10 files changed, 144 insertions, 18 deletions
diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index e69e4b7b..6b10dc19 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -1,3 +1,4 @@
+# common things to set up on every node
 class site_config::default {
   tag 'leap_base'
 
@@ -29,7 +30,7 @@ class site_config::default {
   # i.e. openstack/aws nodes, vagrant nodes
 
   # fix dhclient from changing resolver information
-   if $::dhcp_enabled == 'true' {
+  if $::dhcp_enabled == 'true' {
     include site_config::dhclient
   }
 
@@ -58,7 +59,9 @@ class site_config::default {
 
   # set up core leap files and directories
   include site_config::files
-  include site_config::remove_files
+
+  # remove leftovers from previous deploys
+  include site_config::remove
 
   if ! member($services, 'mx') {
     include site_postfix::satellite
diff --git a/puppet/modules/site_config/manifests/packages/build_essential.pp b/puppet/modules/site_config/manifests/packages/build_essential.pp
index 7dfb8b03..8f3b2641 100644
--- a/puppet/modules/site_config/manifests/packages/build_essential.pp
+++ b/puppet/modules/site_config/manifests/packages/build_essential.pp
@@ -4,8 +4,8 @@
 class site_config::packages::build_essential {
   if !defined(Package['build-essential']) {
     package {
-      ['build-essential', 'g++', 'g++-4.7', 'gcc', 'gcc-4.6', 'gcc-4.7', 'cpp', 'cpp-4.6', 'cpp-4.7', 'libc6-dev']:
+      ['build-essential', 'cpp']:
         ensure => present
     }
   }
-}
-\ No newline at end of file
+}
diff --git a/puppet/modules/site_config/manifests/remove.pp b/puppet/modules/site_config/manifests/remove.pp
new file mode 100644
index 00000000..b1ad1a2b
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove.pp
@@ -0,0 +1,4 @@
+# remove leftovers from previous deploys
+class site_config::remove {
+  include site_config::remove::files
+}
diff --git a/puppet/modules/site_config/manifests/remove_files.pp b/puppet/modules/site_config/manifests/remove/files.pp
index b339e6af..67171259 100644
--- a/puppet/modules/site_config/manifests/remove_files.pp
+++ b/puppet/modules/site_config/manifests/remove/files.pp
@@ -9,7 +9,13 @@
 # release.
 #
 
-class site_config::remove_files {
+class site_config::remove::files {
+
+  # Platform 0.8 removals
+  tidy {
+    '/etc/default/leap_mx':;
+    '/etc/logrotate.d/leap-mx':;
+  }
 
   #
   # Platform 0.7 removals
@@ -20,21 +26,24 @@ class site_config::remove_files {
     '/etc/rsyslog.d/99-leap-mx.conf':;
     '/etc/rsyslog.d/01-webapp.conf':;
     '/etc/rsyslog.d/50-stunnel.conf':;
-    '/etc/logrotate.d/mx':;
     '/etc/logrotate.d/stunnel':;
     '/var/log/stunnel4/stunnel.log':;
     'leap_mx':
       path => '/var/log/',
       recurse => true,
       matches => 'leap_mx*';
+    # We rotate 5 logs, so we should only have mx.log, mx.log.[1-5], with an
+    # optional .gz suffix. The following will remove any logs that are out
+    # of this range
     'leap_mx_rotate':
       path => '/var/log/leap/',
       recurse => true,
-      matches => [ 'mx.log.[0-9]', 'mx.log.[0-9]?', 'mx.log.[6-9]?gz'];
+      matches => [ 'mx.log.[6-9](.gz)?', 'mx.log.[0-9][0-9]'];
     '/srv/leap/webapp/public/provider.json':;
     '/srv/leap/couchdb/designs/tmp_users':
       recurse => true,
       rmdirs => true;
+    '/etc/leap/soledad-server.conf':;
   }
 
   # leax-mx logged to /var/log/leap_mx.log in the past
@@ -46,5 +55,22 @@ class site_config::remove_files {
       onlyif  => "/bin/grep -qe 'leap_mx.log' /etc/check_mk/logwatch.state"
   }
 
-
+  # Don't use check_mk logwatch to watch bigcouch logs anymore
+  # see https://leap.se/code/issues/7375 for more details
+  file { '/etc/check_mk/logwatch.d/bigcouch.cfg':
+    ensure => absent,
+    notify => [
+      Exec['remove_bigcouch_logwatch_spoolfiles'],
+      Exec['remove_bigcouch_logwatch_stateline']
+    ]
+  }
+  # remove leftover bigcouch logwatch spool files
+  exec { 'remove_bigcouch_logwatch_spoolfiles':
+    command     => 'find /var/lib/check_mk/logwatch -name \'\\opt\\bigcouch\\var\\log\\bigcouch.log\' -exec rm {} \;',
+    refreshonly => true,
+  }
+  exec { 'remove_bigcouch_logwatch_stateline':
+    command     => "sed -i '/bigcouch.log/d' /etc/check_mk/logwatch.state",
+    refreshonly => true,
+  }
 }
diff --git a/puppet/modules/site_config/manifests/remove/monitoring.pp b/puppet/modules/site_config/manifests/remove/monitoring.pp
new file mode 100644
index 00000000..d7095597
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove/monitoring.pp
@@ -0,0 +1,10 @@
+# remove leftovers on monitoring nodes
+class site_config::remove::monitoring {
+
+  tidy {
+    'checkmk_logwatch_spool':
+      path    => '/var/lib/check_mk/logwatch',
+      recurse => true,
+      matches => '*tapicero.log'
+  }
+}
diff --git a/puppet/modules/site_config/manifests/remove/tapicero.pp b/puppet/modules/site_config/manifests/remove/tapicero.pp
new file mode 100644
index 00000000..4ce972d0
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove/tapicero.pp
@@ -0,0 +1,69 @@
+# remove tapicero leftovers from previous deploys on couchdb nodes
+class site_config::remove::tapicero {
+
+  # remove tapicero couchdb user
+  $couchdb_config = hiera('couch')
+  $couchdb_mode   = $couchdb_config['mode']
+
+  if $couchdb_mode == 'multimaster'
+  {
+    $port = 5986
+  } else {
+    $port = 5984
+  }
+
+  exec { 'remove_couchdb_user':
+    onlyif  => "/usr/bin/curl -s 127.0.0.1:${port}/_users/org.couchdb.user:tapicero | grep -qv 'not_found'",
+    command => "/usr/local/bin/couch-doc-update --host 127.0.0.1:${port} --db _users --id org.couchdb.user:tapicero --delete"
+  }
+
+
+  exec { 'kill_tapicero':
+    onlyif  => '/usr/bin/test -s /var/run/tapicero.pid',
+    command => '/usr/bin/pkill --pidfile /var/run/tapicero.pid'
+  }
+
+  user { 'tapicero':
+    ensure  => absent;
+  }
+
+  group { 'tapicero':
+    ensure => absent,
+    require => User['tapicero'];
+  }
+
+  tidy {
+    '/srv/leap/tapicero':
+      recurse => true,
+      require   => [ Exec['kill_tapicero'] ];
+    '/var/lib/leap/tapicero':
+      require   => [ Exec['kill_tapicero'] ];
+    '/var/run/tapicero':
+      require   => [ Exec['kill_tapicero'] ];
+    '/etc/leap/tapicero.yaml':
+      require   => [ Exec['kill_tapicero'] ];
+    '/etc/init.d/tapicero':
+      require   => [ Exec['kill_tapicero'] ];
+    'tapicero_logs':
+      path    => '/var/log/leap',
+      recurse => true,
+      matches => 'tapicero*',
+      require   => [ Exec['kill_tapicero'] ];
+    '/etc/check_mk/logwatch.d/tapicero.cfg':;
+  }
+
+  # remove local nagios plugin checks via mrpe
+  augeas {
+    'Tapicero_Procs':
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => 'rm /files/etc/check_mk/mrpe.cfg/Tapicero_Procs',
+      require => File['/etc/check_mk/mrpe.cfg'];
+    'Tapicero_Heartbeat':
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => 'rm Tapicero_Heartbeat',
+      require => File['/etc/check_mk/mrpe.cfg'];
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/remove/webapp.pp b/puppet/modules/site_config/manifests/remove/webapp.pp
new file mode 100644
index 00000000..58f59815
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove/webapp.pp
@@ -0,0 +1,7 @@
+# remove leftovers on webapp nodes
+class site_config::remove::webapp {
+  tidy {
+    '/etc/apache/sites-enabled/leap_webapp.conf':
+      notify => Service['apache'];
+  }
+}
diff --git a/puppet/modules/site_config/manifests/ruby.pp b/puppet/modules/site_config/manifests/ruby.pp
index 2a720114..5c13233d 100644
--- a/puppet/modules/site_config/manifests/ruby.pp
+++ b/puppet/modules/site_config/manifests/ruby.pp
@@ -1,14 +1,8 @@
+# install ruby, rubygems and bundler
+# configure ruby settings common to all servers
 class site_config::ruby {
   Class[Ruby] -> Class[rubygems] -> Class[bundler::install]
-  class { '::ruby': ruby_version => '1.9.3' }
+  class { '::ruby': }
   class { 'bundler::install': install_method => 'package' }
   include rubygems
 }
-
-
-#
-# Ruby settings common to all servers
-#
-# Why this way? So that other classes can do 'include site_ruby' without creating redeclaration errors.
-# See https://puppetlabs.com/blog/modeling-class-composition-with-parameterized-classes/
-#
diff --git a/puppet/modules/site_config/manifests/ruby/dev.pp b/puppet/modules/site_config/manifests/ruby/dev.pp
index 3ea6ca96..e6eb2f8a 100644
--- a/puppet/modules/site_config/manifests/ruby/dev.pp
+++ b/puppet/modules/site_config/manifests/ruby/dev.pp
@@ -1,6 +1,6 @@
+# install ruby dev packages needed for building some gems
 class site_config::ruby::dev inherits site_config::ruby {
   Class['::ruby'] {
-    ruby_version => '1.9.3',
     install_dev  => true
   }
   # building gems locally probably requires build-essential and gcc:
diff --git a/puppet/modules/site_config/manifests/x509/dkim/key.pp b/puppet/modules/site_config/manifests/x509/dkim/key.pp
new file mode 100644
index 00000000..c63a7e94
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/dkim/key.pp
@@ -0,0 +1,13 @@
+class site_config::x509::dkim::key {
+
+  ##
+  ## This is for the DKIM key that is used exclusively for DKIM
+  ## signing
+
+  $x509 = hiera('x509')
+  $key  = $x509['dkim_key']
+
+  x509::key { 'dkim':
+    content => $key
+  }
+}