity.json
@@ -2,27 +2,33 @@
   "_id": "_design/Identity",
   "language": "javascript",
   "views": {
-    "by_user_id": {
-      "map": "                function(doc) {\n                  if ((doc['type'] == 'Identity') && (doc['user_id'] != null)) {\n                    emit(doc['user_id'], 1);\n                  }\n                }\n",
-      "reduce": "_sum"
-    },
     "by_address_and_destination": {
       "map": "                function(doc) {\n                  if ((doc['type'] == 'Identity') && (doc['address'] != null) && (doc['destination'] != null)) {\n                    emit([doc['address'], doc['destination']], 1);\n                  }\n                }\n",
       "reduce": "_sum"
     },
-    "by_address": {
-      "map": "                function(doc) {\n                  if ((doc['type'] == 'Identity') && (doc['address'] != null)) {\n                    emit(doc['address'], 1);\n                  }\n                }\n",
-      "reduce": "_sum"
+    "all": {
+      "map": "                function(doc) {\n                  if (doc['type'] == 'Identity') {\n                    emit(doc._id, null);\n                  }\n                }\n"
     },
-    "pgp_key_by_email": {
-      "map": "      function(doc) {\n        if (doc.type != 'Identity') {\n          return;\n        }\n        if (typeof doc.keys === \"object\") {\n          emit(doc.address, doc.keys[\"pgp\"]);\n        }\n      }\n"
+    "cert_fingerprints_by_expiry": {
+      "map": "function(doc) {\n  if (doc.type != 'Identity') {\n    return;\n  }\n  if (typeof doc.cert_fingerprints === \"object\") {\n    for (fp in doc.cert_fingerprints) {\n      if (doc.cert_fingerprints.hasOwnProperty(fp)) {\n        emit(doc.cert_fingerprints[fp], fp);\n      }\n    }\n  }\n}\n"
+    },
+    "cert_expiry_by_fingerprint": {
+      "map": "function(doc) {\n  if (doc.type != 'Identity') {\n    return;\n  }\n  if (typeof doc.cert_fingerprints === \"object\") {\n    for (fp in doc.cert_fingerprints) {\n      if (doc.cert_fingerprints.hasOwnProperty(fp)) {\n        emit(fp, doc.cert_fingerprints[fp]);\n      }\n    }\n  }\n}\n"
     },
     "disabled": {
-      "map": "      function(doc) {\n        if (doc.type != 'Identity') {\n          return;\n        }\n        if (typeof doc.user_id === \"undefined\") {\n          emit(doc._id, 1);\n        }\n      }\n"
+      "map": "function(doc) {\n  if (doc.type != 'Identity') {\n    return;\n  }\n  if (typeof doc.user_id === \"undefined\") {\n    emit(doc._id, 1);\n  }\n}\n"
     },
-    "all": {
-      "map": "                function(doc) {\n                  if (doc['type'] == 'Identity') {\n                    emit(doc._id, null);\n                  }\n                }\n"
+    "pgp_key_by_email": {
+      "map": "function(doc) {\n  if (doc.type != 'Identity') {\n    return;\n  }\n  if (typeof doc.keys === \"object\") {\n    emit(doc.address, doc.keys[\"pgp\"]);\n  }\n}\n"
+    },
+    "by_user_id": {
+      "map": "                function(doc) {\n                  if ((doc['type'] == 'Identity') && (doc['user_id'] != null)) {\n                    emit(doc['user_id'], 1);\n                  }\n                }\n",
+      "reduce": "_sum"
+    },
+    "by_address": {
+      "map": "                function(doc) {\n                  if ((doc['type'] == 'Identity') && (doc['address'] != null)) {\n                    emit(doc['address'], 1);\n                  }\n                }\n",
+      "reduce": "_sum"
     }
   },
-  "couchrest-hash": "e9004d70e26770c621a9667536429a68"
+  "couchrest-hash": "4a774c3f56122b655a314670403b27e2"
 }
\ No newline at end of file
diff --git a/puppet/modules/site_couchdb/files/designs/invite_codes/InviteCode.json b/puppet/modules/site_couchdb/files/designs/invite_codes/InviteCode.json
new file mode 100644
index 00000000..006c1ea1
--- /dev/null
+++ b/puppet/modules/site_couchdb/files/designs/invite_codes/InviteCode.json
@@ -0,0 +1,22 @@
+{
+   "_id": "_design/InviteCode",
+   "language": "javascript",
+   "views": {
+       "by__id": {
+           "map": "                function(doc) {\n                  if ((doc['type'] == 'InviteCode') && (doc['_id'] != null)) {\n                    emit(doc['_id'], 1);\n                  }\n                }\n",
+           "reduce": "_sum"
+       },
+       "by_invite_code": {
+           "map": "                function(doc) {\n                  if ((doc['type'] == 'InviteCode') && (doc['invite_code'] != null)) {\n                    emit(doc['invite_code'], 1);\n                  }\n                }\n",
+           "reduce": "_sum"
+       },
+       "by_invite_count": {
+           "map": "                function(doc) {\n                  if ((doc['type'] == 'InviteCode') && (doc['invite_count'] != null)) {\n                    emit(doc['invite_count'], 1);\n                  }\n                }\n",
+           "reduce": "_sum"
+       },
+       "all": {
+           "map": "                function(doc) {\n                  if (doc['type'] == 'InviteCode') {\n                    emit(doc._id, null);\n                  }\n                }\n"
+       }
+   },
+   "couchrest-hash": "83fb8f504520b4a9c7ddbb7928cd0ce3"
+}
\ No newline at end of file
diff --git a/puppet/modules/site_couchdb/files/designs/messages/Message.json b/puppet/modules/site_couchdb/files/designs/messages/Message.json
index 7bcd74c7..6a48fc4d 100644
--- a/puppet/modules/site_couchdb/files/designs/messages/Message.json
+++ b/puppet/modules/site_couchdb/files/designs/messages/Message.json
@@ -2,17 +2,17 @@
   "_id": "_design/Message",
   "language": "javascript",
   "views": {
-    "by_user_ids_to_show_and_created_at": {
-      "map": "// not using at moment\n// call with something like Message.by_user_ids_to_show_and_created_at.startkey([user_id, start_date]).endkey([user_id,end_date])\nfunction (doc) {\n  if (doc.type === 'Message' && doc.user_ids_to_show && Array.isArray(doc.user_ids_to_show)) {\n    doc.user_ids_to_show.forEach(function (userId) {\n      emit([userId, doc.created_at], 1);\n    });\n  }\n}\n",
-      "reduce": "function(key, values, rereduce) { return sum(values); }"
-    },
     "by_user_ids_to_show": {
       "map": "function (doc) {\n  if (doc.type === 'Message' && doc.user_ids_to_show && Array.isArray(doc.user_ids_to_show)) {\n    doc.user_ids_to_show.forEach(function (userId) {\n      emit(userId, 1);\n    });\n  }\n}\n",
-      "reduce": "function(key, values, rereduce) { return sum(values); }"
+      "reduce": "          function(key, values, rereduce) {\n            return sum(values);\n          }\n"
+    },
+    "by_user_ids_to_show_and_created_at": {
+      "map": "// not using at moment\n// call with something like Message.by_user_ids_to_show_and_created_at.startkey([user_id, start_date]).endkey([user_id,end_date])\nfunction (doc) {\n  if (doc.type === 'Message' && doc.user_ids_to_show && Array.isArray(doc.user_ids_to_show)) {\n    doc.user_ids_to_show.forEach(function (userId) {\n      emit([userId, doc.created_at], 1);\n    });\n  }\n}\n",
+      "reduce": "          function(key, values, rereduce) {\n            return sum(values);\n          }\n"
     },
     "all": {
       "map": "                function(doc) {\n                  if (doc['type'] == 'Message') {\n                    emit(doc._id, null);\n                  }\n                }\n"
     }
   },
-  "couchrest-hash": "0967e7cc5bb1e61edc1c085f6f0cecbf"
+  "couchrest-hash": "ba80168e51015d2678cad88fc6c5b986"
 }
\ No newline at end of file
diff --git a/puppet/modules/site_couchdb/files/designs/tickets/Ticket.json b/puppet/modules/site_couchdb/files/designs/tickets/Ticket.json
index 2c9408b8..578f632b 100644
--- a/puppet/modules/site_couchdb/files/designs/tickets/Ticket.json
+++ b/puppet/modules/site_couchdb/files/designs/tickets/Ticket.json
@@ -24,27 +24,27 @@
     },
     "by_includes_post_by_and_is_open_and_created_at": {
       "map": "function(doc) {\n  var arr = {}\n  if (doc['type'] == 'Ticket' && doc.comments) {\n    doc.comments.forEach(function(comment){\n      if (comment.posted_by && !arr[comment.posted_by]) {\n        //don't add duplicates\n        arr[comment.posted_by] = true;\n        emit([comment.posted_by, doc.is_open, doc.created_at], 1);\n      }\n    });\n  }\n}\n",
-      "reduce": "function(key, values, rereduce) { return sum(values); }"
-    },
-    "by_includes_post_by_and_is_open_and_updated_at": {
-      "map": "function(doc) {\n  var arr = {}\n  if (doc['type'] == 'Ticket' && doc.comments) {\n    doc.comments.forEach(function(comment){\n      if (comment.posted_by && !arr[comment.posted_by]) {\n        //don't add duplicates\n        arr[comment.posted_by] = true;\n        emit([comment.posted_by, doc.is_open, doc.updated_at], 1);\n      }\n    });\n  }\n}\n",
-      "reduce": "function(key, values, rereduce) { return sum(values); }"
-    },
-    "by_includes_post_by_and_updated_at": {
-      "map": "function(doc) {\n  var arr = {}\n  if (doc['type'] == 'Ticket' && doc.comments) {\n    doc.comments.forEach(function(comment){\n      if (comment.posted_by && !arr[comment.posted_by]) {\n        //don't add duplicates\n        arr[comment.posted_by] = true;\n        emit([comment.posted_by, doc.updated_at], 1);\n      }\n    });\n  }\n}\n",
-      "reduce": "function(key, values, rereduce) { return sum(values); }"
+      "reduce": "          function(key, values, rereduce) {\n            return sum(values);\n          }\n"
     },
     "by_includes_post_by": {
       "map": "// TODO: This view is only used in tests--should we keep it?\nfunction(doc) {\n  var arr = {}\n  if (doc['type'] == 'Ticket' && doc.comments) {\n    doc.comments.forEach(function(comment){\n      if (comment.posted_by && !arr[comment.posted_by]) {\n        //don't add duplicates\n        arr[comment.posted_by] = true;\n        emit(comment.posted_by, 1);\n      }\n    });\n  }\n}\n",
-      "reduce": "function(key, values, rereduce) { return sum(values); }"
+      "reduce": "          function(key, values, rereduce) {\n            return sum(values);\n          }\n"
+    },
+    "by_includes_post_by_and_is_open_and_updated_at": {
+      "map": "function(doc) {\n  var arr = {}\n  if (doc['type'] == 'Ticket' && doc.comments) {\n    doc.comments.forEach(function(comment){\n      if (comment.posted_by && !arr[comment.posted_by]) {\n        //don't add duplicates\n        arr[comment.posted_by] = true;\n        emit([comment.posted_by, doc.is_open, doc.updated_at], 1);\n      }\n    });\n  }\n}\n",
+      "reduce": "          function(key, values, rereduce) {\n            return sum(values);\n          }\n"
     },
     "by_includes_post_by_and_created_at": {
       "map": "function(doc) {\n  var arr = {}\n  if (doc['type'] == 'Ticket' && doc.comments) {\n    doc.comments.forEach(function(comment){\n      if (comment.posted_by && !arr[comment.posted_by]) {\n        //don't add duplicates\n        arr[comment.posted_by] = true;\n        emit([comment.posted_by, doc.created_at], 1);\n      }\n    });\n  }\n}\n",
-      "reduce": "function(key, values, rereduce) { return sum(values); }"
+      "reduce": "          function(key, values, rereduce) {\n            return sum(values);\n          }\n"
+    },
+    "by_includes_post_by_and_updated_at": {
+      "map": "function(doc) {\n  var arr = {}\n  if (doc['type'] == 'Ticket' && doc.comments) {\n    doc.comments.forEach(function(comment){\n      if (comment.posted_by && !arr[comment.posted_by]) {\n        //don't add duplicates\n        arr[comment.posted_by] = true;\n        emit([comment.posted_by, doc.updated_at], 1);\n      }\n    });\n  }\n}\n",
+      "reduce": "          function(key, values, rereduce) {\n            return sum(values);\n          }\n"
     },
     "all": {
       "map": "                function(doc) {\n                  if (doc['type'] == 'Ticket') {\n                    emit(doc._id, null);\n                  }\n                }\n"
     }
   },
-  "couchrest-hash": "9978e2cbeacbe8622c2a7f103bf8130f"
+  "couchrest-hash": "b21eaeea8ea66bfda65581b1b7ce06af"
 }
\ No newline at end of file
diff --git a/puppet/modules/site_couchdb/files/designs/users/User.json b/puppet/modules/site_couchdb/files/designs/users/User.json
index 4089ad97..8a82cf4a 100644
--- a/puppet/modules/site_couchdb/files/designs/users/User.json
+++ b/puppet/modules/site_couchdb/files/designs/users/User.json
@@ -11,12 +11,12 @@
     },
     "by_created_at_and_one_month_warning_not_sent": {
       "map": "function (doc) {\n  if ((doc['type'] == 'User') && (doc['created_at'] != null) && (doc['one_month_warning_sent'] == null)) {\n    emit(doc['created_at'], 1);\n  }    \n}\n",
-      "reduce": "function(key, values, rereduce) { return sum(values); }"
+      "reduce": "          function(key, values, rereduce) {\n            return sum(values);\n          }\n"
     },
     "by_created_at": {
       "map": "                function(doc) {\n                  if ((doc['type'] == 'User') && (doc['created_at'] != null)) {\n                    emit(doc['created_at'], 1);\n                  }\n                }\n",
       "reduce": "_sum"
     }
   },
-  "couchrest-hash": "61840ab3ec0f94ef8bbd6dd208db3b70"
+  "couchrest-hash": "d854607d299887a347e554176cb79e20"
 }
\ No newline at end of file
diff --git a/puppet/modules/site_couchdb/manifests/add_users.pp b/puppet/modules/site_couchdb/manifests/add_users.pp
index 2f734ed4..c905316b 100644
--- a/puppet/modules/site_couchdb/manifests/add_users.pp
+++ b/puppet/modules/site_couchdb/manifests/add_users.pp
@@ -1,3 +1,4 @@
+# add couchdb users for all services
 class site_couchdb::add_users {
 
   Class['site_couchdb::create_dbs']
@@ -35,16 +36,6 @@ class site_couchdb::add_users {
     require => Couchdb::Query::Setup['localhost']
   }
 
-  ### tapicero couchdb user
-  ### admin: needs to be able to create user-<uuid> databases
-  ### read: users
-  couchdb::add_user { $site_couchdb::couchdb_tapicero_user:
-    roles   => '["users"]',
-    pw      => $site_couchdb::couchdb_tapicero_pw,
-    salt    => $site_couchdb::couchdb_tapicero_salt,
-    require => Couchdb::Query::Setup['localhost']
-  }
-
   ## webapp couchdb user
   ## read/write: users, tokens, sessions, tickets, identities, customer
   couchdb::add_user { $site_couchdb::couchdb_webapp_user:
diff --git a/puppet/modules/site_couchdb/manifests/bigcouch.pp b/puppet/modules/site_couchdb/manifests/bigcouch.pp
index 469a2783..2de3d4d0 100644
--- a/puppet/modules/site_couchdb/manifests/bigcouch.pp
+++ b/puppet/modules/site_couchdb/manifests/bigcouch.pp
@@ -44,4 +44,7 @@ class site_couchdb::bigcouch {
     require => Package['couchdb'],
     notify  => Service['couchdb']
   }
+
+  include site_check_mk::agent::couchdb::bigcouch
+
 }
diff --git a/puppet/modules/site_couchdb/manifests/create_dbs.pp b/puppet/modules/site_couchdb/manifests/create_dbs.pp
index eea4bbf5..a2d1c655 100644
--- a/puppet/modules/site_couchdb/manifests/create_dbs.pp
+++ b/puppet/modules/site_couchdb/manifests/create_dbs.pp
@@ -90,4 +90,13 @@ class site_couchdb::create_dbs {
     members => "{ \"names\": [\"${site_couchdb::couchdb_webapp_user}\"], \"roles\": [\"replication\"] }",
     require => Couchdb::Query::Setup['localhost']
   }
+
+  ## invite_codes db
+  ## store invite codes for new signups
+  ## r/w: webapp
+  couchdb::create_db { 'invite_codes':
+    members => "{ \"names\": [\"${site_couchdb::couchdb_webapp_user}\"], \"roles\": [\"replication\"] }",
+    require => Couchdb::Query::Setup['localhost']
+  }
+
 }
diff --git a/puppet/modules/site_couchdb/manifests/designs.pp b/puppet/modules/site_couchdb/manifests/designs.pp
index 1ab1c6a1..e5fd94c6 100644
--- a/puppet/modules/site_couchdb/manifests/designs.pp
+++ b/puppet/modules/site_couchdb/manifests/designs.pp
@@ -12,12 +12,13 @@ class site_couchdb::designs {
   }
 
   site_couchdb::upload_design {
-    'customers':   design => 'customers/Customer.json';
-    'identities':  design => 'identities/Identity.json';
-    'tickets':     design => 'tickets/Ticket.json';
-    'messages':    design => 'messages/Message.json';
-    'users':       design => 'users/User.json';
-    'tmp_users':   design => 'users/User.json';
+    'customers':    design => 'customers/Customer.json';
+    'identities':   design => 'identities/Identity.json';
+    'tickets':      design => 'tickets/Ticket.json';
+    'messages':     design => 'messages/Message.json';
+    'users':        design => 'users/User.json';
+    'tmp_users':    design => 'users/User.json';
+    'invite_codes': design => 'invite_codes/InviteCode.json';
     'shared_docs':
       db => 'shared',
       design => 'shared/docs.json';
diff --git a/puppet/modules/site_couchdb/manifests/init.pp b/puppet/modules/site_couchdb/manifests/init.pp
index 6b6ddd3a..c4fe6277 100644
--- a/puppet/modules/site_couchdb/manifests/init.pp
+++ b/puppet/modules/site_couchdb/manifests/init.pp
@@ -26,11 +26,6 @@ class site_couchdb {
   $couchdb_soledad_pw       = $couchdb_soledad['password']
   $couchdb_soledad_salt     = $couchdb_soledad['salt']
 
-  $couchdb_tapicero         = $couchdb_users['tapicero']
-  $couchdb_tapicero_user    = $couchdb_tapicero['username']
-  $couchdb_tapicero_pw      = $couchdb_tapicero['password']
-  $couchdb_tapicero_salt    = $couchdb_tapicero['salt']
-
   $couchdb_webapp           = $couchdb_users['webapp']
   $couchdb_webapp_user      = $couchdb_webapp['username']
   $couchdb_webapp_pw        = $couchdb_webapp['password']
@@ -43,11 +38,14 @@ class site_couchdb {
 
   $couchdb_backup           = $couchdb_config['backup']
   $couchdb_mode             = $couchdb_config['mode']
-  $couchdb_pwhash_alg       = $couchdb_config['pwhash_alg']
 
-  if $couchdb_mode == 'multimaster' { include site_couchdb::bigcouch }
-  if $couchdb_mode == 'master'      { include site_couchdb::master }
-  if $couchdb_mode == 'mirror'      { include site_couchdb::mirror }
+  # ensure bigcouch has been purged from the system:
+  # TODO: remove this check in 0.9 release
+  if file('/opt/bigcouch/bin/bigcouch', '/dev/null') != '' {
+    fail 'ERROR: BigCouch appears to be installed. Make sure you have migrated to CouchDB before proceeding. See https://leap.se/upgrade-0-8'
+  }
+
+  include site_couchdb::plain
 
   Class['site_config::default']
     -> Service['shorewall']
@@ -55,6 +53,7 @@ class site_couchdb {
     -> Class['couchdb']
     -> Class['site_couchdb::setup']
 
+  include ::site_config::default
   include site_stunnel
 
   include site_couchdb::setup
@@ -66,6 +65,17 @@ class site_couchdb {
   if $couchdb_backup   { include site_couchdb::backup }
 
   include site_check_mk::agent::couchdb
-  include site_check_mk::agent::tapicero
+
+  # remove tapicero leftovers on couchdb nodes
+  include site_config::remove::tapicero
+
+  # Destroy every per-user storage database
+  # where the corresponding user record does not exist.
+  cron { 'cleanup_stale_userdbs':
+    command => '(/bin/date; /srv/leap/couchdb/scripts/cleanup-user-dbs) >> /var/log/leap/couchdb-cleanup.log',
+    user    => 'root',
+    hour    => 4,
+    minute  => 7;
+  }
 
 }
diff --git a/puppet/modules/site_couchdb/manifests/logrotate.pp b/puppet/modules/site_couchdb/manifests/logrotate.pp
index e1039d49..bb8843bb 100644
--- a/puppet/modules/site_couchdb/manifests/logrotate.pp
+++ b/puppet/modules/site_couchdb/manifests/logrotate.pp
@@ -1,12 +1,14 @@
+# configure couchdb logrotation
 class site_couchdb::logrotate {
 
   augeas {
     'logrotate_bigcouch':
       context => '/files/etc/logrotate.d/bigcouch/rule',
-      changes => [ 'set file /opt/bigcouch/var/log/*.log', 'set rotate 7',
-                   'set schedule daily', 'set compress compress',
-                   'set missingok missingok', 'set ifempty notifempty',
-                   'set copytruncate copytruncate' ]
+      changes => [
+        'set file /opt/bigcouch/var/log/*.log', 'set rotate 7',
+        'set schedule daily', 'set compress compress',
+        'set missingok missingok', 'set ifempty notifempty',
+        'set copytruncate copytruncate' ]
   }
 
 }
diff --git a/puppet/modules/site_couchdb/manifests/master.pp b/puppet/modules/site_couchdb/manifests/master.pp
deleted file mode 100644
index c28eee7d..00000000
--- a/puppet/modules/site_couchdb/manifests/master.pp
+++ /dev/null
@@ -1,9 +0,0 @@
-# this class sets up a single, plain couchdb node
-class site_couchdb::master {
-  class { 'couchdb':
-    admin_pw            => $site_couchdb::couchdb_admin_pw,
-    admin_salt          => $site_couchdb::couchdb_admin_salt,
-    chttpd_bind_address => '127.0.0.1',
-    pwhash_alg          => $site_couchdb::couchdb_pwhash_alg
-  }
-}
diff --git a/puppet/modules/site_couchdb/manifests/mirror.pp b/puppet/modules/site_couchdb/manifests/mirror.pp
index abe35c4c..fb82b897 100644
--- a/puppet/modules/site_couchdb/manifests/mirror.pp
+++ b/puppet/modules/site_couchdb/manifests/mirror.pp
@@ -1,3 +1,4 @@
+# configure mirroring of couch nodes
 class site_couchdb::mirror {
 
   Class['site_couchdb::add_users']
@@ -22,55 +23,55 @@ class site_couchdb::mirror {
 
   ### customer database
   couchdb::mirror_db { 'customers':
-    from => $from,
+    from    => $from,
     require => Couchdb::Query::Setup['localhost']
   }
 
   ## identities database
   couchdb::mirror_db { 'identities':
-    from => $from,
+    from    => $from,
     require => Couchdb::Query::Setup['localhost']
   }
 
   ## keycache database
   couchdb::mirror_db { 'keycache':
-    from => $from,
+    from    => $from,
     require => Couchdb::Query::Setup['localhost']
   }
 
   ## sessions database
   couchdb::mirror_db { 'sessions':
-    from => $from,
+    from    => $from,
     require => Couchdb::Query::Setup['localhost']
   }
 
   ## shared database
   couchdb::mirror_db { 'shared':
-    from => $from,
+    from    => $from,
     require => Couchdb::Query::Setup['localhost']
   }
 
   ## tickets database
   couchdb::mirror_db { 'tickets':
-    from => $from,
+    from    => $from,
     require => Couchdb::Query::Setup['localhost']
   }
 
   ## tokens database
   couchdb::mirror_db { 'tokens':
-    from => $from,
+    from    => $from,
     require => Couchdb::Query::Setup['localhost']
   }
 
   ## users database
   couchdb::mirror_db { 'users':
-    from => $from,
+    from    => $from,
     require => Couchdb::Query::Setup['localhost']
   }
 
   ## messages db
   couchdb::mirror_db { 'messages':
-    from => $from,
+    from    => $from,
     require => Couchdb::Query::Setup['localhost']
   }
 
diff --git a/puppet/modules/site_couchdb/manifests/plain.pp b/puppet/modules/site_couchdb/manifests/plain.pp
new file mode 100644
index 00000000..b40fc100
--- /dev/null
+++ b/puppet/modules/site_couchdb/manifests/plain.pp
@@ -0,0 +1,14 @@
+# this class sets up a single, plain couchdb node
+class site_couchdb::plain {
+  class { 'couchdb':
+    admin_pw            => $site_couchdb::couchdb_admin_pw,
+    admin_salt          => $site_couchdb::couchdb_admin_salt,
+    chttpd_bind_address => '127.0.0.1'
+  }
+
+  include site_check_mk::agent::couchdb::plain
+
+  # remove bigcouch leftovers from previous installations
+  include ::site_config::remove::bigcouch
+
+}
diff --git a/puppet/modules/site_couchdb/manifests/setup.pp b/puppet/modules/site_couchdb/manifests/setup.pp
index 69bd1c6a..710d3c1c 100644
--- a/puppet/modules/site_couchdb/manifests/setup.pp
+++ b/puppet/modules/site_couchdb/manifests/setup.pp
@@ -12,27 +12,42 @@ class site_couchdb::setup {
 
   $user = $site_couchdb::couchdb_admin_user
 
-  # /etc/couchdb/couchdb-admin.netrc is deployed by couchdb::query::setup
-  # we symlink to couchdb.netrc for puppet commands.
-  # we symlink this to /root/.netrc for couchdb_scripts (eg. backup)
-  # and makes life easier for the admin (i.e. using curl/wget without
-  # passing credentials)
+  # setup /etc/couchdb/couchdb-admin.netrc for couchdb admin access
+  couchdb::query::setup { 'localhost':
+    user => $user,
+    pw   => $site_couchdb::couchdb_admin_pw
+  }
+
+  # We symlink /etc/couchdb/couchdb-admin.netrc to /etc/couchdb/couchdb.netrc
+  # for puppet commands, and to to /root/.netrc for couchdb_scripts
+  # (eg. backup) and to makes life easier for the admin on the command line
+  # (i.e. using curl/wget without passing credentials)
   file {
     '/etc/couchdb/couchdb.netrc':
       ensure  => link,
       target  => "/etc/couchdb/couchdb-${user}.netrc";
-
     '/root/.netrc':
       ensure  => link,
       target  => '/etc/couchdb/couchdb.netrc';
+  }
 
-    '/srv/leap/couchdb':
-      ensure => directory
+  # setup /etc/couchdb/couchdb-soledad-admin.netrc file for couchdb admin
+  # access, accessible only for the soledad-admin user to create soledad
+  # userdbs
+  if member(hiera('services', []), 'soledad') {
+    file { '/etc/couchdb/couchdb-soledad-admin.netrc':
+      content => "machine localhost login ${user} password ${site_couchdb::couchdb_admin_pw}",
+      mode    => '0400',
+      owner   => 'soledad-admin',
+      group   => 'root',
+      require => [ Package['couchdb'], User['soledad-admin'] ];
+    }
   }
 
-  couchdb::query::setup { 'localhost':
-    user  => $user,
-    pw    => $site_couchdb::couchdb_admin_pw,
+  # Checkout couchdb_scripts repo
+  file {
+    '/srv/leap/couchdb':
+      ensure => directory
   }
 
   vcsrepo { '/srv/leap/couchdb/scripts':
diff --git a/puppet/modules/site_couchdb/manifests/upload_design.pp b/puppet/modules/site_couchdb/manifests/upload_design.pp
index 7b0cabd7..bd73ebf2 100644
--- a/puppet/modules/site_couchdb/manifests/upload_design.pp
+++ b/puppet/modules/site_couchdb/manifests/upload_design.pp
@@ -1,4 +1,5 @@
-define site_couchdb::upload_design($db = $title, $design) {
+# upload a design doc to a db
+define site_couchdb::upload_design($design, $db = $title) {
   $design_name = regsubst($design, '^.*\/(.*)\.json$', '\1')
   $id = "_design/${design_name}"
   $file = "/srv/leap/couchdb/designs/${design}"