summaryrefslogtreecommitdiff
path: root/puppet/modules/site_nickserver/manifests
diff options
context:
space:
mode:
authorelijah <elijah@riseup.net>2013-05-18 17:13:05 -0700
committerelijah <elijah@riseup.net>2013-05-18 17:13:05 -0700
commit450fb19a4df8f4740dcf077b585dbd77c096d133 (patch)
treee0607e377410da51097326b0dd5a40a170d68e0b /puppet/modules/site_nickserver/manifests
parentf82d5b5c7004b01565bbeace598d1716f72c1b2f (diff)
added module site_nickserver
Diffstat (limited to 'puppet/modules/site_nickserver/manifests')
-rw-r--r--puppet/modules/site_nickserver/manifests/init.pp120
1 files changed, 120 insertions, 0 deletions
diff --git a/puppet/modules/site_nickserver/manifests/init.pp b/puppet/modules/site_nickserver/manifests/init.pp
new file mode 100644
index 00000000..4a80d8fd
--- /dev/null
+++ b/puppet/modules/site_nickserver/manifests/init.pp
@@ -0,0 +1,120 @@
+#
+# TODO: currently, this is dependent on the HAProxy stuff that is in site_webapp.
+# it would be good to factor that out into a site_haproxy, so that nickserver could be applied independently.
+#
+
+class site_nickserver {
+ tag 'leap_service'
+ include site_config::ruby
+
+ #
+ # VARIABLES
+ #
+
+ $nickserver = hiera('nickserver')
+ $nickserver_port = $nickserver['port']
+ $couchdb_user = $nickserver['couchdb_user']['username']
+ $couchdb_password = $nickserver['couchdb_user']['password']
+ $couchdb_host = 'localhost' # couchdb is available on localhost via haproxy, which is bound to 4096.
+ $couchdb_port = '4096' # See site_webapp/templates/haproxy_couchdb.cfg.erg
+
+ #
+ # USER AND GROUP
+ #
+
+ group { 'nickserver':
+ ensure => present,
+ allowdupe => false;
+ }
+ user { 'nickserver':
+ ensure => present,
+ allowdupe => false,
+ gid => 'nickserver',
+ groups => 'ssl-cert',
+ home => '/srv/leap/nickserver',
+ require => Group['nickserver'];
+ }
+
+ #
+ # NICKSERVER CODE
+ #
+
+ #file { '/srv/leap/nickserver':
+ # ensure => directory,
+ # owner => 'nickserver',
+ # group => 'nickserver',
+ # require => User['nickserver'];
+ #}
+ vcsrepo { '/srv/leap/nickserver':
+ ensure => present,
+ revision => 'origin/master',
+ provider => git,
+ source => 'git://code.leap.se/nickserver',
+ owner => 'nickserver',
+ group => 'nickserver',
+ require => [ User['nickserver'], Group['nickserver'] ],
+ notify => Exec['nickserver_bundler_update'];
+ }
+ exec { 'nickserver_bundler_update':
+ cwd => '/srv/leap/nickserver',
+ command => '/bin/bash -c "/usr/bin/bundle check || /usr/bin/bundle install --path vendor/bundle"',
+ unless => '/usr/bin/bundle check',
+ user => 'nickserver',
+ timeout => 600,
+ require => [ Class['bundler::install'], Vcsrepo['/srv/leap/nickserver'] ],
+ notify => Service['nickserver'];
+ }
+
+ #
+ # NICKSERVER CONFIG
+ #
+
+ file { '/etc/leap/nickserver.yml':
+ content => template('site_nickserver/nickserver.yml.erb'),
+ owner => nickserver,
+ group => nickserver,
+ mode => '0600',
+ notify => Service['nickserver'];
+ }
+
+ #
+ # NICKSERVER DAEMON
+ #
+
+ file {
+ '/usr/bin/nickserver':
+ ensure => link,
+ target => '/srv/leap/nickserver/bin/nickserver',
+ require => Vcsrepo['/srv/leap/nickserver'];
+ '/etc/init.d/nickserver':
+ owner => root, group => 0, mode => '0755',
+ source => '/srv/leap/nickserver/dist/debian-init-script',
+ require => Vcsrepo['/srv/leap/nickserver'];
+ }
+
+ service { 'nickserver':
+ ensure => running,
+ enable => true,
+ hasrestart => true,
+ hasstatus => true,
+ require => File['/etc/init.d/nickserver'];
+ }
+
+ #
+ # FIREWALL
+ #
+
+ file { '/etc/shorewall/macro.nickserver':
+ content => "PARAM - - tcp $nickserver_port",
+ notify => Service['shorewall'],
+ require => Package['shorewall'];
+ }
+
+ shorewall::rule { 'net2fw-nickserver':
+ source => 'net',
+ destination => '$FW',
+ action => 'nickserver(ACCEPT)',
+ order => 200;
+ }
+
+} \ No newline at end of file