From 1071c3622469b7b02dd3b772070db540b6842dfb Mon Sep 17 00:00:00 2001
From: Christoph Kluenter <ckluente@thoughtworks.com>
Date: Mon, 29 Sep 2014 13:53:39 +0200
Subject: new fact to check if dhcp is used;

from https://github.com/gds-operations/puppet-resolvconf/blob/master/lib/facter/dhcp_enabled.rb
---
 .../modules/site_config/lib/facter/dhcp_enabled.rb | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 puppet/modules/site_config/lib/facter/dhcp_enabled.rb

diff --git a/puppet/modules/site_config/lib/facter/dhcp_enabled.rb b/puppet/modules/site_config/lib/facter/dhcp_enabled.rb
new file mode 100644
index 00000000..33220da3
--- /dev/null
+++ b/puppet/modules/site_config/lib/facter/dhcp_enabled.rb
@@ -0,0 +1,22 @@
+require 'facter'
+def dhcp_enabled?(ifs, recurse=true)
+  dhcp = false
+  included_ifs = []
+  if FileTest.exists?(ifs)
+    File.open(ifs) do |file|
+      dhcp = file.enum_for(:each_line).any? do |line|
+        if recurse && line =~ /^\s*source\s+([^\s]+)/
+          included_ifs += Dir.glob($1)
+        end
+        line =~ /inet\s+dhcp/
+      end
+    end
+  end
+  dhcp || included_ifs.any? { |ifs| dhcp_enabled?(ifs, false) }
+end
+Facter.add(:dhcp_enabled) do
+  confine :osfamily => 'Debian'
+  setcode do
+    dhcp_enabled?('/etc/network/interfaces')
+  end
+end
-- 
cgit v1.2.3


From 63ca770b6913d674db639c486a8ba215ea0b7a65 Mon Sep 17 00:00:00 2001
From: Christoph Kluenter <ckluente@thoughtworks.com>
Date: Mon, 29 Sep 2014 13:57:30 +0200
Subject: configure dhclient if its used in /e/network/interfaces

we don't dhclient to to set domain and search in /etc/reslov.conf
bigcouch has a strange way to find its hostname. It uses the domain
stanza in /etc/resolv.conf to find its domain
---
 puppet/modules/site_config/manifests/default.pp | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index fc2179de..42359a00 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -25,10 +25,7 @@ class site_config::default {
   # i.e. openstack/aws nodes, vagrant nodes
 
   # fix dhclient from changing resolver information
-  if $::ec2_instance_id {
-    include site_config::dhclient
-  }
-  if $::virtual == 'virtualbox' {
+   if $::dhcp_enabled == 'true' {
     include site_config::dhclient
   }
 
-- 
cgit v1.2.3


From 664dca31dec0c7935ee96359209d9dcefc03e38c Mon Sep 17 00:00:00 2001
From: Christoph Kluenter <ckluente@thoughtworks.com>
Date: Mon, 29 Sep 2014 14:31:54 +0200
Subject: ensure dhclicent and resolv.conf are configured before bigcouch

---
 puppet/modules/site_config/manifests/dhclient.pp  | 4 +++-
 puppet/modules/site_couchdb/manifests/bigcouch.pp | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/puppet/modules/site_config/manifests/dhclient.pp b/puppet/modules/site_config/manifests/dhclient.pp
index 7ac0caf3..dbe2ef1c 100644
--- a/puppet/modules/site_config/manifests/dhclient.pp
+++ b/puppet/modules/site_config/manifests/dhclient.pp
@@ -17,7 +17,9 @@ class site_config::dhclient {
 
   exec { 'reload_dhclient':
     refreshonly => true,
-    command     => '/usr/local/sbin/reload_dhclient';
+    command     => '/usr/local/sbin/reload_dhclient',
+    before      => Class['site_config::resolvconf'],
+    require     => File['/usr/local/sbin/reload_dhclient'],
   }
 
   file { '/etc/dhcp/dhclient-enter-hooks.d/disable_resolvconf':
diff --git a/puppet/modules/site_couchdb/manifests/bigcouch.pp b/puppet/modules/site_couchdb/manifests/bigcouch.pp
index f0aab734..d3352000 100644
--- a/puppet/modules/site_couchdb/manifests/bigcouch.pp
+++ b/puppet/modules/site_couchdb/manifests/bigcouch.pp
@@ -17,6 +17,7 @@ class site_couchdb::bigcouch {
   # stunnel must running correctly before bigcouch dbs can be set up.
   #
   Class['site_config::default']
+    -> Class['site_config::resolvconf']
     -> Class['couchdb::bigcouch::package::cloudant']
     -> Service['shorewall']
     -> Service['stunnel']
-- 
cgit v1.2.3


From 7d1f286e571af299fa88881393876dc6fb494256 Mon Sep 17 00:00:00 2001
From: guido <guido@bruo.org>
Date: Mon, 22 Dec 2014 10:52:38 -0300
Subject: Adds a ssl_common.inc file to use inside vhosts for the SSL config
 (solves #5103)

Change-Id: I717bf7ca2c5679165a99370c4540f8b8dc1a48ea
---
 puppet/modules/site_apache/files/include.d/ssl_common.inc     | 7 +++++++
 puppet/modules/site_apache/manifests/common.pp                | 1 +
 puppet/modules/site_apache/templates/vhosts.d/api.conf.erb    | 8 +-------
 puppet/modules/site_apache/templates/vhosts.d/common.conf.erb | 8 +-------
 4 files changed, 10 insertions(+), 14 deletions(-)
 create mode 100644 puppet/modules/site_apache/files/include.d/ssl_common.inc

diff --git a/puppet/modules/site_apache/files/include.d/ssl_common.inc b/puppet/modules/site_apache/files/include.d/ssl_common.inc
new file mode 100644
index 00000000..08b993cc
--- /dev/null
+++ b/puppet/modules/site_apache/files/include.d/ssl_common.inc
@@ -0,0 +1,7 @@
+SSLEngine on
+SSLProtocol all -SSLv2 -SSLv3
+SSLHonorCipherOrder on
+SSLCompression off
+SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
+
+RequestHeader set X_FORWARDED_PROTO 'https'
\ No newline at end of file
diff --git a/puppet/modules/site_apache/manifests/common.pp b/puppet/modules/site_apache/manifests/common.pp
index 72f24838..2b83ffa5 100644
--- a/puppet/modules/site_apache/manifests/common.pp
+++ b/puppet/modules/site_apache/manifests/common.pp
@@ -23,4 +23,5 @@ class site_apache::common {
       content => template('site_apache/vhosts.d/common.conf.erb')
   }
 
+  apache::config::include{ 'ssl_common.inc': }
 }
diff --git a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
index e4732289..0396f54b 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
@@ -11,18 +11,12 @@ Listen 0.0.0.0:<%= api_port %>
   ServerName <%= api_domain %>
   CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log common
 
-  SSLEngine on
-  SSLProtocol all -SSLv2 -SSLv3
-  SSLHonorCipherOrder on
-  SSLCompression off
-  SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
-
   SSLCACertificatePath /etc/ssl/certs
   SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::ca_name') %>.crt
   SSLCertificateKeyFile <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key
   SSLCertificateFile <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt
 
-  RequestHeader set X_FORWARDED_PROTO 'https'
+  Include include.d/ssl_common.inc
 
   <IfModule mod_headers.c>
 <% if @webapp['secure'] -%>
diff --git a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
index a9733a97..a5f1fc51 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
@@ -12,18 +12,12 @@
   ServerAlias www.<%= domain %>
   CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log common
 
-  SSLEngine on
-  SSLProtocol all -SSLv2 -SSLv3
-  SSLHonorCipherOrder on
-  SSLCompression off
-  SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
-
   SSLCACertificatePath /etc/ssl/certs
   SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::commercial_ca_name') %>.crt
   SSLCertificateKeyFile <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::commercial_cert_name') %>.key
   SSLCertificateFile <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::commercial_cert_name') %>.crt
 
-  RequestHeader set X_FORWARDED_PROTO 'https'
+  Include include.d/ssl_common.inc
 
   <IfModule mod_headers.c>
 <% if (defined? @services) and (@services.include? 'webapp') and (@webapp['secure']) -%>
-- 
cgit v1.2.3


From ed5793260ecacadcef53e534f71cc8aa2015b07a Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Mon, 5 Jan 2015 10:58:25 +0100
Subject: updated link to quickstart tutorial

Change-Id: Ib0cefe0e755c5034b175408df698990db174f9d9
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index ca6f64ba..c3770de6 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ The LEAP Platform is set of complementary packages and server recipes to automat
 Getting started
 =============================
 
-It is highly recommended that you start by reading the overview of the [LEAP Platform](https://leap.se/docs/platform) and then begin with the [Quick Start guide](https://leap.se/docs/platform/quick-start) to walk through a test environment setup to get familiar with how things work before deploying to live servers.
+It is highly recommended that you start by reading the overview of the [LEAP Platform](https://leap.se/docs/platform) and then begin with the [Quick Start tutorial](https://leap.se/en/docs/platform/tutorials/quick-start) to walk through a test environment setup to get familiar with how things work before deploying to live servers.
 
 An offline copy of this documentation is contained in the `doc` subdirectory. For more current updates to the documentation, visit the website.
 
-- 
cgit v1.2.3


From bd098f1691307685958d4a07caba9812c025e163 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Mon, 5 Jan 2015 17:03:20 -0800
Subject: vpn: each openvpn process needs a unique status file name. closes
 #6608

---
 puppet/modules/site_openvpn/manifests/server_config.pp | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/puppet/modules/site_openvpn/manifests/server_config.pp b/puppet/modules/site_openvpn/manifests/server_config.pp
index 466f6d00..221c79a7 100644
--- a/puppet/modules/site_openvpn/manifests/server_config.pp
+++ b/puppet/modules/site_openvpn/manifests/server_config.pp
@@ -57,6 +57,8 @@ define site_openvpn::server_config(
   $management, $config, $tls_remote = undef) {
 
   $openvpn_configname = $name
+  $shortname = regsubst(regsubst($name, '_config', ''), '_', '-')
+  $openvpn_status_filename = "/var/run/openvpn-status-${shortname}"
 
   concat {
     "/etc/openvpn/${openvpn_configname}.conf":
@@ -187,7 +189,7 @@ define site_openvpn::server_config(
       server => $openvpn_configname;
     "status ${openvpn_configname}":
       key    => 'status',
-      value  => '/var/run/openvpn-status 10',
+      value  => "${openvpn_status_filename} 10",
       server => $openvpn_configname;
     "status-version ${openvpn_configname}":
       key    => 'status-version',
-- 
cgit v1.2.3


From 53b87cc2b283df665a46a5781974f9ffd047c72c Mon Sep 17 00:00:00 2001
From: guido <guido@bruo.org>
Date: Mon, 12 Jan 2015 12:43:35 -0300
Subject: Adds apache support for webapp.domain if defined. Fixes #6632

Change-Id: If63aac60e44c4a68f030f93e20e8dc071f9df610
---
 puppet/modules/site_apache/templates/vhosts.d/common.conf.erb | 4 +++-
 puppet/modules/site_webapp/manifests/apache.pp                | 3 +++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
index a5f1fc51..87c40005 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
@@ -7,7 +7,9 @@
 </VirtualHost>
 
 <VirtualHost *:443>
-  ServerName <%= domain_name %>
+
+  ServerName <%= webapp_domain %>
+  ServerAlias <%= domain_name %>
   ServerAlias <%= domain %>
   ServerAlias www.<%= domain %>
   CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log common
diff --git a/puppet/modules/site_webapp/manifests/apache.pp b/puppet/modules/site_webapp/manifests/apache.pp
index 21243d34..93e172a0 100644
--- a/puppet/modules/site_webapp/manifests/apache.pp
+++ b/puppet/modules/site_webapp/manifests/apache.pp
@@ -7,6 +7,9 @@ class site_webapp::apache {
   $web_domain       = hiera('domain')
   $domain_name      = $web_domain['name']
 
+  $webapp           = hiera('webapp')
+  $webapp_domain    = $webapp['domain']
+
   include site_apache::common
   include site_apache::module::headers
   include site_apache::module::alias
-- 
cgit v1.2.3


From b503fc864c8152f4e76d284a6ef89eddec59028b Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 1 Jan 2015 10:38:00 +0100
Subject: Simplyfied Vagrant support, added offlineimap config file

Change-Id: I4bdb6cfe34d4c0edbf31d425d7f682c137ae1596
---
 .gitignore                        |  2 +-
 Vagrantfile                       | 27 +++++++++++++
 vagrant/configure-leap.sh         | 83 +++++++++++++++++++++++++++++++++++++++
 vagrant/install-platform.pp       | 19 +++++++++
 vagrant/offlineimaprc.example.org | 24 +++++++++++
 vagrant/vagrant.config            | 12 ++++++
 6 files changed, 166 insertions(+), 1 deletion(-)
 create mode 100644 Vagrantfile
 create mode 100755 vagrant/configure-leap.sh
 create mode 100755 vagrant/install-platform.pp
 create mode 100644 vagrant/offlineimaprc.example.org
 create mode 100644 vagrant/vagrant.config

diff --git a/.gitignore b/.gitignore
index eda5e35f..30792935 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,2 @@
-.reviewboardrc
+/.vagrant
 /puppet/modules/site_custom
diff --git a/Vagrantfile b/Vagrantfile
new file mode 100644
index 00000000..4a91c459
--- /dev/null
+++ b/Vagrantfile
@@ -0,0 +1,27 @@
+Vagrant.configure("2") do |config|
+  config.vm.define :node1 do |config|
+
+    # Please verify the sha512 sum of the downloaded box before importing it into vagrant !
+    # see https://leap.se/en/docs/platform/details/development#Verify.vagrantbox.download
+    # for details
+
+    config.vm.box = "leap-wheezy"
+    config.vm.box_url = "https://downloads.leap.se/platform/vagrant/virtualbox/leap-wheezy.box"
+    #config.vm.network :private_network, ip: "10.5.5.102"
+    config.vm.provider "virtualbox" do |v|
+      v.customize ["modifyvm", :id, "--natdnshostresolver1", "on"]
+      v.name = "node1"
+    end
+
+    config.vm.provision "puppet" do |puppet|
+      puppet.manifests_path = "./vagrant"
+      puppet.module_path = "./puppet/modules" 
+      puppet.manifest_file = "install-platform.pp"
+      puppet.options = "--verbose"
+    end
+    config.vm.provision "shell", path: "vagrant/configure-leap.sh"
+
+    config.ssh.username = "vagrant"
+
+  end
+end
diff --git a/vagrant/configure-leap.sh b/vagrant/configure-leap.sh
new file mode 100755
index 00000000..9541e194
--- /dev/null
+++ b/vagrant/configure-leap.sh
@@ -0,0 +1,83 @@
+#!/bin/bash
+
+
+. /vagrant/vagrant/vagrant.config 
+
+#OPTS='--no-color'
+OPTS=''
+PROVIDERDIR='/srv/leap/configuration'
+NODE='node1'
+LEAP='/usr/local/bin/leap'
+
+echo '==============================================='
+echo 'configuring leap'
+echo '==============================================='
+
+# purge $PROVIDERDIR so this script can be run multiple times
+[ -e $PROVIDERDIR ] && rm -rf $PROVIDERDIR
+mkdir $PROVIDERDIR
+cd $PROVIDERDIR
+
+$LEAP $OPTS new --contacts "$contacts" --domain "$provider_domain" --name "$provider_name" --platform=/vagrant .
+echo -e '\n@log = "/var/log/leap/deploy.log"' >> Leapfile
+
+if [ ! -e /root/.ssh/id_rsa ]; then
+  ssh-keygen -f /root/.ssh/id_rsa -P ''
+  cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
+fi
+
+mkdir -p $PROVIDERDIR/files/nodes/$NODE
+sh -c "cat /etc/ssh/ssh_host_rsa_key.pub | cut -d' ' -f1,2 >> $PROVIDERDIR/files/nodes/$NODE/${NODE}_ssh.pub"
+
+$LEAP $OPTS add-user --self
+$LEAP $OPTS cert ca
+$LEAP $OPTS cert csr
+$LEAP $OPTS node add $NODE ip_address:"$(facter ipaddress)"  services:"$services" tags:production
+echo '{ "webapp": { "admins": ["testadmin"] } }' > services/webapp.json
+
+$LEAP $OPTS compile
+
+git init
+git add .
+git commit -m'configured provider'
+
+$LEAP $OPTS node init $NODE 
+if [ $? -eq 1 ]; then
+  echo 'node init failed'
+  exit 1
+fi
+
+$LEAP $OPTS -v 2 deploy
+if [ $? -eq 1 ]; then
+  echo 'deploy failed'
+  exit 1
+fi
+
+set +e
+git add .
+git commit -m'initialized and deployed provider'
+set -e
+
+echo '==============================================='
+echo 'testing the platform'
+echo '==============================================='
+
+$LEAP $OPTS -v 2 test --continue
+
+echo '==============================================='
+echo 'setting node to demo-mode'
+echo '==============================================='
+postconf -e default_transport='error: in demo mode'
+
+sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_config
+/etc/init.d/ssh reload
+
+# add users: testadmin and testuser with passwords "hallo123"
+curl -s -k https://localhost/1/users.json -d "user%5Blogin%5D=testuser&user%5Bpassword_salt%5D=7d4880237a038e0e&user%5Bpassword_verifier%5D=b98dc393afcd16e5a40fb57ce9cddfa6a978b84be326196627c111d426cada898cdaf3a6427e98b27daf4b0ed61d278bc856515aeceb2312e50c8f816659fcaa4460d839a1e2d7ffb867d32ac869962061368141c7571a53443d58dc84ca1fca34776894414c1090a93e296db6cef12c2cc3f7a991b05d49728ed358fd868286"
+curl -s -k https://localhost/1/users.json -d "user%5Blogin%5D=testadmin&user%5Bpassword_salt%5D=ece1c457014d8282&user%5Bpassword_verifier%5D=9654d93ab409edf4ff1543d07e08f321107c3fd00de05c646c637866a94f28b3eb263ea9129dacebb7291b3374cc6f0bf88eb3d231eb3a76eed330a0e8fd2a5c477ed2693694efc1cc23ae83c2ae351a21139701983dd595b6c3225a1bebd2a4e6122f83df87606f1a41152d9890e5a11ac3749b3bfcf4407fc83ef60b4ced68"
+
+echo -e '\n\n\n'
+echo 'You are now ready to use your provider. Please update your /etc/hosts with following dns overrides:'
+
+$LEAP list --print ip_address,domain.full,dns.aliases | sed 's/,//g' | cut -d' ' -f 2-
+
diff --git a/vagrant/install-platform.pp b/vagrant/install-platform.pp
new file mode 100755
index 00000000..012a0eb0
--- /dev/null
+++ b/vagrant/install-platform.pp
@@ -0,0 +1,19 @@
+class {'apt': }
+File['/etc/apt/preferences'] ->
+  Exec['refresh_apt'] ->
+    Package <| ( title != 'lsb' ) |>
+
+package { [ 'rsync', 'ruby-hiera-puppet', 'git', 'ruby1.9.1-dev', 'rake', 'jq' ]:
+  ensure => installed
+}
+
+package { 'leap_cli':
+  ensure   => latest,
+  provider => 'gem',
+  require  => Package['ruby1.9.1-dev']
+}
+
+file { [ '/srv/leap', '/srv/leap/configuration', '/var/log/leap' ]:
+  ensure => directory
+}
+
diff --git a/vagrant/offlineimaprc.example.org b/vagrant/offlineimaprc.example.org
new file mode 100644
index 00000000..3d119634
--- /dev/null
+++ b/vagrant/offlineimaprc.example.org
@@ -0,0 +1,24 @@
+# WARNING: Use offlineimap *only* for testing/debugging, 
+# because it will save the mails *decrypted* locally to 
+# your disk !
+
+[general]
+accounts = testuser@example.org
+
+[Account testuser@example.org]
+localrepository = testuser@example.org_local
+remoterepository = testuser@example.org_remote
+
+[Repository testuser@example.org_local]
+type = Maildir
+localfolders = /tmp/offlineimap.testuser@example.org
+
+[Repository testuser@example.org_remote]
+type = IMAP
+remotehost = localhost
+remoteuser = testuser@example.org
+remoteport = 1984
+ssl = no
+remotepass = every_pw_works_here 
+
+
diff --git a/vagrant/vagrant.config b/vagrant/vagrant.config
new file mode 100644
index 00000000..ae124246
--- /dev/null
+++ b/vagrant/vagrant.config
@@ -0,0 +1,12 @@
+# config values used by configure-leap.sh
+provider_domain='example.org'
+provider_name='Leap Example Provider'
+contacts="no-reply@$provider_domain"
+
+# serivces that get configured
+# note that the "openvpn" service does currently *not* work
+# in a vagrant setup,
+# see https://leap.se/en/docs/platform/troubleshooting/known-issues#Special.Environments
+services='webapp,mx,couchdb,soledad,monitor'
+
+
-- 
cgit v1.2.3


From 280d1656978291d1fd9cab6280af64677973a4fb Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 13 Jan 2015 22:26:13 +0100
Subject: don't remove fontconfig-config package cause pnp4nagios depends on it
 (#6615)

Change-Id: If6c0d88e83b52588ee908edfa81451d37794a4b4
---
 puppet/modules/site_config/manifests/packages/base.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/site_config/manifests/packages/base.pp b/puppet/modules/site_config/manifests/packages/base.pp
index ae47963c..f20d04a4 100644
--- a/puppet/modules/site_config/manifests/packages/base.pp
+++ b/puppet/modules/site_config/manifests/packages/base.pp
@@ -7,7 +7,7 @@ class site_config::packages::base {
   }
 
   # base set of packages that we want to remove everywhere
-  package { [ 'acpi', 'acpid', 'acpi-support-base',  'eject', 'ftp', 'fontconfig-config',
+  package { [ 'acpi', 'acpid', 'acpi-support-base',  'eject', 'ftp',
               'laptop-detect', 'lpr', 'nfs-common', 'nfs-kernel-server',
               'portmap', 'pppconfig', 'pppoe', 'pump', 'qstat', 'rpcbind',
               'samba-common', 'samba-common-bin', 'smbclient', 'tcl8.5',
-- 
cgit v1.2.3


From f683cb19ead4ce0fadd047b78ce596ae2e9fab2f Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 13 Jan 2015 22:26:29 +0100
Subject: added pnp4nagios graphing support (#1539)

Change-Id: I5c7bcfe2e6dca2276c03bd4985b0fb1e4852a9df
---
 puppet/modules/site_nagios/files/configs/Debian/nagios.cfg | 11 +++++++++++
 puppet/modules/site_nagios/manifests/server.pp             |  3 ++-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/puppet/modules/site_nagios/files/configs/Debian/nagios.cfg b/puppet/modules/site_nagios/files/configs/Debian/nagios.cfg
index e46ebf62..0d729b8c 100644
--- a/puppet/modules/site_nagios/files/configs/Debian/nagios.cfg
+++ b/puppet/modules/site_nagios/files/configs/Debian/nagios.cfg
@@ -1273,4 +1273,15 @@ debug_file=/var/lib/nagios3/nagios.debug
 
 max_debug_file_size=1000000
 
+process_performance_data=1
+service_perfdata_file=/var/lib/nagios3/service-perfdata
+service_perfdata_file_template=DATATYPE::SERVICEPERFDATA\tTIMET::$TIMET$\tHOSTNAME::$HOSTNAME$\tSERVICEDESC::$SERVICEDESC$\tSERVICEPERFDATA::$SERVICEPERFDATA$\tSERVICECHECKCOMMAND::$SERVICECHECKCOMMAND$\tHOSTSTATE::$HOSTSTATE$\tHOSTSTATETYPE::$HOSTSTATETYPE$\tSERVICESTATE::$SERVICESTATE$\tSERVICESTATETYPE::$SERVICESTATETYPE$
+service_perfdata_file_mode=a
+service_perfdata_file_processing_interval=15
+service_perfdata_file_processing_command=process-service-perfdata-file-pnp4nagios-bulk-npcd
+host_perfdata_file=/var/lib/nagios3/host-perfdata
+host_perfdata_file_template=DATATYPE::HOSTPERFDATA\tTIMET::$TIMET$\tHOSTNAME::$HOSTNAME$\tHOSTPERFDATA::$HOSTPERFDATA$\tHOSTCHECKCOMMAND::$HOSTCHECKCOMMAND$\tHOSTSTATE::$HOSTSTATE$\tHOSTSTATETYPE::$HOSTSTATETYPE$
+host_perfdata_file_mode=a
+host_perfdata_file_processing_interval=15
+host_perfdata_file_processing_command=process-host-perfdata-file-pnp4nagios-bulk-npcd
 
diff --git a/puppet/modules/site_nagios/manifests/server.pp b/puppet/modules/site_nagios/manifests/server.pp
index 092ca503..ae266c36 100644
--- a/puppet/modules/site_nagios/manifests/server.pp
+++ b/puppet/modules/site_nagios/manifests/server.pp
@@ -13,7 +13,8 @@ class site_nagios::server inherits nagios::base {
   include nagios::defaults::commands
   include nagios::defaults::templates
   include nagios::defaults::timeperiods
-  include nagios::defaults::plugins
+  include nagios::pnp4nagios
+  include nagios::pnp4nagios::popup
 
   class { 'nagios':
     # don't manage apache class from nagios, cause we already include
-- 
cgit v1.2.3


From 663fe4574674bdeaf2e8c749e7e46d3fe1e6c2e4 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 13 Jan 2015 10:23:48 -0500
Subject: Configure rsyslog to put leap-mx logs into /var/log/leap/mx.log, and
 setup logrotation (#6637)

Change-Id: I873517b2d99f5b55289728969b49d5405da7d4c6
---
 puppet/modules/leap_mx/manifests/init.pp   |  3 ++-
 puppet/modules/leap_mx/manifests/syslog.pp | 17 +++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)
 create mode 100644 puppet/modules/leap_mx/manifests/syslog.pp

diff --git a/puppet/modules/leap_mx/manifests/init.pp b/puppet/modules/leap_mx/manifests/init.pp
index c90fc231..c2cc96c6 100644
--- a/puppet/modules/leap_mx/manifests/init.pp
+++ b/puppet/modules/leap_mx/manifests/init.pp
@@ -9,7 +9,8 @@ class leap_mx {
 
   include soledad::common
   include site_apt::preferences::twisted
-
+  include leap_mx::syslog
+  
   #
   # USER AND GROUP
   #
diff --git a/puppet/modules/leap_mx/manifests/syslog.pp b/puppet/modules/leap_mx/manifests/syslog.pp
new file mode 100644
index 00000000..0247a392
--- /dev/null
+++ b/puppet/modules/leap_mx/manifests/syslog.pp
@@ -0,0 +1,17 @@
+class leap_mx::syslog {
+
+  rsyslog::snippet { '99-leap-mx':
+    content => 'if $programname startswith \'leap-mx\' then /var/log/leap/mx.log
+&~'
+  }
+
+  augeas {
+    'logrotate_leap-mx':
+      context => '/files/etc/logrotate.d/leap-mx/rule',
+      changes => [ 'set file /var/log/leap/mx*.log', 'set rotate 7',
+                   'set schedule daily', 'set compress compress',
+                   'set missingok missingok', 'set ifempty notifempty',
+                   'set copytruncate copytruncate' ]
+  }
+
+}
-- 
cgit v1.2.3


From 4802464729299be48757e7d793da8f85dfdc09bd Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 13 Jan 2015 17:53:25 -0500
Subject: update couchdb submodule to get fix for #6287

Change-Id: I2ad21d93580d2ba373cde7c4de4d32bd281e06ca
---
 puppet/modules/couchdb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/couchdb b/puppet/modules/couchdb
index 4c0d5673..0fbe82d1 160000
--- a/puppet/modules/couchdb
+++ b/puppet/modules/couchdb
@@ -1 +1 @@
-Subproject commit 4c0d5673df02fe42e1bbadfee7d4ea1ca1f88e98
+Subproject commit 0fbe82d154d5dc7e4e56251bfdaf3b06563ee3e6
-- 
cgit v1.2.3


From 0d46876a37334e71634eeaa77546d3fa5d1fde55 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 14 Jan 2015 13:27:45 -0800
Subject: static site service: pin amber gem to 0.3.4

---
 puppet/modules/site_static/manifests/init.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/site_static/manifests/init.pp b/puppet/modules/site_static/manifests/init.pp
index aed9775e..ce79c00f 100644
--- a/puppet/modules/site_static/manifests/init.pp
+++ b/puppet/modules/site_static/manifests/init.pp
@@ -44,7 +44,7 @@ class site_static {
 
   if (member($formats, 'amber')) {
     include site_config::ruby::dev
-    rubygems::gem{'amber-0.3.0': }
+    rubygems::gem{'amber-0.3.4': }
   }
 
   create_resources(site_static::domain, $domains)
-- 
cgit v1.2.3


From b2a59dc0d8d28b14450bfef9d109331e04d6c2cf Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Wed, 21 Jan 2015 15:10:36 -0500
Subject: Provide a base-level set of quality entropy by installing haveged on
 systems by default (#6664)

Change-Id: Ic2d4416b7c55f00f01d4b2ade78339d653bc8993
---
 puppet/modules/haveged/manifests/init.pp                | 17 +++++++++++++++++
 puppet/modules/site_check_mk/manifests/agent/haveged.pp |  9 +++++++++
 puppet/modules/site_config/manifests/default.pp         |  3 +++
 3 files changed, 29 insertions(+)
 create mode 100644 puppet/modules/haveged/manifests/init.pp
 create mode 100644 puppet/modules/site_check_mk/manifests/agent/haveged.pp

diff --git a/puppet/modules/haveged/manifests/init.pp b/puppet/modules/haveged/manifests/init.pp
new file mode 100644
index 00000000..6d6a3569
--- /dev/null
+++ b/puppet/modules/haveged/manifests/init.pp
@@ -0,0 +1,17 @@
+class haveged {
+
+  package { 'haveged':
+    ensure => present,
+  }
+
+  service { 'haveged':
+    ensure     => running,
+    hasrestart => true,
+    hasstatus  => true,
+    enable     => true,
+    require    => Package['haveged'],
+    subscribe  => File['/etc/default/haveged'];
+  }
+
+  include site_check_mk::agent::haveged
+}
diff --git a/puppet/modules/site_check_mk/manifests/agent/haveged.pp b/puppet/modules/site_check_mk/manifests/agent/haveged.pp
new file mode 100644
index 00000000..92e77faa
--- /dev/null
+++ b/puppet/modules/site_check_mk/manifests/agent/haveged.pp
@@ -0,0 +1,9 @@
+class site_check_mk::agent::haveged {
+
+# check haveged process
+  file_line {
+    'haveged_proc':
+      line => 'haveged_proc  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /usr/sbin/haveged',
+      path => '/etc/check_mk/mrpe.cfg';
+  }
+}
diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index a20ffc3b..138efc97 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -38,6 +38,9 @@ class site_config::default {
   # install/configure syslog
   include site_config::syslog
 
+  # provide a basic level of quality entropy
+  include haveged
+
   # install/remove base packages
   include site_config::packages::base
 
-- 
cgit v1.2.3


From 19567504f45a1041a088a8b91e1eb323583661f5 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 22 Jan 2015 14:11:15 -0800
Subject: added support for custom tests in files/tests

---
 bin/run_tests | 40 +++++++++++++++++++++++++++-------------
 platform.rb   |  4 +++-
 2 files changed, 30 insertions(+), 14 deletions(-)

diff --git a/bin/run_tests b/bin/run_tests
index 44384379..8eab5286 100755
--- a/bin/run_tests
+++ b/bin/run_tests
@@ -16,7 +16,7 @@ require 'yaml'
 require 'tsort'
 
 ##
-## EXIT CODES
+## CONSTANTS
 ##
 
 EXIT_CODES = {
@@ -26,6 +26,20 @@ EXIT_CODES = {
   :error => 3
 }
 
+HIERA_FILE   = '/etc/leap/hiera.yaml'
+HELPER_PATHS = [
+  '../../tests/helpers/*.rb',
+  '/srv/leap/files/tests/helpers/*.rb'
+]
+TEST_PATHS   = [
+  '../../tests/white-box/*.rb',
+  '/srv/leap/files/tests/white-box/*.rb'
+]
+
+##
+## UTILITY
+##
+
 def bail(code, msg=nil)
   puts msg if msg
   if code.is_a? Symbol
@@ -35,10 +49,6 @@ def bail(code, msg=nil)
   end
 end
 
-##
-## UTILITY
-##
-
 def service?(service)
   $node["services"].include?(service.to_s)
 end
@@ -417,21 +427,25 @@ end
 
 def main
   # load node data from hiera file
-  if File.exists?('/etc/leap/hiera.yaml')
-    $node = YAML.load_file('/etc/leap/hiera.yaml')
+  if File.exists?(HIERA_FILE)
+    $node = YAML.load_file(HIERA_FILE)
   else
     $node = {"services" => [], "dummy" => true}
   end
 
   # load all test classes
   this_file = File.symlink?(__FILE__) ? File.readlink(__FILE__) : __FILE__
-  Dir[File.expand_path('../../tests/helpers/*.rb', this_file)].each do |helper|
-    require helper
+  HELPER_PATHS.each do |path|
+    Dir[File.expand_path(path, this_file)].each do |helper|
+      require helper
+    end
   end
-  Dir[File.expand_path('../../tests/white-box/*.rb', this_file)].each do |test_file|
-    begin
-      require test_file
-    rescue SkipTest
+  TEST_PATHS.each do |path|
+    Dir[File.expand_path(path, this_file)].each do |test_file|
+      begin
+        require test_file
+      rescue SkipTest
+      end
     end
   end
 
diff --git a/platform.rb b/platform.rb
index c37b6d29..26b17465 100644
--- a/platform.rb
+++ b/platform.rb
@@ -52,10 +52,12 @@ Leap::Platform.define do
     :soledad_service_json_template => 'files/service-definitions/#{arg}/soledad-service.json.erb',
     :smtp_service_json_template    => 'files/service-definitions/#{arg}/smtp-service.json.erb',
 
-    # custom puppet
+    # custom files
     :custom_puppet_dir => 'files/puppet',
     :custom_puppet_modules_dir => 'files/puppet/modules',
     :custom_puppet_manifests_dir => 'files/puppet/manifests',
+    :custom_tests => 'files/tests',
+    :custom_bin => 'files/bin',
 
     # output files
     :facts            => 'facts.json',
-- 
cgit v1.2.3


From 0e872f337358bdab1c7c0d7ae904f19b810ea290 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 27 Jan 2015 15:09:17 +0100
Subject: configure vagrantbox to use https for fetching gems (Feature #6676)

Change-Id: I0c29e7e07c294e2b5480396bed9db1c3694127d7
---
 vagrant/install-platform.pp | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/vagrant/install-platform.pp b/vagrant/install-platform.pp
index 012a0eb0..30f0b1e6 100755
--- a/vagrant/install-platform.pp
+++ b/vagrant/install-platform.pp
@@ -1,16 +1,20 @@
 class {'apt': }
 File['/etc/apt/preferences'] ->
   Exec['refresh_apt'] ->
-    Package <| ( title != 'lsb' ) |>
+  Package <| ( title != 'lsb' ) |>
 
 package { [ 'rsync', 'ruby-hiera-puppet', 'git', 'ruby1.9.1-dev', 'rake', 'jq' ]:
   ensure => installed
 }
 
+file { '/etc/gemrc':
+  content => "---\n:sources:\n  - https://rubygems.org/"
+}
+
 package { 'leap_cli':
   ensure   => latest,
   provider => 'gem',
-  require  => Package['ruby1.9.1-dev']
+  require  => [ Package['ruby1.9.1-dev'], File['/etc/gemrc'] ]
 }
 
 file { [ '/srv/leap', '/srv/leap/configuration', '/var/log/leap' ]:
-- 
cgit v1.2.3


From 29961800ca92983cf60131bfe4894ecc4ee13107 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 27 Jan 2015 09:18:35 -0500
Subject: Fix unresolved dependency (#6664)

Change-Id: I70a35d6c14ec4a8551af0afd8731ef703f89e510
---
 puppet/modules/haveged/manifests/init.pp | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/puppet/modules/haveged/manifests/init.pp b/puppet/modules/haveged/manifests/init.pp
index 6d6a3569..8f901937 100644
--- a/puppet/modules/haveged/manifests/init.pp
+++ b/puppet/modules/haveged/manifests/init.pp
@@ -9,8 +9,7 @@ class haveged {
     hasrestart => true,
     hasstatus  => true,
     enable     => true,
-    require    => Package['haveged'],
-    subscribe  => File['/etc/default/haveged'];
+    require    => Package['haveged'];
   }
 
   include site_check_mk::agent::haveged
-- 
cgit v1.2.3


From aa04142eadacdfe9ddd2bfba19e25082b1c7da25 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 27 Jan 2015 11:23:29 -0500
Subject: Update nagios submodule to get fix for pnp4nagios dependency problem
 (#6660)

Change-Id: I395c90f3b1e2d412e73c9e07552827d7d8b31010
---
 puppet/modules/nagios | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/nagios b/puppet/modules/nagios
index 57a1140b..aaf9e3df 160000
--- a/puppet/modules/nagios
+++ b/puppet/modules/nagios
@@ -1 +1 @@
-Subproject commit 57a1140b437a8cfb9cfd5d94a5759b1e3ed86d45
+Subproject commit aaf9e3df1c184c934f014f1003d8c2e2776b2b71
-- 
cgit v1.2.3


From 3dc7507adef2935668e309dd3a3f2694f283f215 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 27 Jan 2015 20:48:28 +0100
Subject: vcsrepo should depend on git package (Bug #6659)

Change-Id: Ibc2ae4697a37af97de625bfc9d8e149306578321
---
 puppet/modules/site_config/manifests/default.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index 138efc97..a75b3c7c 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -47,7 +47,7 @@ class site_config::default {
   # include basic shorewall config
   include site_shorewall::defaults
 
-  Class['git'] -> Vcsrepo<||>
+  Package['git'] -> Vcsrepo<||>
 
   # include basic shell config
   include site_config::shell
-- 
cgit v1.2.3


From 26ba53625bc9061acaabfc1a510d42efc55555c0 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 27 Jan 2015 15:15:24 -0500
Subject: update stdlib to latest version to address cve-2015-1029 (#6666)

Change-Id: Ibd39797484b86b7254b534693fdfc3b0c15122e3
---
 puppet/modules/stdlib | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/stdlib b/puppet/modules/stdlib
index 71cb0f4c..71123634 160000
--- a/puppet/modules/stdlib
+++ b/puppet/modules/stdlib
@@ -1 +1 @@
-Subproject commit 71cb0f4c2c3bf95f62c9f189f5cef155b09a9682
+Subproject commit 71123634744b9fe2ec7d6a3e38e9789fd84801e3
-- 
cgit v1.2.3


From 1da37fd05328976894035176faed6811d003dd4c Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 27 Jan 2015 22:10:06 +0100
Subject: provide apt.url key that can be customized in provider.json

Change-Id: Ic8bcca7fde25b4eb540aab8cc4114748b9b2cfd7
---
 provider_base/common.json   | 3 +++
 provider_base/provider.json | 3 +++
 2 files changed, 6 insertions(+)

diff --git a/provider_base/common.json b/provider_base/common.json
index 649db0d9..c25f59b4 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -50,5 +50,8 @@
   "platform": {
     "version": "= Leap::Platform.version.to_s",
     "major_version": "= Leap::Platform.major_version"
+  },
+  "apt": {
+   "url": "= provider.apt.url"
   }
 }
diff --git a/provider_base/provider.json b/provider_base/provider.json
index 77437935..d66a01c4 100644
--- a/provider_base/provider.json
+++ b/provider_base/provider.json
@@ -59,5 +59,8 @@
   "client_version": {
     "min": "0.5",
     "max": null
+  },
+  "apt": {
+   "url": "http://http.debian.net/debian/"
   }
 }
-- 
cgit v1.2.3


From e99752e09a784629b89a2f798109804b11a1e8a4 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 27 Jan 2015 22:14:26 +0100
Subject: use apt.url hiera value for customizing apt sources url

Change-Id: Ib18c9031df13dab3187e0bb0f2202ffddd0d228d
---
 puppet/modules/site_apt/manifests/init.pp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/puppet/modules/site_apt/manifests/init.pp b/puppet/modules/site_apt/manifests/init.pp
index 633ccf1e..7e63eaf1 100644
--- a/puppet/modules/site_apt/manifests/init.pp
+++ b/puppet/modules/site_apt/manifests/init.pp
@@ -1,7 +1,12 @@
 class site_apt {
 
+  $apt_config = hiera('apt')
+  $apt_url    = $apt_config['url']
+
   class { 'apt':
-    custom_key_dir     => 'puppet:///modules/site_apt/keys'
+    custom_key_dir => 'puppet:///modules/site_apt/keys',
+    debian_url     => $apt_url,
+    backports_url  => $apt_url
   }
 
   # enable http://deb.leap.se debian package repository
-- 
cgit v1.2.3


From 1b3455a697ae74b34f28f4960bf0a274e27a1ee8 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 27 Jan 2015 22:40:08 +0100
Subject: provide way to customize all three apt sources urls (basic, security,
 backports)

Change-Id: I5542b320bb1edb52c63350b5e4fd2af681991fb5
---
 provider_base/common.json                 |  6 +++++-
 provider_base/provider.json               |  6 +++++-
 puppet/modules/site_apt/manifests/init.pp | 12 ++++++++----
 3 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/provider_base/common.json b/provider_base/common.json
index c25f59b4..cc4d2557 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -52,6 +52,10 @@
     "major_version": "= Leap::Platform.major_version"
   },
   "apt": {
-   "url": "= provider.apt.url"
+    "url": {
+      "basic": "= provider.apt.url.basic",
+      "security": "= provider.apt.url.security",
+      "backports": "= provider.apt.url.backports"
+    }
   }
 }
diff --git a/provider_base/provider.json b/provider_base/provider.json
index d66a01c4..84d033c5 100644
--- a/provider_base/provider.json
+++ b/provider_base/provider.json
@@ -61,6 +61,10 @@
     "max": null
   },
   "apt": {
-   "url": "http://http.debian.net/debian/"
+    "url": {
+      "basic": "http://http.debian.net/debian/",
+      "security": "http://security.debian.org/",
+      "backports": "http://http.debian.net/debian/"
+    }
   }
 }
diff --git a/puppet/modules/site_apt/manifests/init.pp b/puppet/modules/site_apt/manifests/init.pp
index 7e63eaf1..506591dc 100644
--- a/puppet/modules/site_apt/manifests/init.pp
+++ b/puppet/modules/site_apt/manifests/init.pp
@@ -1,12 +1,16 @@
 class site_apt {
 
-  $apt_config = hiera('apt')
-  $apt_url    = $apt_config['url']
+  $apt_config        = hiera('apt')
+  $apt_url           = $apt_config['url']
+  $apt_url_basic     = $apt_url['basic']
+  $apt_url_security  = $apt_url['security']
+  $apt_url_backports = $apt_url['backports']
 
   class { 'apt':
     custom_key_dir => 'puppet:///modules/site_apt/keys',
-    debian_url     => $apt_url,
-    backports_url  => $apt_url
+    debian_url     => $apt_url_basic,
+    security_url   => $apt_url_security,
+    backports_url  => $apt_url_backports
   }
 
   # enable http://deb.leap.se debian package repository
-- 
cgit v1.2.3


From 74b420220315b9b0731a6ebb22ce3f4a837cf052 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Tue, 27 Jan 2015 14:19:13 -0800
Subject: skip tests that require user registration if it is disabled

---
 tests/white-box/webapp.rb | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/tests/white-box/webapp.rb b/tests/white-box/webapp.rb
index 9f104899..a0d64eea 100644
--- a/tests/white-box/webapp.rb
+++ b/tests/white-box/webapp.rb
@@ -42,11 +42,16 @@ class Webapp < LeapTest
   end
 
   def test_05_Can_create_and_authenticate_and_delete_user_via_API?
-    assert_tmp_user
-    pass
+    if property('webapp.allow_registration')
+      assert_tmp_user
+      pass
+    else
+      skip "New user registrations are disabled."
+    end
   end
 
   def test_06_Can_sync_Soledad?
+    return unless property('webapp.allow_registration')
     soledad_config = property('definition_files.soledad_service')
     if soledad_config && !soledad_config.empty?
       soledad_server = pick_soledad_server(soledad_config)
-- 
cgit v1.2.3


From 50d1839a5776dbb1c672e0c6083f709da67dc3b3 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 28 Jan 2015 22:22:31 -0800
Subject: update default provider.json to use the (now) correct expiration time
 format. requires new leap_cli.

---
 platform.rb                                         | 4 ++--
 provider_base/provider.json                         | 6 +++---
 puppet/modules/site_webapp/templates/config.yml.erb | 2 +-
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/platform.rb b/platform.rb
index 26b17465..1466b33c 100644
--- a/platform.rb
+++ b/platform.rb
@@ -4,8 +4,8 @@
 #
 
 Leap::Platform.define do
-  self.version = "0.6"
-  self.compatible_cli = "1.6.1".."1.99"
+  self.version = "0.6.1"
+  self.compatible_cli = "1.6.3".."1.99"
 
   #
   # the facter facts that should be gathered
diff --git a/provider_base/provider.json b/provider_base/provider.json
index 84d033c5..a60411b1 100644
--- a/provider_base/provider.json
+++ b/provider_base/provider.json
@@ -42,16 +42,16 @@
     "organizational_unit": "= 'https://' + provider.domain",
     "bit_size": 4096,
     "digest": "SHA256",
-    "life_span": "10y",
+    "life_span": "10 years",
     "server_certificates": {
       "bit_size": 4096,
       "digest": "SHA256",
-      "life_span": "1y"
+      "life_span": "1 years"
     },
     "client_certificates": {
       "bit_size": 2048,
       "digest": "SHA256",
-      "life_span": "2m",
+      "life_span": "2 months",
       "limited_prefix": "LIMITED",
       "unlimited_prefix": "UNLIMITED"
     }
diff --git a/puppet/modules/site_webapp/templates/config.yml.erb b/puppet/modules/site_webapp/templates/config.yml.erb
index 0c75f3ca..5c05fc62 100644
--- a/puppet/modules/site_webapp/templates/config.yml.erb
+++ b/puppet/modules/site_webapp/templates/config.yml.erb
@@ -7,7 +7,7 @@ production:
   client_ca_key: <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::client_ca_name') %>.key
   client_ca_cert: <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::client_ca_name') %>.crt
   secret_token: "<%= @secret_token %>"
-  client_cert_lifespan: <%= cert_options['life_span'].to_i %>
+  client_cert_lifespan: <%= cert_options['life_span'] %>
   client_cert_bit_size: <%= cert_options['bit_size'].to_i %>
   client_cert_hash: <%= cert_options['digest'] %>
   allow_limited_certs: <%= @webapp['allow_limited_certs'].inspect %>
-- 
cgit v1.2.3


From 1882d0b1a3470b61c07aaeec9e9da8e5125c532d Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Mon, 2 Feb 2015 11:23:55 +0100
Subject: bumped version number from 0.6 to 0.6.1, otherwise latest
 leap_cli:develop refuses to work

Change-Id: Ic11ef26f4874cf4d8e4f79d3e28cd04eee020422
---
 platform.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/platform.rb b/platform.rb
index 26b17465..7dadbc7b 100644
--- a/platform.rb
+++ b/platform.rb
@@ -4,7 +4,7 @@
 #
 
 Leap::Platform.define do
-  self.version = "0.6"
+  self.version = "0.6.1"
   self.compatible_cli = "1.6.1".."1.99"
 
   #
-- 
cgit v1.2.3


From 5df867fbd3a78ca4160eb54d708d55a7d047bdb2 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Mon, 2 Feb 2015 22:53:14 -0800
Subject: added custom puppet function sorted_json(). closes #6389

---
 puppet/lib/puppet/parser/functions/sorted_json.rb  | 47 ++++++++++++++++++++++
 .../modules/site_webapp/templates/config.yml.erb   |  2 +-
 2 files changed, 48 insertions(+), 1 deletion(-)
 create mode 100644 puppet/lib/puppet/parser/functions/sorted_json.rb

diff --git a/puppet/lib/puppet/parser/functions/sorted_json.rb b/puppet/lib/puppet/parser/functions/sorted_json.rb
new file mode 100644
index 00000000..605da00e
--- /dev/null
+++ b/puppet/lib/puppet/parser/functions/sorted_json.rb
@@ -0,0 +1,47 @@
+#
+# Written by Gavin Mogan, from https://gist.github.com/halkeye/2287885
+# Put in the public domain by the author.
+#
+
+require 'json'
+
+def sorted_json(obj)
+  case obj
+    when String, Fixnum, Float, TrueClass, FalseClass, NilClass
+      return obj.to_json
+    when Array
+      arrayRet = []
+      obj.each do |a|
+        arrayRet.push(sorted_json(a))
+      end
+      return "[" << arrayRet.join(',') << "]";
+    when Hash
+      ret = []
+      obj.keys.sort.each do |k|
+        ret.push(k.to_json << ":" << sorted_json(obj[k]))
+      end
+      return "{" << ret.join(",") << "}";
+    else
+      raise Exception("Unable to handle object of type <%s>" % obj.class.to_s)
+  end
+end
+
+module Puppet::Parser::Functions
+  newfunction(:sorted_json, :type => :rvalue, :doc => <<-EOS
+This function takes data, outputs making sure the hash keys are sorted
+
+*Examples:*
+
+    sorted_json({'key'=>'value'})
+
+Would return: {'key':'value'}
+    EOS
+  ) do |arguments|
+    raise(Puppet::ParseError, "sorted_json(): Wrong number of arguments " +
+      "given (#{arguments.size} for 1)") if arguments.size != 1
+
+    json = arguments[0]
+    return sorted_json(json)
+  end
+end
+
diff --git a/puppet/modules/site_webapp/templates/config.yml.erb b/puppet/modules/site_webapp/templates/config.yml.erb
index 0c75f3ca..c6895256 100644
--- a/puppet/modules/site_webapp/templates/config.yml.erb
+++ b/puppet/modules/site_webapp/templates/config.yml.erb
@@ -17,7 +17,7 @@ production:
   unlimited_cert_prefix: "<%= cert_options['unlimited_prefix'] %>"
   minimum_client_version: "<%= @webapp['client_version']['min'] %>"
   default_service_level: "<%= @webapp['default_service_level'] %>"
-  service_levels: <%= @webapp['service_levels'].to_json %>
+  service_levels: <%= scope.function_sorted_json([@webapp['service_levels']]) %>
   allow_registration: <%= @webapp['allow_registration'].inspect %>
   handle_blacklist: <%= @webapp['forbidden_usernames'].inspect %>
 <%- if @webapp['engines'] && @webapp['engines'].any? -%>
-- 
cgit v1.2.3


From aab8376aa98f9e2acaa412aebadff64c458cfaa1 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Tue, 3 Feb 2015 12:17:35 -0800
Subject: increase the sleep time for soledad test

---
 tests/white-box/webapp.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/white-box/webapp.rb b/tests/white-box/webapp.rb
index a0d64eea..1e78c8a5 100644
--- a/tests/white-box/webapp.rb
+++ b/tests/white-box/webapp.rb
@@ -101,14 +101,14 @@ class Webapp < LeapTest
   def assert_user_db_exists(user)
     last_body, last_response, last_error = nil
     3.times do
-      sleep 0.1
+      sleep 0.2
       get(couchdb_url("/user-#{user.id}/_design/docs")) do |body, response, error|
         last_body, last_response, last_error = body, response, error
         if response.code.to_i == 200
           return
         end
       end
-      sleep 0.2
+      sleep 0.5
     end
     assert false, "Could not find user db for test user #{user.username}\nuuid=#{user.id}\nHTTP #{last_response.code} #{last_error} #{last_body}"
   end
-- 
cgit v1.2.3


From 47b11e980b262e0c043feb203a092df37ff04cd8 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 3 Feb 2015 15:35:44 -0500
Subject: update couch-doc-update to catch a more specific exception (#6699)

Change-Id: I4f7a13443574d5771ebd9dd2278ef64ba8593a7a
---
 puppet/modules/couchdb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/couchdb b/puppet/modules/couchdb
index 0fbe82d1..726b3a81 160000
--- a/puppet/modules/couchdb
+++ b/puppet/modules/couchdb
@@ -1 +1 @@
-Subproject commit 0fbe82d154d5dc7e4e56251bfdaf3b06563ee3e6
+Subproject commit 726b3a8145eee81eb55faebdbec40ed0e1b4e819
-- 
cgit v1.2.3


From 46994b7a746ea9c89de74a2e8d4996c21c20af5c Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 3 Feb 2015 21:45:52 +0100
Subject: don't create dbs before couch cluster is settled

Change-Id: Ifd665eb7efc06c1cf9e7b8fcfd5f42dbb34ac1b1
---
 puppet/modules/site_couchdb/manifests/create_dbs.pp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/puppet/modules/site_couchdb/manifests/create_dbs.pp b/puppet/modules/site_couchdb/manifests/create_dbs.pp
index 4322f773..40148b8e 100644
--- a/puppet/modules/site_couchdb/manifests/create_dbs.pp
+++ b/puppet/modules/site_couchdb/manifests/create_dbs.pp
@@ -1,6 +1,7 @@
 class site_couchdb::create_dbs {
 
   Class['site_couchdb::setup']
+    -> Class['site_couchdb::bigcouch::settle_cluster']
     -> Class['site_couchdb::create_dbs']
 
   # Couchdb databases
-- 
cgit v1.2.3


From aed223ad42635370bdbc1b239ed43a1330698c5e Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 4 Feb 2015 14:03:31 -0800
Subject: consolidate sources into common.json

---
 provider_base/common.json                        | 35 ++++++++++++++++++++----
 provider_base/provider.json                      |  7 -----
 provider_base/services/webapp.json               |  4 ---
 puppet/modules/leap_mx/manifests/init.pp         | 15 ++++++----
 puppet/modules/site_apt/manifests/init.pp        | 10 +++----
 puppet/modules/site_nickserver/manifests/init.pp |  9 +++---
 puppet/modules/site_webapp/manifests/init.pp     |  7 +++--
 puppet/modules/soledad/manifests/server.pp       |  6 ++--
 puppet/modules/tapicero/manifests/init.pp        |  8 ++++--
 9 files changed, 62 insertions(+), 39 deletions(-)

diff --git a/provider_base/common.json b/provider_base/common.json
index cc4d2557..95ffa8d2 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -51,11 +51,36 @@
     "version": "= Leap::Platform.version.to_s",
     "major_version": "= Leap::Platform.major_version"
   },
-  "apt": {
-    "url": {
-      "basic": "= provider.apt.url.basic",
-      "security": "= provider.apt.url.security",
-      "backports": "= provider.apt.url.backports"
+  "sources": {
+    "apt": {
+      "basic": "http://http.debian.net/debian/",
+      "security": "http://security.debian.org/",
+      "backports": "http://http.debian.net/debian/"
+    },
+    "leap-mx": {
+      "type": "apt",
+      "package": "leap-mx",
+      "revision": "latest"
+    },
+    "nickserver": {
+      "type": "git",
+      "source": "https://leap.se/git/nickserver",
+      "revision": "origin/master"
+    },
+    "soledad": {
+      "type": "apt",
+      "package": "soledad-server",
+      "revision": "latest"
+    },
+    "tapicero": {
+      "type": "git",
+      "source": "https://leap.se/git/tapicero",
+      "revision": "origin/version/0.6"
+    },
+    "webapp": {
+      "type": "git",
+      "source": "https://leap.se/git/leap_web",
+      "revision": "origin/version/0.6"
     }
   }
 }
diff --git a/provider_base/provider.json b/provider_base/provider.json
index a60411b1..f8d2715f 100644
--- a/provider_base/provider.json
+++ b/provider_base/provider.json
@@ -59,12 +59,5 @@
   "client_version": {
     "min": "0.5",
     "max": null
-  },
-  "apt": {
-    "url": {
-      "basic": "http://http.debian.net/debian/",
-      "security": "http://security.debian.org/",
-      "backports": "http://http.debian.net/debian/"
-    }
   }
 }
diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json
index 67744f99..e80a758a 100644
--- a/provider_base/services/webapp.json
+++ b/provider_base/services/webapp.json
@@ -20,10 +20,6 @@
     "secret_token": "= secret :webapp_secret_token",
     "api_version": 1,
     "secure": false,
-    "git": {
-      "source": "https://leap.se/git/leap_web",
-      "revision": "origin/version/0.6"
-    },
     "client_version": "= provider.client_version",
     "nagios_test_user": {
       "username": "nagios_test",
diff --git a/puppet/modules/leap_mx/manifests/init.pp b/puppet/modules/leap_mx/manifests/init.pp
index c2cc96c6..d8a24821 100644
--- a/puppet/modules/leap_mx/manifests/init.pp
+++ b/puppet/modules/leap_mx/manifests/init.pp
@@ -7,10 +7,12 @@ class leap_mx {
   $couchdb_host     = 'localhost'
   $couchdb_port     = '4096'
 
+  $sources          = hiera('sources')
+
   include soledad::common
   include site_apt::preferences::twisted
   include leap_mx::syslog
-  
+
   #
   # USER AND GROUP
   #
@@ -45,11 +47,12 @@ class leap_mx {
   #
 
   package {
-    'leap-mx':
-      ensure  => latest,
-      require => Class['site_apt::preferences::twisted'];
-
-    [ 'leap-keymanager' ]:
+    $sources['leap-mx']['package']:
+      ensure  => $sources['leap-mx']['revision'],
+      require => [
+        Class['site_apt::preferences::twisted'],
+        Class['site_apt::leap_repo'] ];
+    'leap-keymanager':
       ensure => latest;
   }
 
diff --git a/puppet/modules/site_apt/manifests/init.pp b/puppet/modules/site_apt/manifests/init.pp
index 506591dc..c32c29c4 100644
--- a/puppet/modules/site_apt/manifests/init.pp
+++ b/puppet/modules/site_apt/manifests/init.pp
@@ -1,10 +1,10 @@
 class site_apt {
 
-  $apt_config        = hiera('apt')
-  $apt_url           = $apt_config['url']
-  $apt_url_basic     = $apt_url['basic']
-  $apt_url_security  = $apt_url['security']
-  $apt_url_backports = $apt_url['backports']
+  $sources           = hiera('sources')
+  $apt_config        = $sources['apt']
+  $apt_url_basic     = $apt_config['basic']
+  $apt_url_security  = $apt_config['security']
+  $apt_url_backports = $apt_config['backports']
 
   class { 'apt':
     custom_key_dir => 'puppet:///modules/site_apt/keys',
diff --git a/puppet/modules/site_nickserver/manifests/init.pp b/puppet/modules/site_nickserver/manifests/init.pp
index eaf90d55..c2deab0f 100644
--- a/puppet/modules/site_nickserver/manifests/init.pp
+++ b/puppet/modules/site_nickserver/manifests/init.pp
@@ -34,11 +34,12 @@ class site_nickserver {
   # See site_webapp/templates/haproxy_couchdb.cfg.erg
   $couchdb_port      = '4096'
 
+  $sources           = hiera('sources')
+
   # temporarily for now:
   $domain          = hiera('domain')
   $address_domain  = $domain['full_suffix']
 
-
   include site_config::x509::cert
   include site_config::x509::key
   include site_config::x509::ca
@@ -69,9 +70,9 @@ class site_nickserver {
 
   vcsrepo { '/srv/leap/nickserver':
     ensure   => present,
-    revision => 'origin/master',
-    provider => git,
-    source   => 'https://leap.se/git/nickserver',
+    revision => $sources['nickserver']['revision'],
+    provider => $sources['nickserver']['type'],
+    source   => $sources['nickserver']['source'],
     owner    => 'nickserver',
     group    => 'nickserver',
     require  => [ User['nickserver'], Group['nickserver'] ],
diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index 9f97d2c5..ea64048b 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -11,6 +11,7 @@ class site_webapp {
   $api_version      = $webapp['api_version']
   $secret_token     = $webapp['secret_token']
   $tor              = hiera('tor', false)
+  $sources          = hiera('sources')
 
   Class['site_config::default'] -> Class['site_webapp']
 
@@ -43,9 +44,9 @@ class site_webapp {
   vcsrepo { '/srv/leap/webapp':
     ensure   => present,
     force    => true,
-    revision => $webapp['git']['revision'],
-    provider => git,
-    source   => $webapp['git']['source'],
+    revision => $sources['webapp']['revision'],
+    provider => $sources['webapp']['type'],
+    source   => $sources['webapp']['source'],
     owner    => 'leap-webapp',
     group    => 'leap-webapp',
     require  => [ User['leap-webapp'], Group['leap-webapp'] ],
diff --git a/puppet/modules/soledad/manifests/server.pp b/puppet/modules/soledad/manifests/server.pp
index 394e6032..b71fab69 100644
--- a/puppet/modules/soledad/manifests/server.pp
+++ b/puppet/modules/soledad/manifests/server.pp
@@ -12,6 +12,8 @@ class soledad::server {
 
   $soledad_port = $soledad['port']
 
+  $sources      = hiera('sources')
+
   include site_config::x509::cert
   include site_config::x509::key
   include site_config::x509::ca
@@ -29,8 +31,8 @@ class soledad::server {
     require => Class['soledad'];
   }
 
-  package { 'soledad-server':
-    ensure  => latest,
+  package { $sources['soledad']['package']:
+    ensure  => $sources['soledad']['revision'],
     require => [
       Class['site_apt::preferences::twisted'],
       Class['site_apt::leap_repo'] ];
diff --git a/puppet/modules/tapicero/manifests/init.pp b/puppet/modules/tapicero/manifests/init.pp
index 28711b94..8afb18b8 100644
--- a/puppet/modules/tapicero/manifests/init.pp
+++ b/puppet/modules/tapicero/manifests/init.pp
@@ -15,6 +15,8 @@ class tapicero {
   $couchdb_mode            = $couchdb['mode']
   $couchdb_replication     = $couchdb['replication']
 
+  $sources                 = hiera('sources')
+
   Class['site_config::default'] -> Class['tapicero']
 
   include site_config::ruby::dev
@@ -95,9 +97,9 @@ class tapicero {
   vcsrepo { '/srv/leap/tapicero':
     ensure   => present,
     force    => true,
-    revision => 'origin/version/0.6',
-    provider => git,
-    source   => 'https://leap.se/git/tapicero',
+    revision => $sources['tapicero']['revision'],
+    provider => $sources['tapicero']['type'],
+    source   => $sources['tapicero']['source'],
     owner    => 'tapicero',
     group    => 'tapicero',
     require  => [ User['tapicero'], Group['tapicero'] ],
-- 
cgit v1.2.3


From 1555cfa158c26ced05300402bbbce08081d62f7b Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 4 Feb 2015 15:42:26 -0800
Subject: upgrade to tapicero 0.6.1, to remove auth in process list (closes
 #6697)

---
 provider_base/common.json                           | 2 +-
 puppet/modules/tapicero/templates/tapicero.yaml.erb | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/provider_base/common.json b/provider_base/common.json
index 95ffa8d2..74c09efe 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -75,7 +75,7 @@
     "tapicero": {
       "type": "git",
       "source": "https://leap.se/git/tapicero",
-      "revision": "origin/version/0.6"
+      "revision": "origin/version/0.6.1"
     },
     "webapp": {
       "type": "git",
diff --git a/puppet/modules/tapicero/templates/tapicero.yaml.erb b/puppet/modules/tapicero/templates/tapicero.yaml.erb
index 510450ad..40048a5e 100644
--- a/puppet/modules/tapicero/templates/tapicero.yaml.erb
+++ b/puppet/modules/tapicero/templates/tapicero.yaml.erb
@@ -13,6 +13,7 @@ connection:
   password: <%= @couchdb_admin_password %>
   prefix : ""
   suffix : ""
+  netrc: "/etc/couchdb/couchdb.netrc"
 
 # file to store the last processed user record in so we can resume after
 # a restart:
-- 
cgit v1.2.3


From 1d8998f1ee74c4b68cf9372409ef7e6e47f63927 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 5 Feb 2015 11:39:14 -0500
Subject: add a new line between resources

Change-Id: I7e763cfda2ebd6943b2ce3f6512bc5f5354dbc56
---
 puppet/modules/leap_mx/manifests/init.pp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/puppet/modules/leap_mx/manifests/init.pp b/puppet/modules/leap_mx/manifests/init.pp
index d8a24821..78065f56 100644
--- a/puppet/modules/leap_mx/manifests/init.pp
+++ b/puppet/modules/leap_mx/manifests/init.pp
@@ -52,6 +52,7 @@ class leap_mx {
       require => [
         Class['site_apt::preferences::twisted'],
         Class['site_apt::leap_repo'] ];
+
     'leap-keymanager':
       ensure => latest;
   }
-- 
cgit v1.2.3


From 512cd3900b742e01a4a205d2c504741aab5fe84d Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Mon, 9 Feb 2015 22:29:58 -0800
Subject: logs deploy information to /var/log/leap/deploy.log (full puppet log)
 and /var/log/leap/deploy-summary.log (just the start and complete, with
 platform version, user, leap_cli version, platform branch). downgrading
 platform require --downgrade (requires new leap_cli)

---
 bin/puppet_command                              | 117 ++++++++++++++++++++----
 puppet/modules/site_config/manifests/default.pp |   2 +-
 puppet/modules/site_config/manifests/syslog.pp  |   9 ++
 3 files changed, 108 insertions(+), 20 deletions(-)

diff --git a/bin/puppet_command b/bin/puppet_command
index cdb0b027..bc4bfc5b 100755
--- a/bin/puppet_command
+++ b/bin/puppet_command
@@ -4,11 +4,14 @@
 # This is a wrapper script around the puppet command used by the LEAP platform.
 #
 # We do this in order to make it faster and easier to control puppet remotely
-# (exit codes, lockfile, multiple manifests, etc)
+# (exit codes, logging, lockfile, version check, etc)
 #
 
 require 'pty'
 require 'yaml'
+require 'logger'
+require 'socket'
+require 'fileutils'
 
 PUPPET_BIN        = '/usr/bin/puppet'
 PUPPET_DIRECTORY  = '/srv/leap'
@@ -18,6 +21,11 @@ SITE_MODULES      = 'puppet/modules'
 CUSTOM_MODULES    = ':files/puppet/modules'
 DEFAULT_TAGS      = 'leap_base,leap_service'
 HIERA_FILE        = '/etc/leap/hiera.yaml'
+LOG_DIR           = '/var/log/leap'
+DEPLOY_LOG        = '/var/log/leap/deploy.log'
+SUMMARY_LOG       = '/var/log/leap/deploy-summary.log'
+APPLY_START_STR   = "STARTING APPLY"
+APPLY_FINISH_STR  = "APPLY COMPLETE"
 
 def main
   process_command_line_arguments
@@ -28,15 +36,39 @@ def main
   end
 end
 
-def puts(str)
+def open_log_files
+  FileUtils.mkdir_p(LOG_DIR)
+  $logger = Logger.new(DEPLOY_LOG)
+  $summary_logger = Logger.new(SUMMARY_LOG)
+  [$logger, $summary_logger].each do |logger|
+    logger.level = Logger::INFO
+    logger.formatter = proc do |severity, datetime, progname, msg|
+      "%s %s: %s\n" % [datetime.strftime("%b %d %H:%M:%S"), Socket.gethostname, msg]
+    end
+  end
+end
+
+def close_log_files
+  $logger.close
+  $summary_logger.close
+end
+
+def log(str, *args)
+  str = str.strip
   $stdout.puts str
   $stdout.flush
+  $logger.info(str)
+  if args.include? :summary
+    $summary_logger.info(str)
+  end
 end
 
 def process_command_line_arguments
   @commands = []
   @verbosity = 1
   @tags = DEFAULT_TAGS
+  @info = {}
+  @downgrade = false
   loop do
     case ARGV[0]
       when 'apply'        then ARGV.shift; @commands << 'apply'
@@ -44,6 +76,8 @@ def process_command_line_arguments
       when '--verbosity'  then ARGV.shift; @verbosity = ARGV.shift.to_i
       when '--force'      then ARGV.shift; remove_lockfile
       when '--tags'       then ARGV.shift; @tags      = ARGV.shift
+      when '--info'       then ARGV.shift; @info      = parse_info(ARGV.shift)
+      when '--downgrade'  then ARGV.shift; @downgrade = true
       when /^-/           then usage("Unknown option: #{ARGV[0].inspect}")
       else break
     end
@@ -52,16 +86,18 @@ def process_command_line_arguments
 end
 
 def apply
+  platform_version_check! unless @downgrade
+  log "#{APPLY_START_STR} {#{format_info(@info)}}", :summary
   exit_code = puppet_apply do |line|
-    puts line
+    log line
   end
-  puts "Puppet apply complete (#{exitcode_description(exit_code)})."
+  log "#{APPLY_FINISH_STR} (#{exitcode_description(exit_code)}) {#{format_info(@info)}}", :summary
 end
 
 def set_hostname
   hostname = hiera_file['name']
   if hostname.nil? || hostname.empty?
-    puts('ERROR: "name" missing from hiera file')
+    log('ERROR: "name" missing from hiera file')
     exit(1)
   end
   current_hostname_file = File.read('/etc/hostname') rescue nil
@@ -73,18 +109,18 @@ def set_hostname
       f.write hostname
     end
     if File.read('/etc/hostname') == hostname
-      puts "Changed /etc/hostname to #{hostname}"
+      log "Changed /etc/hostname to #{hostname}"
     else
-      puts "ERROR: failed to update /etc/hostname"
+      log "ERROR: failed to update /etc/hostname"
     end
   end
 
   # call /bin/hostname
   if current_hostname != hostname
     if run("/bin/hostname #{hostname}") == 0
-      puts "Changed hostname to #{hostname}"
+      log "Changed hostname to #{hostname}"
     else
-      puts "ERROR: call to `/bin/hostname #{hostname}` returned an error."
+      log "ERROR: call to `/bin/hostname #{hostname}` returned an error."
     end
   end
 end
@@ -103,18 +139,56 @@ def puppet_apply(options={}, &block)
   end
 end
 
+#
+# parse the --info flag. example str: "key1: value1, key2: value2, ..."
+#
+def parse_info(str)
+  str.split(', ').
+    map {|i| i.split(': ')}.
+    inject({}) {|h,i| h[i[0]] = i[1]; h}
+rescue Exception => exc
+  {"platform" => "INVALID_FORMAT"}
+end
+
+def format_info(info)
+  info.to_a.map{|i|i.join(': ')}.join(', ')
+end
+
+#
+# exits with a warning message if the last successful deployed
+# platform was newer than the one we are currently attempting to
+# deploy.
+#
+PLATFORM_RE = /\{.*platform: ([0-9\.]+)[ ,\}].*[\}$]/
+def platform_version_check!
+  if @info["platform"]
+    new_version = @info["platform"].split(' ').first
+    if File.exists?(SUMMARY_LOG) && new_version
+      most_recent_line = `tail '#{SUMMARY_LOG}'`.split("\n").grep(PLATFORM_RE).last
+      if most_recent_line
+        prior_version = most_recent_line.match(PLATFORM_RE)[1]
+        if Gem::Version.new(prior_version) > Gem::Version.new(new_version)
+          log("ERROR: You are attempting to deploy platform v#{new_version} but this node uses v#{prior_version}.")
+          log("       Run with --downgrade if you really want to deploy an older platform version.")
+          exit(0)
+        end
+      end
+    end
+  end
+end
+
 #
 # Return a ruby object representing the contents of the hiera yaml file.
 #
 def hiera_file
   unless File.exists?(HIERA_FILE)
-    puts("ERROR: hiera file '#{HIERA_FILE}' does not exist.")
+    log("ERROR: hiera file '#{HIERA_FILE}' does not exist.")
     exit(1)
   end
   $hiera_contents ||= YAML.load_file(HIERA_FILE)
   return $hiera_contents
 rescue Exception => exc
-  puts("ERROR: problem reading hiera file '#{HIERA_FILE}' (#{exc})")
+  log("ERROR: problem reading hiera file '#{HIERA_FILE}' (#{exc})")
   exit(1)
 end
 
@@ -150,13 +224,16 @@ def usage(s)
   $stderr.puts("Usage: #{File.basename($0)} COMMAND [OPTIONS]")
   $stderr.puts
   $stderr.puts("COMMAND may be one or more of:
-  set_hostname     -- set the hostname of this server
-  apply            -- apply puppet manifests")
+  set_hostname     -- set the hostname of this server.
+  apply            -- apply puppet manifests.")
   $stderr.puts
   $stderr.puts("OPTIONS may be one or more of:
-  --verbosity VERB -- set the verbosity level 0..5
-  --tags TAGS      -- set the tags to pass through to puppet
-  --force          -- run even when lockfile is present")
+  --verbosity VERB -- set the verbosity level 0..5.
+  --tags TAGS      -- set the tags to pass through to puppet.
+  --force          -- run even when lockfile is present.
+  --info           -- additional info to include in logs (e.g. 'user: alice, platform: 0.6.1')
+  --downgrade      -- allow a deploy even if the platform version is older than previous deploy.
+  ")
   exit(2)
 end
 
@@ -176,13 +253,15 @@ def with_lockfile(lock_file_path=DEFAULT_LOCKFILE)
     File.open(lock_file_path, File::CREAT | File::EXCL | File::WRONLY) do |o|
       o.write(Process.pid)
     end
+    open_log_files
     yield
     remove_lockfile
+    close_log_files
   rescue Errno::EEXIST
-    puts("ERROR: the lock file '#{lock_file_path}' already exists. Wait a minute for the process to die, or run with --force to ignore. Bailing out.")
+    log("ERROR: the lock file '#{lock_file_path}' already exists. Wait a minute for the process to die, or run with --force to ignore. Bailing out.")
     exit(1)
   rescue IOError => exc
-    puts("ERROR: problem with lock file '#{lock_file_path}' (#{exc}). Bailing out.")
+    log("ERROR: problem with lock file '#{lock_file_path}' (#{exc}). Bailing out.")
     exit(1)
   end
 end
@@ -193,7 +272,7 @@ end
 ##
 
 def run(cmd)
-  puts cmd if @verbosity >= 3
+  log(cmd) if @verbosity >= 3
   PTY.spawn("#{cmd}") do |output, input, pid|
     begin
       while line = output.gets do
diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index a75b3c7c..aa49f930 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -35,7 +35,7 @@ class site_config::default {
   # configure caching, local resolver
   include site_config::caching_resolver
 
-  # install/configure syslog
+  # install/configure syslog and core log rotations
   include site_config::syslog
 
   # provide a basic level of quality entropy
diff --git a/puppet/modules/site_config/manifests/syslog.pp b/puppet/modules/site_config/manifests/syslog.pp
index 26c65f02..1b0c1e05 100644
--- a/puppet/modules/site_config/manifests/syslog.pp
+++ b/puppet/modules/site_config/manifests/syslog.pp
@@ -11,4 +11,13 @@ class site_config::syslog {
     content => '$ModLoad mmanon
 action(type="mmanon" ipv4.bits="32" mode="rewrite")'
   }
+
+  augeas {
+    'logrotate_leap_deploy':
+      context => '/files/etc/logrotate.d/leap_deploy/rule',
+      changes => [ 'set file /var/log/leap/deploy*.log', 'set rotate 7',
+                   'set schedule daily', 'set compress compress',
+                   'set missingok missingok',
+                   'set copytruncate copytruncate' ]
+  }
 }
-- 
cgit v1.2.3


From d44e7b27f266aaa29a0f99d26d87dfa0d8125615 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 11 Feb 2015 20:25:07 +0100
Subject: updated LEAP archive signing key 0x1E34A1828E207901 (#6728)

Change-Id: I110e93a64f82e4133a043ff3fa18ab14b69a5dcc
---
 puppet/modules/site_apt/files/keys/leap_key.asc | 372 ++++++++++++++++++++++--
 1 file changed, 347 insertions(+), 25 deletions(-)

diff --git a/puppet/modules/site_apt/files/keys/leap_key.asc b/puppet/modules/site_apt/files/keys/leap_key.asc
index b6b5077b..c039db15 100644
--- a/puppet/modules/site_apt/files/keys/leap_key.asc
+++ b/puppet/modules/site_apt/files/keys/leap_key.asc
@@ -1,5 +1,5 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1.4.14 (GNU/Linux)
+Version: GnuPG v1
 
 mQINBFESwt0BEAC2CR+XgW04DVwT427v2T4+qz+O/xGOwQcalVaSOUuguYgf29en
 Apb6mUqROOTuJWN1nw1lvXiA6iFxg6DjDUhsp6j54X7GAAAjZ9QuavPgcsractsJ
@@ -48,28 +48,350 @@ KFJBkjrM0xn8H+D6qzwzGfmX1Yaw12oYA6pcai4aK5sO7KHt+THAxYAcVF7qxGU7
 lnDifM56hrH/DbE5InlDC8OUqDysj0cHacRee+ZYtj7TiEykWfP5RrZCLQ7L6Jd/
 HtgQti/9TVUaFkIlQCfvF+l4BYZQYvnhx3MVK7ChKLmy6AVQLWnDrBrDvl07HLvW
 6pslRzVHfWyIYng0pZ0HvK+MpQztCoUcDK470mjlpAtjNHuyKh6r6TtaiVK8MgbR
-Sx/NMHb1/PXQJrkCDQRREsLdARAA3Frw+j6H9McEIi/gjiGwvxnIdGc8McWchnFp
-OWvdhTW9056v+y22DoKbULjT8k+8GzuRQ0xp4VwCC1rX3UExwceczzGs+tSKuIGm
-g1ELygsaOZHdQBNLGPvn+TZNGlaYXPlQo7m8YhXGHwgQrdKyjcFD5xnOHxe981LT
-q+IQ6jVYhho7/Qik9rVE1XHxoOfYvnNZJD0cFdf9OcX47YoqmM4sZYPMoOmKoVQT
-sAAQ527wz742Bd6SpuhqBpdEw6YiCYxEoo5kBY3IhP3L5OTS4tzhOkdf1xlhWSnC
-FE7NkPcK6o+r6qCcUqRGV9jRwI97JlPKegEHYWvLD4Sk31pWi8NZ0toU/nqRvxbh
-htHxuNf3jeAAzxQBhGVi0C/IBr4vqyFqmEHr9JxIa3DTV8w/a0Y4hX2bczL9Y1cB
-6n8qOA68aAn+xerJcSOroTIJh83D/7OguexGGYoZBDvX6dWguf8udFPeYpJvkT6T
-SYF9U0JpVTtlCNutjScUO2uaV9+uDqACngwqbzBTjL8UucAleVcFfOi48yepnOd1
-1YFYxbw+/BcqLNhi1eP2AaGxIgXbR88tF9OC0SXaCH+1Z1bbalOmQNYstOv9BbsH
-vW7mPgX2xhyoDkVRWaNAQoDLbnJr4gi9cD8/kQMzdlGOzt2ist/+xueblXJs5TOO
-80Rw+AEAEQEAAYkCJQQYAQoADwUCURLC3QIbDAUJAeEzgAAKCRAeNKGCjiB5AdMq
-D/9SXulJq6Q4U7aN6o7TLMU2MgqeWqtBqwTNIisBoSJjXq9Od4iN2S5Akwo/ZQO0
-1nRNPPc9yjwidgb7wCUFDNglUDuGS2nXaQ0XAO83qHMOsORN2S93dO6xVRX2Chhz
-l9bUr1WIQcM+lIs/LZCX2rvKlsFYmZQHX/ibhQs7T01RXajwJqwxyXyVPL+kPNeo
-wva4ZUf6rzdqKZLfFgyJyGdHI18bF6lahgHdN2OOawEeU2K+MlluR3ZahoyN4u1M
-qijf6snmfd0++EIqDHwYPn70F4JPdMhyuVpYBVyVtsgHy9W5fS+zSj+vX+qj6MBX
-dFBs+a9nr8GZJO4BUP2mtyNgmEfUVQefSHnq+0OlGPZG4raxTEqJfp2KTRCGB4hI
-zYWO1g1cOBeXxFfXJdkX8LoKbP5s2Kzn9sAK6BxmazOvSNpuimCDNvKjR00iKNS4
-Dxix2FBXQU/4pVpGHjXTQP6RqeTrAedXvpgCHWP1UIlswIQecGmQcJ/hRZjd+0vl
-cjfCYhZHr7N96Da6Cy8v2fZiZHaSAt7T2oIZ9X3gEh/kOlLDcuIdvMHUfojn0MrP
-Ce1AqOHyQQqhkVylvZpS0PdE0VW3PmJ98uKfX2FVAOTUD4Rw3n9Ew7bfM249HuP4
-JOXi/Skp4sBB/xgrtV1u+E+BW0SS/BOiwfrI4xUy+MrWuw==
-=Om8x
+Sx/NMHb1/PXQJohdBBARCAAGBQJToyd4AAoJEJwCrGKo9aTfErwBALArOyHjW8Wc
+knvNM1/gMfMd0FUk2PdaQkp31pNb1BGiAPjrGavSVPXANL71oqyyTqnypEXQL1sq
+/GMsjQUvDugfiQEcBBABAgAGBQJTjlvwAAoJEAwyonG9PMeAAgUH/i8DN3Fk74sC
+Bb/eQmUQBeYfNcNvItj4bR17om2R/nvxtNp/RYrJywWwT95rL1gmOwbNtGpTh8P/
+34bH5JbagPQZCq2TVVgOgPOa78ljhsx4iTd3jK/oYnJapkCm6JypZ88XudMu3bci
+GV6khpZ01KtzJCjV7hsF1HAogU815ivdKv8uBGa8H4og3ooEbE0Yc1byOCk6m210
+ru5Oe3OoK0MjV3F0b2q8Bs8Dzy0b+5kPdL6QCDgErx6TqaniKX7lqPI+GoCp2IId
+acWkhCVjCwKGsDIplruJ108BCV79FJ08ZmSzN/Qyt6VuvWghchPtPWwmCTG3MqAd
+jtyizNX75uOJARwEEAEIAAYFAlOOHPIACgkQQuhqKhH0jTbbcgf/Y4kHgH6abmVX
+6G5+JnTIqJUyXpgdrpml8apj+j2vlEwC4SfjiRTNY9ywRlwoVXFP5KMfOJ3UZowc
+oj/z5TdskAGbjjE69CWYrNR7frPKPsxPZxQaaRXWWvALGNZHvuBQ8986gYQCBC/j
+DXxpb2gc3ViuDKMEMzmv4a/qtWLJuoE/UVDmjXnVAK6BwmxrW20Cwj+3xd5riDA9
+yLYHYhbahWaefJpatTkBhuqgNRAUstropxcGp4rvO7iOPxiCG0Z843r+atAHzrjz
+/ffeggG4jL1YbPiYx7gDqi+RtFGNJcrKhiXLmcbWFUv2XxlEJQMypowkygmawIqk
+a08STHXAYIkCHAQQAQIABgUCU44f/gAKCRChtMW9f78Ds/YPD/9CnqvZ74qjGNhB
+oclfcGnRof3Q0qpUP/+HAXW8stJCFsWPoet5QtvB7KORFXNC00NWvfHMMq4KzTkO
+JOWzU1Pinm6MxCWUichkNwUyOTM3p/nRFe8jX1QTSIGKC7vZMTghZ6sUc0a9MUz5
+e2Zd7jj4b2IPwbvo0KeZLEW+zNk74lf5hSs/v+O6gy9SwrZrIKjTlRDQ9L06awhl
+aDRjjtYsC/dPKLF5DF79q5fRdwvl+TgSG/k3WNbs1K6Q/sxqpf4pl54L7sE9bMrf
+bU5+rX/pL96Kmavpw3S3k7cK8/2ykn/gMtRuGwdiubWoWoPXEMsr+VHQRU/mqnSz
+iJIJWNRhS/VUAUBDO74u1D3RK5vMC+MJKFCUwHuPhceqKQbeq6Ccxi5A3N2gyiQB
+NcuxcSEoOQ3q2KoXMaawXsnDILxxYgPIJn9f7g7ceZS1kz1WHzrCC2wJWLosQzfJ
+r+XhhL1LA4ZeHmhaIFIBq0kY46K05uJOllaCpN39P38Cb82qzaLVH1ZCs1zfU3q6
+KzH6M3yvXxVlU6X8he0+ycK63pAeQBqXxEfo22gWqudScjBHa3OsMDp1igkiZvwI
+6gWFbkRcSuMk94Wrvzm2WFx4ClGB5A65aTt9nIr68ipJvmOrAA43bd0zZpKHxQtP
+3lJznewo8TQ9ypryePMxlgWYD+6HAYkCHAQQAQIABgUCU6PKNgAKCRCEb/rGNK7q
+P75REACeQFrfO0xSXZysAboGdzv6I7ZE8YYW3/rd5+RKY/m8F374MXf3YN7KiIdh
+g71h/sN4/lzgJl48so9B86Z84pmUOGPVaIGmqzDJBGBY1Z2ULU+sagy8ti94kdES
+LLVencI/dQXaL/dxoOerMgULGjNvuftZNFebwMdf0VjUCvWkV6T7pubEgyN8h4Mo
+J+rclg/SWf3O4QxFzDyNSdwDkNgTzew7n9DiNDqrTBEvV6ahMI8ayhhs1lzlTOSj
+tG8c1edsBa2tQSpkV6BuAv5Fqbp8hAkP79QO4aGATdKuoLIYHD8eULwDArnrR8VU
+aeLZTPzfobzg6KfHYTZNw8SXAl640DNbgvMQk9IPtfUXDP1b8EnGf76CjpGRhDNS
+VAnPhoFFd5OIzmJikocfYZkuuIw5EveQ+l5GAroO4TytdfGwYl0KhNAqExgbkWT4
+UVQwin24B+1MHN0Iwqg9zupQI0+IjZeWyzkmuHek6sphXC33HarRYeytte2HP35w
+MmALHeADTVrngSCsckzbVL5GCV5voiLaplqS4vqE6liqW1pEXWOYwfoPipyVDZxZ
+d9EsmErW4FPotht7rWKeizZqAdyQQft07dAckwKF92bG4cez3fFvW1hQKYHM61a6
+91qG8TRybZvnBh8aemrS5o8QChTk0UFQUjpRBbAOb+ayf/dgjIkCHAQQAQIABgUC
+U6V1nAAKCRB4YIWsINNFfeXiEACXy45MLSpjTfAF6xuxtlN2zBuo7gP3VNboIq0M
+ZcD1yxRIhSwKS1QAeWso2a7YJ6Kzp/HG2hi60Zi/Hd1vXSnNYwLD50GszInc8iNA
+2OEZUuDiw7c65lWxOdjc9jbnd4tbEBiupfqZ/15R+R7gmeOVElW5d3owC+ENgbPO
+hmZ3AH5cx4QdXtmPy5oWpHyU13izxvV934aY5OXcvsCYwIt7DCISEgiuPJ2azkzX
+7ak8C8U+diHF5M5Ps+6nBmNQ9bpHHwZ7hZOUQGs/1UW5cEeWwJEMcTEPLwvs3qjt
+K1L/k8DS6t95hr7xiNiyojCpC4L1XwT05MxGHKwY5qXMw4bqInyGsnf28NuoaUk+
+V+fqIS6uC+p7/D2l9RU206R93vGTOwIxxEaehy8i7GadhiHOKGADm7yatlmOJfMx
++9D/X7q2wWB+t0Hu5fr34NwEaMfJJgjOHhLqtBiuPsrr6D7+sNKIXkZcJNKE9nf+
+Nef1jygPjDF2O6AcHl2P6vPoKUwEAYYUyYB2ku/pm5wJ3V1bbXkTsYse8bWCUf6j
+SSWIacIoHAXtZjOe3BhKGKxG84h/7i/054SYI0+IIuec3zwiy+te+V5cyGbutaVg
+4WndnH/j27B7oEWmwstsu7i0EIO1dw3WwjhjiXsflaseWoB5LrOHaHpRccEeiRdl
+lka4uYkCHAQQAQIABgUCU6h3iQAKCRCDgslcKQI9+WQgD/9kFhcS5qu+l0RsHNmK
+fhk6RMlnPs0jY6E2BxdXbJaNBFN1NW3kIVNYPFflvazCowBP2ek+gtiJW5/uH3C2
+FAW//Dt2pVcjRN8tIqqrvMRJxLQEP2zJ1YFKnbYl30+ehHWlUUyleKzIBA/6GbiA
+ig/TbaA1cOgZNVDdtfJUxLphzNZ7FGatfjkKEYP8+xd/3Oj/Wba8F4cNhMUbsV2q
+Os3nXlnVt2hKVB9kOpUJQdjlJp3DKbim6uj/sLs9KRLdBfhrezd2KoIpvvGDo/V4
+xqdhW/J/vwjrISOQ05YsrCMOL2O9/Sdron+gA1zm/xQfC9k/Nv6lcCaOLywdcaYd
+3XJqXZBuZy5KEljm5Nyo4Hxhd9ZJiXw+pMzX75NLZr6XnZz7/t/8FbRKhlHfAl/6
+hoPK3f31os8KHyj6YrqGDGg8dwvhxMsHpPlvsx4jpIsbcE7kTwidvhJwe8qet4Xi
+cTxnF43irlAk0xIbmxnSgH6XX4G6vejPsqr89p9pCWLjURTT+tr+U1XiNfehomdh
+DUYXZv1Sg5pK2HNEqkGKQTsjzb29t6kiGA1JsmBCPP5SPGdHDagMfa+VFlT/+bmw
+Wsad5R+f3vhTQJ4GBcpBgMpQwEX5wHSGs7dpKxUaL2kinRR7wBBtPLO0P0GLJ6vf
+kBhrtfA4gQCGqT+cOEdHlH8gC4kCHAQQAQgABgUCU44YbwAKCRC9aMeqmX+nf6J8
+D/sFps0R7GCzzEKgIdDCA4lAWj5XXa5PkGAoZAcPj0kbn3x+lrLtScjAoDXRFjoJ
+pP+bqh1tBHvLPn849mIcX+jKgTh/HvSWSc4ShSt/4ejKagDUdxHzKipvH9A73FmV
+JI4DVTthjLl9d3EK2+de02jzQsHh8mzTjKJPnUUUI61BmdGyQCA+COaVG66tjZBM
+b8LuQoXQqgxpzYfDW3EC0IT5MdDu3wDFxOVCVLja0wPsOfp4K4XRsfkAOk3AaXVt
+2DQv4LCEa02FfrKDrsJECRgWfiu4kxVzxR8A5O2ZgPreOh8sWRnDIt2eMmzj651h
+B+W+ym3A9o6WoileJ3yQHfOqK+4gvreTzaQERtR3Bj2YgphlnIi/MwbuofjBhVbM
++Zg55D6HS+g12xadxAsFJJ9Z1lhLINgOP+W6pZTU3zgktEc93IagU5DyQN2d0nl0
+Mc9yQHQhYzpDBF2Ub4Czk7uFmTmRVGf8xE9VThv4WeTA60zuonh3hZGrdkgdgp6x
+rZ5jJs8SJLxXsIX1umrRSJxCxOJ4FfmsTRDtUlJdOFEg7qmXpjKYe5MHGx8PnS6t
+RiCy+0JnDUXnA2hDBESSrvXcTUQ4iPTpWGluq3vicle7OmKU3Gzxu9VFETOGZbZK
+EbdU9btswvSNaQ+Yat+mr9hJKEbXS1XS6srpT2FwBBhK9IkCHAQQAQgABgUCU47W
+PAAKCRDHMrHRwo9OL0TaD/sFMQOnuhtHjBYVJjQxABawtNsp7VtUP98hgfchc2iG
+eXu5IDu3fgoyf769iAFq5x1K62yP1gOoEbk1fCn5RtZT4pQ0DZ+wpKxELpkwUwc8
+R5/aSOaYxxl6TyVDTeEguMQkWYiDgVC3SaDCTh6OxmHrIEROniChI92oB9VXvT6b
+N2wew2sEwY7k7bCTuujsywW/azsc8ojc3WvwdfDElribCl8eFCHYGIQg+YWcRIv0
+PS2TwJoEqpjKkLSKANNeDHwCFX6QNwbdJJVTfL0BoEKNUxKG+Lc6Y748h5DpA4nf
+P7333Z6eoAyaOeCQDScAJyVW203OR2mWNvs7PWii2+gvr82mPe1tncShrA6gdn8y
+Gf1bmdyNOqDpnOz2XpDKggy7tlIlBWIPzv2g87saS/gjdD/z11DXJdG8d0lJy2sw
+KkWDtUZbn04Mw2SwkZ2xeSufrKfJN81kLEM/zAtfD2kCTv3KilNnjjLRNMrM06qb
+wruxw7G9x61kLrLJlCZTG6XRnqmn03OiaKACnepQY63yTZynhXwtWP4VxHmxTovK
+T7TSYN+vSomVRjAvecm/EVz4H60OgzzRArWnTx2tmsnttzoSHsmA17O7TA2IBBSr
+F2BY4+OgEvSQiUldsfEC/qPwlSP016Z1oD30DB5bV7PBm0UheOl51B2Sh1E/N4A1
+sokCHAQQAQgABgUCU6Mo0wAKCRCl5rymKbpBJy+OEADI3UuK8K8IdayCpC9UOwuA
+/LDF01RW2EoogmwLywSS0ipf+D0rEvH9EtqXbz2ibOBhZIxtYzXXEx0Kx3fnYQvI
+nm8wdnc0650tGMCyU8sBTaV9B0mdYakMmQZc8Hbwd88fLnwEFn+qHJ0ac31geIxD
+N7vfgKeqea+4VGKnNbG1h0bRn2CK2pccnp8sm1eHJ/u25X05Z0Ofrx4It53OhO5R
+TSHGhHM62+48FcdEYtm6jPcS6RY/mXWBWPJsjmvvtQ+67PfJVHVJMDVFJV98PSqL
+bD69doz+golpESEdO5uWrLJEXMj8O154HQg5xnOXWurzNG4FdL6eeXk7+1UfXSXL
+UzGkaMgB6HjNTTrjJG19B/+9F4nbItN2EOJ4lVEvDCL5uE0CBxvG9y04dxzI8jCg
+1/hPjYyd4Qb7N6CDDoo7M0lhm5QSlDa0NDfaIpxEPBtcb0wOKaJUHfDMertl0mWv
+YbPhP5Lftq+h4syvQ9iu0gitGCGW6O/GXH3/ZhnyjVJRJnFkcYIeckKXVK7aCEty
+S8adffjrwYvH681P5d+EwDxY2B8UJE9sPx+Bz5mpsETSVbm+aA0KsCwc9jLnJcDB
+84/7ovuRXdP0C06Q+YC8fY8QQZmIl/bkzwAWWyZVSw4O9/3pWnjXvqSu/6xOSVfF
+0455bMvyv+MOiTlx8NqfgYkCHAQQAQgABgUCU6f59gAKCRDfoyRRwJ6+uqx7EADL
+COXDrUmHbHQzOn5B+uVfDQJrtVz3jNFdHb3p4qRD01tJ67/GhcoZ7NUVo79ELuWJ
+alQaIM9agmYZa5CsJIULRI8JtalcLRXCxFX4ls7L/XRRO0atwzpt/K9hao6Taewp
++J0Vy+TVLVeh2jcajRL6DfrlawMDpD2OxDw16KGMZagmNoWcuMZqK6PRXBnFGy6l
+EL7+gCy+vHe30nl9R64qMhTxnpCFvK1UCk2Khzz/7nUNwXw4McU2KYnU7AiSMNdf
+PWv/AW0m0MyWRBLmEy/nen+hIEmoxIomifroX3PuyChjZ2FaNWs3Kb7HKhXGSeCl
+1UkLBPeZa+obfP0D57qODeXMUxny8yOGOXOrHlRhdJz01qZ9v0UCfwnBJo1ewLaa
+cJ1l5Va26GwDbCh03mhwSE+AWXZbVTuemzUS5QBBYzC+SBxSqF+sE1hFy9okReGF
+Y+AjsjI+uu3A9ht3+vmvcgLWPyvkxIVksnvcmPp/k2RLkyk/tQWA31pNRMyqaReR
+esg4mFszKEtbC+tFVqucpCxd/Rvvvz918lkEFjIPN0yQoRenb/bKB4i3jbKIKMnJ
+zCsNeaobdpsNcAdl0DOpLMfo+RFzheQnMkwBQgI0XNxz3ZNMPN+BkEFWs7u7mfpK
+k+ZnU/9fKOyrOC1z2KZwNhjOF9oHv+wfa3ZQ7I/nkokCHAQQAQoABgUCU4eKwAAK
+CRCMv5oyKGGnkL6sD/4+jhdGUEO+n20VXPWZ7hV4GzVezVV2yLHd3kCfG+wKQPtp
+Y9Qxc+3gyI5rOKxyIp2sYh0xpMkTbEy7HjFJq3gFtAC/lQQfoncZUrGL6xsh6PmY
+x3MzXQteoJ/u94c6LXyZoYhYfSi6jv4/DASeIdxDZwaaVm7WRb/FcT54l1iazevj
+Jp4h/+udPeGjsS2c9cUu2URJYv2DlxO6JyKRdv6H4e/RgzUmf5LJ83LLQ3V2BUrp
+ZSnpw1YZkdUESNyNAKXfdAkNOTZXHM7BbmBSg7MSpaz2PZXgf51CfoKYkNtfyIpp
+iTNxRlmImwXKl9+efQUOiWokuQGb683bUMRbq2S08CSzrvTAXuDLTrro3emAvhO+
+NxFQN7Lf5s8eElcTH/dDG12HlMSZcQU2S9mEl/N+LwdOpOP84hHU7or6q5riUcAL
+YIYPRcaU8O4QqHKPOId2G60f4S2g7hHVTi3B7IXCgSzusciSVCiol8Q5jqngBSu3
+qySjuGtF2CHaz36Qr5cdRSJSAPgm2mquVOdUtY87a4+662bHmf3w5Ma8cTjnoCnt
+EmXL5YzxMmPWhCR7aNvrL8/TPUwIPFQfbG+CDgg5hgjJ+gM3tlm4x2LyAcWqJJSu
+a6u58TGEdNKe3c1jJuub32/D0xqIJF6PA63sIIDHal1488NvPMI32HDITm8H9IkC
+HAQQAQoABgUCU5BQsQAKCRDUVSNnbtYQt5B+D/wL1OizDsTv6fx+jbP8//DpdyO9
+8YagYCAxoXTbJ5WQLkTXpWWVMHNjho8yw9H5d9HQEr0NkdyCWEQdoocaOH+po308
+jeAih0ujbLmGC0JjFMx4gKYdGyqH/VuIwx4odPzlmmgcMDvjAH7ynuhjbX3jVpRk
+z+0qSk24TyauIXGmQMHUD69d7obckmLzPRLtBZP/ZSV5Wmjt5eKGILmjcBmZAde5
+PIXRRefzMtgsey0mkL8AUyLbQ+/uNRyujGvcEtonbdqLaSzXlS55zOAcvOM/IiD/
+jM1rCkN9favjCFtYD/4oLtXICRHmVDiLjfxsqE8+ZiRsA/eDZYeqjDfh1c1pCb95
+IvP/5+LWXdS2COk1W/FgePlKDurlvPRmRONL6Naxz+whvaU+XAvS7uLv4lvueOVs
+mpqI09mwigzbzhIpOP2havP0o6p6tEDeRzjEUfaiHwBypz6HrsyI0I6cdSYo2C1m
+ht7XSpMYJiEJXsIOntdhmKQMZ5TKGuLazEBJFWu4caW/2ooZuZnI2agE+GOHIe1j
+odmDiW9I5plInjt8JJ9M3vXawkTqkCuwwrajmEj02H/guCZiINBjBgYqEHkp5ETz
+aPIBO9/+ibURoRxUPRDKsXig1weKg1zOdA0WFw/j0M2NVZN2quDFDq+vj7pq/ABb
+bDI6xb5ylKGa55N/pIkCHAQQAQoABgUCU6HosgAKCRBNBWHp+dvuE19iEAC/p2ql
+a8cO4XhC03GT29RSBXdEU8jF5Up/mYj1FJT70qT9/FLGaqcBeGCGo3VIBnLDiOHU
+DR6ZA1DGV2hcCr0bwjnf1RwDSpAx+gfljMPbUJE2WAcn9/h97Gpkz1pGIyZUYmIC
+SvsiHq4eAuiEfRCN9rTYYv+qjE2kaIFyknrLoou40yL8TnvZRi6DGxh2dFy3XaPN
++QSsZ3GtFmXA2xkd1izPGdMJ1LrNPWOnchjnI7yBFytxrMlSjQcrQISzzmcczsl6
+xVvCQL1DKDVOfSRq3H7s0abbYHK2TiwxednU5RxELXOQYUC7kpdpI+qssSx0zWxd
+C7FpeOEbQZ4h+UTO5dM2xI9LRTACKu+73+GOyHjIS+9iF2bBpJoH2tmoiUnEK07x
+U9w1digPPxQSIfFC/NWabZ3Y9L8s5efKh3dN0WczoxwNWZviqIk8aBLRkEh4cfbC
+VrVyqWLNYrWcJIv5oE8MkcCX7tTVaaiQJUlYLhMNquM6dlq4QyvpVEppgT20BCw/
+WH8Ra04n01KRlFk3p4EKc7k9ETDqnOdHQhHlyLBBytgB5xgpp3DIWXspMoVcJZX/
+u/XTbdRDxC6cywBNUhJAfhVY8OXwA2rLW+p1KBi/2DT+Gjzh0FZteaUyYUa7JITC
+DYoZ5hjWFaCYh9EtuyirFZ2umSkPb6oBkNhKb4kCHAQQAQoABgUCU6xtjAAKCRCq
+aOzI6YAJU6erEACj8z2iMep2PzgcnpHz8csKlAmTrBRmNgErJNWfSPG5Uw1wvf6R
+zcD5iZ9D9Xu6SCcZ0DVtLdho9Z1/Zb22ocOxTBd40DkryDdO9ANSHj/bw4tYzTtW
+mftoU5qMdD7nQgp+2fMTuptASAx/WK/n1tWam9XyM/i9fdD4iu2pzbBdX0F2RgmM
+S197fQgAAVMfDDHjgquiyGBefCaMxv4FEM/Omn5ipkhrmPpsqTmZJNxAusiOiPJS
++pjl18Xjf+VKtRgLtr4pu0y+NVVXmI9IvncFlR1viyaKDoudB0K9UXlVKUURP7am
+bdS/yginiVbgaZ9Tx5STFC1FYKk69JdouvzYQc9vWW3C0cv68GWivpdFQMHrDAjA
+y9rFpeqs9UBbHpxCQ38ReoYDyxL4QJulEv3HpIRRt+UV7NE+3+Ln3a3/nTnUKJZ3
+m+kX6qKh875Td1OBZAmgfy8zlDdd50n0bQjSt8/DZsRdpFq5LG5vXA80Y+Tpn3i0
+jTJ37JGV+7+Yxb3qXM8XY0DFnn/cf/BFbbqLwEUxalooKp8eOO1G8yW8kqBdxGe6
+I1gJEaht5hkbrh7LOzjs22Tyz+DN6uo3Lm+cIu2YmC1j38x9LzVxUJHIxFA0XTur
+wsMDMB4RvSs+jdWCCdkQM+1StiYeYDC7+dG2FquqpbsFl6fsoICKCksvVIkCHAQQ
+AQoABgUCU7TR8wAKCRB3w9S09qPTPwxAD/9Yt9gFoQptDzAEEzbTICYmA8zj2fyv
+PmSFCYfMQfAEOH0oJerU7ux/7zr3XnzekFd1NPomHhJuGBLyftHYJvird9KafLzn
+BW8NB54kCHARHqdyqQYoEs1qUIuBNn3TGW+7Ao1qjXkUr59PzFqILJH1aCYelgy/
+NN81NNTESw2in0xZ/OliVGZuXtTbYiS4js0p2bkPfzT/f8FeMGwzAX5RrvP7of6l
+W2U9pslpUf0g+3m77/G3nwQkV70e8NvL7j9Q+zkH33IMlnrbDPiIhwgjnrtokUbG
+bs4XHyhFZxoSMddOy75lRs3YhS+vGIEvfLo/P3aiMIDLEupdYR6ZbYZxCF2y/+h/
+KKgypirzK3Z3zePA3KQeEIvlq+vo0nxJCyfnj9wzM7AJ3IJKzMkvmvYSVqaX1OCB
+aTLeTUkpFUh4Nq2fv62RRtlRqdIzish3bqlmHwFBApQwvm0/uH2k3lucl9Kz7S+u
+nh1h9NR4BVY2l+f8Oi4T4Irut3qJnsrZXunPBMJrKkPYU8iKEVmSM6E+M4T1yGoV
+se3JAIFpDVNHlZfckOYmqYG3NAvuralw3mis/eaGlnBrBI9zp66FzZpoqaATzz6/
+EIbuZ2vs47xIIgVUoW9NZwGo5igYhW9ixUURznFDPRrg5+UfoBoCcQ4i2wVvciqb
+TaetJ6+QuqCadYkCHAQQAQoABgUCU7u12wAKCRDnvXCXmESXmUfAEACrMuez//Vq
+yvynY5ADBUMytq2jrK8GUqfbxDOzeRe9++16xIYJZ5qNsdFBL2ezryvuafcPsIqM
+BvwucEJ88jU7/BaUClJo2QPD+WLUit99J/O68DTi2m9Jxn+EUi/L2d0e+Kcb17zb
+Efbcg42+TZfxQhf1kUWLH71UsDwAiiSnfy6dkIDgwPnlTpuerRmsgI5dkFeCt8bo
+YFRXatVrjzJsX6rBp+CEasAXHuhAQvIoqepi3CTAUo5gPHSF+aldAD2SRw3xegmR
+nJkKNOYu4RfCUi3iRLV7Lm898pL82659jSUQMo7aZevwhaKQU/gm0LBbXHGizV7J
+uKyYE5vzEpAEA+ChOntE4dcsN2B5m81lD0ra8HbbqTO2AVlp/BJxNueGm/WdYHXd
+pGwLvWWBP5ZMqaPhqBdQ/5DMzkeyZnSBjykMNIFQIi2jRLe6/poReh9ieIuzO8QI
+MA4X3QTsRv3qaF/TkjTzUpB0x13fXWuyp4mrSEbFmsgMEdsHqOLkBAa2w1RLgvPQ
+21FKewWyasv2T8NdvuZT0sARuirvxLMFrb8fMC4Ly8xBhXVbpWpFz6eo8leygqSS
+NSsMzzCtm6yJ0sO9ufQWrQZMmcqV5ERGecnjYJ6QCPWEC+xCKGS2W4PmnkO96alE
+fDjEKsA6uGi4z1FYvx9macKX35Hx1cXsUIkCHAQSAQgABgUCVAJs5gAKCRAIlNrg
+SWRisWpGD/4lp2TRzpJkSpn/MKcMDPjxu3eJbZLISDHeerVhVU7BpyaxUpAHaFyv
+5eTi2SoTXIWPFUGzZXj0kREmWBQLk/OM2VcLpN4oSt2b05TPWNXatIve6Zlg1AMJ
+Xz+i7iTTLCgjYUhL6uvfIczX3Khx0VwfOZ1xT+VNJqyXXlL/eONc/+a/VB/ZikvY
+789VfgS/Xq3JTNQpUnGFf87YBrThd9xLsaVgpTNhmOQpAEHLaZIRw778roAcQWyZ
++/apIRuMUcOyishyT9p68DDu5N91TYfXayy2ckgmAt7Cf6j70YT9Xc2u374F/Avt
+XHHlnX3/hTI3cVKF+Wio8L95aM4BDmoHkk/7x2S6TUiHDiBQnLgSuwLdYr9eQKSZ
+Ijek94y5nz9KabKwj09vqW1b6jbt1eEsoeBdFGfL1GgmrSMO/erz7a+KrLgn+4Ld
+6GB/dLLhPCbf1ILe6oyThzvt+9vGsUqSNw6R3O1J1VYZBBHaDMZwvLRZcYOTfdpX
+OtmV5mNRCvDHyVR1OpsAY9m7EpF7npsgJa3UD+kaf9krVvua+aAR1Cj462M+UAcF
+FTOBQ5PciWtxKm6R1tFI23K9zqIGl+7VnrgiOiwQdEByFtdOnAOcbXf+iCyYZY4i
+v3ZzDt5ybREdPxgf+6LUVoKBh+Yy70ut/HmEI0P1exJc3k8ZoZtQUYkCHAQTAQIA
+BgUCU7GS8AAKCRAjY4v3LFk7wWflD/oDgQNEhpD6EFFCQ/y3g5PtOVjeF349vuTI
+XcTcQI657s7K5ftCYgWu1NNYUyLFiQJ1siRVZCqq39k7SIG3+4X9mUvGubqXog3+
+YZRy4FwnLGizr6PwEHsLeHoFiGAlbyaBrojgSgwVi5sir7JsH2PugxEFCZj9l6F3
+RbslBpDW0QwSsdenw1GQJrejZC3HkuE+D0U2cQ/YMebUaKiIi535H1N1oimcVpow
+RSX1NoyYI69w1JSyvc0fau7KfQua0+iGhyicL1BecGPKF+YIns6fuunnZuwsH+K3
+5cUu2tpi58bO42bbfirpn57LF/a7+o2pjUSMzez06aUqS4WZjw47bnpIm92gUarM
+41ExXuXLXZlEofeiUnWbVkJ5+MWeBKEfTBeqHToESEYoFSVgfszCR/0hQNy7E5AD
+OPorbvJaqUlNL6/cDURnQKe85QFi8y+oOzEkf7D6XvouMGQyxsYVjHEpEZdN63ev
+Te99Ir1nFc+FUCgch0wLPTKlYDpQBsYiZRYrZMG/pvKvu9+ig2sqRjI6nlARN6Ho
+cMoAGViK23JGikC5B15lblCGTL8bmiDMtd0+JccCSLv7dAJI1FSJEFqyI2CAGm0R
+j5Qh2/Zfu6XlsJdlnaCIXsqMB+5N50uXY4VuZ0L2+cokpYm+Pn9zJBFyxX3C2F7r
+1Vsuysds4okCHAQTAQIABgUCU/Dt2QAKCRBtnoZL9ilTXmhID/9PzhdXfJKYQLzR
+9/NBX05SlWVrQU8KOA4KtaOE9AVCVgD4bcIuH5Sf437xtaLUChw/x112y37kT6i8
++NzyedmLjXvZ59bmaUEzrLw3aZUZ9vNdkLeqQgmk2t0tIfQjVssv3qFqbHmdRT3p
+XqMRz4JzyA8Q1ogM3C6Ng7qv1bpQS0JerfSchGrINGSRWIrbsguhmAIiJ/Vt0X8y
+ALzqmg6kt0Lnz5VnG7dMpIfDqyef761o/wbAvVx9WphEmlCqiMd/r9kThQT2rQnq
+jvi2pFnUEwUj1zQf7ArpErcB50OfBFh9o4OPt8BPYdOkXprsIl+MI7Ax3C+Nu08+
+jtyKZxTL4gQ6lBvzjQyseX2tmw3LMd4nekrJhifF406zUY4uDEVINLyDCOyaelKz
+SsOk92vHD17s6h33PxyS5oUZl8ieM7E7s2ibJAa6BAKWXBsQ9JTpKDb7csFz+TOW
+vqsUMQZVGiINe/YAfcGQWLOK6NHbEnIOZ5dRSPXKxmWyXKe7KvZBRNExZfE494/Z
+hKC+Z9/wRRfg7B72fkFghwuwuxsmjuEv3DXXqfLeyGgTRQgF2LnFAoShjrJDJUE+
+ZCtZ2cmdfLDy9wdLZ0cRHbW26FzP26MUxiQmeOUiJnh2F6uKuF5XbFHipKVmSz0B
+cP0rNui1+Rq9Uc+jJunKkuGZ8QRTDIkCHAQTAQgABgUCU8F/NwAKCRDYolbJslup
+1C3WD/4kJ9NqhgjBBdW1Qk1VimzcDnMu2HRJOSYNqp/UVV8DRoet+f+507VCYaNg
+rczhKUra8wHQjiXg5blBAa/Y4rXxSFP+Yhow4e9DM+0CW3SLWByxXkNfGFtAufla
+OFYqbH6fn+1T2meuktXqVZroK2gXG1SDKHarg/XAK8QN1ism+tuGHSaO4ry1WLy8
+Ok94xPG2ca+2ViRhZm9FBqX+b4++3sIwycWIoo4MV7QzmFAJR1YxD2neSFp5hul9
+BgwUM0RLwW2DfbKB6fBCwVsZBBYRNs3gyrBAguZHi1hb2KGnHZAEgY9XEqfFlUon
+2A9VGs3MEq0eO67MpRNvcuVWr79i5stQL2FSj2+U44YlpOjY9zoqQE3ISerOQ/cj
+7ryqogQqDzbC8C9MPHCKI+2k6CvX2Bzk5HJWk7KNOM9n94VAiRD8a6NrpBTWrql5
+DSF46cVyQhUU56AKEL10tYBbtvm+QkhFvUudcomCxY1WJiNqOZQ0wO18Lw8gyNsy
+mEaija3z/ANIbGUQOQN4zqKOJ2TrhrTrZ50JUO6umHRbmObMZ3Y+G/R8WhgKs5kp
+JjZsvGnCNmi6cVeCKbLWtlevs0S5lfLafVX4/rGSkrD4TJk9mgzjLygYWiKqygmI
+2NaIKWslYua93V91SMSeSCz5w3Qzc1SRPjLJaeyNEX+cnO1aYIkCHAQTAQgABgUC
+U8kmlgAKCRBDYhta0kTdB4ruD/wKAy1lg71RR5uVOsoeM40WKCkaqF/G+9RDRtYx
+Xaj6LKSv7CQ3dVDuNlAbJXZOt6j3BPFtUSvcZaeSRtvuF3oQDJF78Zhc3UpMEpgc
+s4k86OOaspNAwb8B1clh9Yf5qCingQp3nr63a75d7d+5O8hDmqgREqsVHI4XPFz+
+/rlEQrwxkWaK2ht7fP2ARLCcfWccr9m2k4zPyacgjc6u7u3mdLcSiADsVcraoqBI
+aw/VLP3VBi+cv0B+Z99RBbvGgzdnkY1kOESEwmXJAMwv5pwxBXzI0ooVzMJM1pbG
+Tmec9pB4z3FzShsIwISHV+Z9HPsO+mkJ4W/LhGUZhrc9Fas+zk8loqCuI4u9hDoo
+apkIwwBgeR1O/GeaNwDU2qLYRmmv3PLATv+bi4qmYXsLbOMgvEEM59WqJxJMGx8Q
+mavFprVCRaO4yTsqIh482wFHbOHSZLOXGpzxggaLvveIVTncUhpFVOumCxLblOV0
+dyqjdCY0xQQC4YiBN4IH+3u4uwEG34htyZo6US57ilXxCW7nBDVFsKGUpgm5gs4Q
+USIfK4bpFOVOfKF9tyTzwF8NM10HB4HP3AnglgNCsxxoWhtY9H9rqwVxdxBfSmtx
+ureQFSVNUy6JxyfJrq+Io3c3oAIlCAJ76IMal7p9XvF2uMsVDnfkvSvcgF3Ba8U2
+AiJMYokCHAQTAQoABgUCU/yTLAAKCRCL3If7chXhiap8EACdzs4+K8bjmXcStt6O
+NKhWG086FXNDCAre5PuQ5k4NDqwYvQUBbJ6T1yrSuSa/FNmM+uKwfp3AEAqwNCWr
+ZQHxVagsfSJLcNhPhc6uON3twtJuC8eIKnXOIob1ITQEwMSGdW4dqR2w3jcwfCLE
+x2wvlxjFYN7yHYj+QdxaidWONjep5VSAt/noovt8WPZgBBoX126QV0gvKF1AQNpq
+OtiRFRLRceXFfrnNUuWCchZ6SzGxyer40tphmposQ4Ikehh2NQxTMx9ivbnKpfEY
+OhffDcSRcUMtYe0q/XqxcPcas/+Q0BhJ7LD7Tzw5huLRne80d5pX0SSkuPjsZJVS
+3ZzxQdI+1UYjJrvDCL0xIFg95JpGsEmeaWc3WsZVnQwVUjhd+yzgE+7jmEFLzlk/
+j4x1Ofg9Gn1TH72kXBZb1gqQZa/nI1daydUZu6JuoXLbGrBn3tdalEIagz23SWvM
+pz6L/yNU56quv0kVlCv8tEzCojQP6a6TkBIuvtCgjjKEIROqCQQbmGGxZpNVukXC
+6P8+3Tva305iT+SOYvQ8VYOh0zPMAt3xjN1fU1/MdaSlZ7n3utF64yp4OkvAzugn
+13AjHXlYvy09dC9TRGOyAK8j/YYJ0YBdApBOrLdz3Rja1Xfc2x3WWtcTXigDiScp
+T9afUXrKSHHAi5xkia94q8dGAYkCIgQQAQoADAUCU44fpgWDA8JnAAAKCRDM0u2U
+0hc56a3eEACP0z/b1KkxJv+EXc4eqBLuzNeX/eBK2SR0Ob0keWeYM18uExJzazHC
+i0XGDxi7DSWB8Rvx9JgsHJDyy0jh8IgYwjLsBuOfKfB43wgePQYC8C46G7l7mjqT
+piFiM4FFPe8pUp+OjCON+hy0XXK8oIRGgE14KF5E3TV/tlg2qRu52zG+yBeK7LzU
+jTJoC7G11dqUzJPsAw2Wc90dw4/29VwNWihYVd2iVNhvENVQcJhhEgeeTj/dSAFk
+NC80KQ/ivfRjzRPU3QONlSz67kNkcPIHT9wlOFuPio4Bsl/2hYyU7IInf1z5wlig
+S0j7aOrf70Xj8uRapc88HE/a41cV0hby5yITEwvLaeoH3vQc8dlV4yhDSoS6GmGW
+S5VJEvNem9tHm1QnAbHI42uAhitZMMjJ+hehT2m05P0XGpDvjPfiZWP2MAmiHkOZ
+39eSKTCbgb1dXtBMeEk3iH/VRoC9/plUKWr6gMJeJLPpJybLFRf1WMfnaFKVSq4/
+oeJyzPjgBJxKASj2jj055yz2TULqZJUjGqXbHa5pFWLs2RWzIyV2t5Bcn8p1Xo4H
+icSzjzj20qXjozmt/Qo3hO5dDLTfrQ8wnjqq7bSu4d7Mv+SjnzXBadu8cZcEVFoq
+SY0Mkc8RylMi9bEgoXTUyaM1py4lN3zm+z1FmO2KID4lWpPbZDogI4kCHAQQAQIA
+BgUCU6/1AAAKCRABogUB6BpLumA4D/4hW/M4AcQ+uZHnWmA+N+JC3WbWnjOcHcrL
+plpxSY5paom8nHGOfdSivqpDNaY+5yQLz1i6DFp0bj4c7zL+g7s7hRDz1Qf4S0e+
+dy96NleRkf2RVijhtkNxeyISaHEU7wImFdrrsycP7OImvvZvJk6bpWljk9FsXamL
+EySRKtq0WSa/UdcrLkR/93Wo2PLPpXoMRX8+jV8nLpL9RYkRThH05bgaYzGPPGyS
+H4pIkR8RlIvzd170glzNbuuPhhAV8kJUtXsj6W71AWLypnMkrUKseVL1t4iN+nf3
+ZFo6y/+s2MIzgiEHN3Ju+aJ+uSNpJdSwD2S89vhsHT22dQOqDHWdUo1DRYcL9kEu
+g3navGxVUKZ2etjaeT1PFfweLacwl+Uu45RCbmQD6pFzda7Wng8GbDERndUQ7qA/
+DCSBfnmJBNhXIMWJd8lA0puzd1wP189ZUzbge7AVLXJfFFuj5hVqkTKeWW8kodSz
+YKVfS1lq/jT2rtMDLK6k7vyf0Gjor5XJhfla68BtBNxn0+dUq25FOTAPy5ETf8BF
+L0Au8CboxnOMju02WBFb5Q5oNs7fk17hvzR7Ou/f/wMVQDZ16lGRROPsvN6wi6z1
+j04V4QNqOd60JnBVq+O2qmbtXjou7qxHR0ZBwI/qPaktwFJIAXmeOFdKQyl+I7TI
+6FmdpUB6x4kCHAQQAQoABgUCVHNXLgAKCRA1Dr6IHnUkHiwrEADJGKIoU5qyXiSi
+kVtmBdYmZilF9T9fzfcrL4TNmL/V/VCZgd9zRANBN+saSXkgm0CG+3jLIBlFhg/+
+zBlxceGrnDMB3M7C5n9kvymh5pAGzOVlYwfR5QICvJ+nEmk/WcaxiEUzGj04i5VO
+uRUr0aEVbVqubznnFtc+qEntQ1oWNW/fSvMmfBHBxSLRbqDBUGciDizh1R5XuJBM
+S+6freS5NeBnZki4Tl4zYS5Xu4qW2Y8PEHmWeLluNK5EnXmDqK+cZ+xQWn76Or0s
+T9xx7hZUvef8y1T9RGoS4lpo96PylZtAMnCJPT3NffaupN/P0XIu9cI90fmRFWvW
+Rpj4bF0MWCoA/iGz47rQuIIBo1EAU3oV0I9v7TqEwhkNRFHuKxcqA7dETDvRbsqy
+D6/Rkp0696cRCWMOuaokNSEKtjZEeRep07NWckGgBPbLppuS9HC5b1cwhZg9DWz6
+Shy3eZ/UcbCNdLoTt0nJ3/FIInLxCSzKjeKeeaA+OJL+cVz2XiGAqZ1UzBIb4NbN
+uTn9jGxc2MfyrpF1lkrYTuXa19ZF6bD8TkH93RGI8FUid7Y58w23OLF77z++glVu
+kpNB2BXCPppxhzaAyQIvrCuLVBBABf24JOP5kbSY6yZJL7NPMPW9E/RDRTcX0Yxz
+jW5LWdzdRe7NKSQ2Djx8ixT8B6uoV4kCHAQSAQoABgUCU/DRxQAKCRD5gmtHlHEU
+hhpDEACbY5HkQMYaXjjsjCzTMsl6oxEXrPlVAFCBk02k47Sb4xLyKYdvJ0w1Kfsc
+eo1EzUviwRbQuO/VAKfIc8ZtbikHLhKGU4/e/DVZHF8RtHyTgp9yWACbM8fDP2mi
+Grig2ESTxskGLfWIF/nx5fkkpMjEdTs0CQvgT2sV+RUTYRY7ZKy2tmnqctrdIeTJ
+Bw1ao1xKgGyqYp2LD4YmHyTW7pQPKIn5XzJr7BUgvRdpeZiC36QbuOJlS0UETk+X
+1ncL7VdpBhIGUoN0b22H4euEv1oRvK7wmZHDDI/wIW6F85jFMpEJXRAR3xgMrd45
+zYwM7q8UW3mYpR5qomfMAVtAFPckIt3ptkOuUIHVsUExzJS7AfeqZQxh5RDxphB5
+D+qaHHfqNNBCc2t8Aba89mDIk+789CY/Oxv11BxhVvrK2ZoOLhgprBO5q/edjwXY
+Bjtql7TRWrmQuhuFnBbL7Iq5GXovlnp7YSqtxBvA+1uneM2Fp419krP0Wd6WxkXn
+K91Nul9jkjN7afnAc4mAjUSmJfeZH8rkQ3Wv8iHEFkVUNd60ELICuIAtQSwlxsYR
+y0vpJP5RAzFgVCGukPnAKlnB653vBPGYb7PgCmYFrQ2A/q2TDlIkP3VlCNmvlSdm
+A9zIIl75Zi1qgDeOqTKuygQK95BfGbIUMeiJmI7zTnwdAzaPg4kCPQQTAQoAJwIb
+AwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVMvC/gUJBZoznQAKCRAeNKGCjiB5
+AbOiD/9uuAChZPgW6Sn96awak3mpeaKLE6MsOCRI++ahc6RGUEz+8ny3frzQSruW
+IutcRtLSRGKuNAaITku7CErjdyrWcAcL7YW1YU8+911U4tEI9rC/Qcy3/T4ULH7M
+SqXskVoMcd8PLG9F1Si/tW7rHjVeFNRh64eg9frYCArEFrm/5786IqS67yHQp+mF
+LfWqKws8rGg2fkpSE38gWEgn47/Qk6HQXEiNvItJ7XWvOg8xMbR0X83kP6Ctn3sr
+tzMEaPsoABxVvu8BmYO1SFfEbR2MGiVbVb8dR1373E6dY1QcoNZVXfYPE0QaJff9
+vLORfXmjkqbeefZxgNj5BA2+yIE04td6jGmuVOl79kJz6VFm8osror68aMl/tP77
+70cA/mg632uMNQqhPdkA+iV+GDWbvscXGA9vCUztptX8F6V4eDy9sJKfyPg/Zz33
+ZSoWDe5C+lDLF2zg0Vrv5bXj0qtIpk704qSIcGnehXXeLaWndCnKb88p+W8/jcfP
+QeLjCWnCPjGgeAHyAqEIO73puNltOn+aPXyxjtOi/KQRaS81aJZTxq4ffR44FB2z
+I082Oa33gmnZbP3sYsVuH44QQAYUEkHBIIosiqklqEoa9G6+Dtm5zUZtmyP6Cx1a
+xiN+5XQGoz1fh6sk9/TMW3fpqV0KS1Gu5JsgXTSxxXkarGueFrkCDQRREsLdARAA
+3Frw+j6H9McEIi/gjiGwvxnIdGc8McWchnFpOWvdhTW9056v+y22DoKbULjT8k+8
+GzuRQ0xp4VwCC1rX3UExwceczzGs+tSKuIGmg1ELygsaOZHdQBNLGPvn+TZNGlaY
+XPlQo7m8YhXGHwgQrdKyjcFD5xnOHxe981LTq+IQ6jVYhho7/Qik9rVE1XHxoOfY
+vnNZJD0cFdf9OcX47YoqmM4sZYPMoOmKoVQTsAAQ527wz742Bd6SpuhqBpdEw6Yi
+CYxEoo5kBY3IhP3L5OTS4tzhOkdf1xlhWSnCFE7NkPcK6o+r6qCcUqRGV9jRwI97
+JlPKegEHYWvLD4Sk31pWi8NZ0toU/nqRvxbhhtHxuNf3jeAAzxQBhGVi0C/IBr4v
+qyFqmEHr9JxIa3DTV8w/a0Y4hX2bczL9Y1cB6n8qOA68aAn+xerJcSOroTIJh83D
+/7OguexGGYoZBDvX6dWguf8udFPeYpJvkT6TSYF9U0JpVTtlCNutjScUO2uaV9+u
+DqACngwqbzBTjL8UucAleVcFfOi48yepnOd11YFYxbw+/BcqLNhi1eP2AaGxIgXb
+R88tF9OC0SXaCH+1Z1bbalOmQNYstOv9BbsHvW7mPgX2xhyoDkVRWaNAQoDLbnJr
+4gi9cD8/kQMzdlGOzt2ist/+xueblXJs5TOO80Rw+AEAEQEAAYkCJQQYAQoADwUC
+URLC3QIbDAUJAeEzgAAKCRAeNKGCjiB5AdMqD/9SXulJq6Q4U7aN6o7TLMU2Mgqe
+WqtBqwTNIisBoSJjXq9Od4iN2S5Akwo/ZQO01nRNPPc9yjwidgb7wCUFDNglUDuG
+S2nXaQ0XAO83qHMOsORN2S93dO6xVRX2Chhzl9bUr1WIQcM+lIs/LZCX2rvKlsFY
+mZQHX/ibhQs7T01RXajwJqwxyXyVPL+kPNeowva4ZUf6rzdqKZLfFgyJyGdHI18b
+F6lahgHdN2OOawEeU2K+MlluR3ZahoyN4u1Mqijf6snmfd0++EIqDHwYPn70F4JP
+dMhyuVpYBVyVtsgHy9W5fS+zSj+vX+qj6MBXdFBs+a9nr8GZJO4BUP2mtyNgmEfU
+VQefSHnq+0OlGPZG4raxTEqJfp2KTRCGB4hIzYWO1g1cOBeXxFfXJdkX8LoKbP5s
+2Kzn9sAK6BxmazOvSNpuimCDNvKjR00iKNS4Dxix2FBXQU/4pVpGHjXTQP6RqeTr
+AedXvpgCHWP1UIlswIQecGmQcJ/hRZjd+0vlcjfCYhZHr7N96Da6Cy8v2fZiZHaS
+At7T2oIZ9X3gEh/kOlLDcuIdvMHUfojn0MrPCe1AqOHyQQqhkVylvZpS0PdE0VW3
+PmJ98uKfX2FVAOTUD4Rw3n9Ew7bfM249HuP4JOXi/Skp4sBB/xgrtV1u+E+BW0SS
+/BOiwfrI4xUy+MrWu4kCJQQYAQoADwIbDAUCU3Zl0QUJBETWQQAKCRAeNKGCjiB5
+AVyfEACZN/cEPfHGRT2XSPS7GSLNUhayHiOn4Y1WEPzSvVBnpdR9BaU1lLTDzBAD
+KZ9wPy7kRASeQh6BoF5wQhUFMBxfG5KpYQJqoPYvtL4DwnfuAor7BDxM9C76FCK8
+adHlJOMj91Zn2KrJHlkuu8rfyht6jKWx1Ew6dwiAnUnn9k7IfgigARsjBput8n+9
+n/ZH+VBeegT1y7/T3mkQLAdHkBQeX4VwbsHko9ihjblwjxksyfZv02Xdorz9viVW
+clg31fpzvFzIqFyhQ5bUp99VH1fuKKpa4tplBVXgdf5+XGwbpauZC8bDNdxtxbT8
+BADhGB3xHPdf7nO+DZht2NQx50LUL6dgnj+cpAabS6ED6nn2O9Bf3kTb4GyHhhPD
+n+8aocpGPYg6FE59cQ9S00sigVu+JH+4gQZppd2Fj9chef0B6YkVe3BXiQEKapuC
+i7kMIqHkxUvxqrpwp9hSEOaWqTZ9Ls41VSgxR1qfg23P0I6YI1Pox1y/2NpkiOGS
+rNU5bhxCcwbB5M0Uaev26cfHO0MD2leuPIg1wRlyoIRc00RiiFrRFB1m8RnPN537
+rlgiDBW9zHSfh2g6ImYIjRY0+ezWaHMrEOovPwh9ynFYLWgIIUY/yKzsWCzRQ9eg
+d6bUixO57s+dFQfs8hYA2DjrjIuVMKqv6EuGwsaPDsPQFH3zMIkCUwQoAQoAPQUC
+U4eKeDYdA1NpZ25pbmctb25seSBrZXksIHJldm9raW5nIGVuY3J5cHRpb24gY2Fw
+YWJsZSBzdWJrZXkACgkQHjShgo4geQGeGw//fLw5CXRJ/aqz8qgEtI2+9O+Jxh6+
+Jiqyu7cYrRwcuTQLUXAjkE3ZrPRmWGHKL2xsshfO4D2R2KCU7eiy1J0WWvJrMQe6
+u/g8ryJX29tm4rt30L5Vn+iTOms6vHnaDzzK/KpZyrRNMlIhFaJhPYnx950uKVny
+F7BSbKIqC3ngApZur4QN5oAv9W/09rMSJ2GIMXa9Mo+4fkDiZ8coHByyxBmbor8I
+YsaLCz/ZKuT7RHBbh9mt3S2eIa79M7GV0+4lM2wi+hmPYoA8/Ngv+04hurNNrvgj
+6vj1LH+qpEZ+zQdH4QcrQYXKO/1QCXFKKAk8CQw+lGGFcCcrwVgGfzm+ZTGS0OxJ
+hXosHb+Bsdfh29fexCiAWMH9mSsNWmo554ZQSdmhOSe6CaYoDSDb+/+FDquzXwJW
+ZjTYYez6lbHkJ7icPo5IGb3xxjsXB7vrDOWSIqNptsaRBSjQthsX8NUD8AC/qeSE
+K7YL0J3tbuwBYUz3QN5Jk3nmZi+WLBHb9Gz6XruoUN5Cp0PZmYiLQjpU+ZNp2Nb2
+fVNZ/FurSHgu28VZN3fFdW7sQ5/moBLWP/8KK+yMWpJ6Aj5162dOL0+41y9w+u+c
+xHuEZsOXFixgubFcljipTDNRfeHNZlsyuWubwYfiHMCFgArktdFRnmtDAnjDqTOk
+8ENKxCfgWSoZztc=
+=6255
 -----END PGP PUBLIC KEY BLOCK-----
-- 
cgit v1.2.3


From 282abe541a2543face242ce35c89d9e4b032de23 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 26 Feb 2015 12:48:40 -0500
Subject: update leap archive signing key with version that expires in 2 years

Change-Id: I0587ee6d9033824ca66b70de09e4e0f65d67cab1
---
 puppet/modules/site_apt/files/keys/leap_key.asc | 634 +++++++++++++-----------
 1 file changed, 340 insertions(+), 294 deletions(-)

diff --git a/puppet/modules/site_apt/files/keys/leap_key.asc b/puppet/modules/site_apt/files/keys/leap_key.asc
index c039db15..5d9fb310 100644
--- a/puppet/modules/site_apt/files/keys/leap_key.asc
+++ b/puppet/modules/site_apt/files/keys/leap_key.asc
@@ -1,5 +1,4 @@
 -----BEGIN PGP PUBLIC KEY BLOCK-----
-Version: GnuPG v1
 
 mQINBFESwt0BEAC2CR+XgW04DVwT427v2T4+qz+O/xGOwQcalVaSOUuguYgf29en
 Apb6mUqROOTuJWN1nw1lvXiA6iFxg6DjDUhsp6j54X7GAAAjZ9QuavPgcsractsJ
@@ -24,19 +23,7 @@ n3oGGT0bjZiXZHShsWa5mjEvCJ7oqwtcCdo8thW128LY2/0h3JkSsYdgdsJjGJbG
 RrWJgRxImkSbxp3f6SAOsLwOdmrs52wCoEpAYPMbu79jb2G7JbR4uDB0i/pXCp+c
 aleyKb4ve2EjHAY/VPF5BXKaQh3JIvGKVEZIv5ospoosr78UHBk60RMMzDSlOFso
 BcB6Plpqoq4lI/4Zh8M1+eDjAOnOKwQanS4Hv7O2PqldGBUAXS3m6OI2Kvv3VqnM
-X0GOB2sX4Ox8UYkCPQQTAQoAJwUCURLC3QIbAwUJAeEzgAULCQgHAwUVCgkICwUW
-AgMBAAIeAQIXgAAKCRAeNKGCjiB5AZBiD/wJwUVZjfNeWdpKrYy9HtZExtTcU/94
-3lgRUNinUuLPFU4i2s+hR3h5fzXR15nUD+IBJlXlzLV2G/IjXYPTp4a0gqHpWULa
-b5Stu7AzFiO42/RWUAzWD1Fyh6SuZ3FDERvheid8s4SXoe6y4cJ5ErfSlJS6qqku
-8ss8mS8lM1Mp+lc9wYTWQ+8hmSUivAZb9WLEljFxhvEnvAKPwD18o7+S9GABFwYs
-xflQvKZHguaOVqBEksry+vu8okWNrg3Ll3dDQEeahr7nrLrHe8gqONJgOE9jjxRv
-bJmGtIUTyGqgWZZzBfQXL/6uXL23bWkYZDkQNhfsm+colAV8gpj+/E3q/uMXwqz1
-bv06K/LsK3NHzBNE57kJHEhg9K3Uw2Wx5qwFMU1GDxsB3P9p+TyqAboEZAB2irTR
-y9k8peFB7wwf0sW3Eg78XFsfy4gyV619VnBR+PbfOpKqFFXAodF1mFiIrPeefaVp
-F9fiQ5Owt0sJjDaJnYT83ksAO2Aj+VsY3UjnDrGFaiV8Neit9y/8W8DqmZ3EZEF/
-M3iS0yDjqqt9ACFD+jkGlKYsyHv7gbpTq0yi6u/kRXHUTIvVwFL9M6Z6AUcG8gzo
-qbKhXGfWKEq0lN5HAjJ//V9ro3DekFd0A+NQOlFV6XtspZwphVdtW1WS078HmVlw
-F5dbD8pcfT/RjYkCPQQTAQoAJwIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUC
+X0GOB2sX4Ox8UYkCPQQTAQoAJwIbAwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUC
 UvT9ZgUJA8NuBQAKCRAeNKGCjiB5AXB+D/9k/BzZdAczQ3/v7hKrN9y3/D8kOEYK
 rF8HdcBOH522sN6mqvm7wGkf3RmNSi731m6vzlbBSonrAT5KDMpj+THOmUcY29V5
 a1YOgFCCkToOfl+LmlLiuqfrGCJyE28MKMrsi2zMBKhsSxhvcI0EhJkQpPBu8gUs
@@ -48,32 +35,112 @@ KFJBkjrM0xn8H+D6qzwzGfmX1Yaw12oYA6pcai4aK5sO7KHt+THAxYAcVF7qxGU7
 lnDifM56hrH/DbE5InlDC8OUqDysj0cHacRee+ZYtj7TiEykWfP5RrZCLQ7L6Jd/
 HtgQti/9TVUaFkIlQCfvF+l4BYZQYvnhx3MVK7ChKLmy6AVQLWnDrBrDvl07HLvW
 6pslRzVHfWyIYng0pZ0HvK+MpQztCoUcDK470mjlpAtjNHuyKh6r6TtaiVK8MgbR
-Sx/NMHb1/PXQJohdBBARCAAGBQJToyd4AAoJEJwCrGKo9aTfErwBALArOyHjW8Wc
-knvNM1/gMfMd0FUk2PdaQkp31pNb1BGiAPjrGavSVPXANL71oqyyTqnypEXQL1sq
-/GMsjQUvDugfiQEcBBABAgAGBQJTjlvwAAoJEAwyonG9PMeAAgUH/i8DN3Fk74sC
-Bb/eQmUQBeYfNcNvItj4bR17om2R/nvxtNp/RYrJywWwT95rL1gmOwbNtGpTh8P/
-34bH5JbagPQZCq2TVVgOgPOa78ljhsx4iTd3jK/oYnJapkCm6JypZ88XudMu3bci
-GV6khpZ01KtzJCjV7hsF1HAogU815ivdKv8uBGa8H4og3ooEbE0Yc1byOCk6m210
-ru5Oe3OoK0MjV3F0b2q8Bs8Dzy0b+5kPdL6QCDgErx6TqaniKX7lqPI+GoCp2IId
-acWkhCVjCwKGsDIplruJ108BCV79FJ08ZmSzN/Qyt6VuvWghchPtPWwmCTG3MqAd
-jtyizNX75uOJARwEEAEIAAYFAlOOHPIACgkQQuhqKhH0jTbbcgf/Y4kHgH6abmVX
-6G5+JnTIqJUyXpgdrpml8apj+j2vlEwC4SfjiRTNY9ywRlwoVXFP5KMfOJ3UZowc
-oj/z5TdskAGbjjE69CWYrNR7frPKPsxPZxQaaRXWWvALGNZHvuBQ8986gYQCBC/j
-DXxpb2gc3ViuDKMEMzmv4a/qtWLJuoE/UVDmjXnVAK6BwmxrW20Cwj+3xd5riDA9
-yLYHYhbahWaefJpatTkBhuqgNRAUstropxcGp4rvO7iOPxiCG0Z843r+atAHzrjz
-/ffeggG4jL1YbPiYx7gDqi+RtFGNJcrKhiXLmcbWFUv2XxlEJQMypowkygmawIqk
-a08STHXAYIkCHAQQAQIABgUCU44f/gAKCRChtMW9f78Ds/YPD/9CnqvZ74qjGNhB
-oclfcGnRof3Q0qpUP/+HAXW8stJCFsWPoet5QtvB7KORFXNC00NWvfHMMq4KzTkO
-JOWzU1Pinm6MxCWUichkNwUyOTM3p/nRFe8jX1QTSIGKC7vZMTghZ6sUc0a9MUz5
-e2Zd7jj4b2IPwbvo0KeZLEW+zNk74lf5hSs/v+O6gy9SwrZrIKjTlRDQ9L06awhl
-aDRjjtYsC/dPKLF5DF79q5fRdwvl+TgSG/k3WNbs1K6Q/sxqpf4pl54L7sE9bMrf
-bU5+rX/pL96Kmavpw3S3k7cK8/2ykn/gMtRuGwdiubWoWoPXEMsr+VHQRU/mqnSz
-iJIJWNRhS/VUAUBDO74u1D3RK5vMC+MJKFCUwHuPhceqKQbeq6Ccxi5A3N2gyiQB
-NcuxcSEoOQ3q2KoXMaawXsnDILxxYgPIJn9f7g7ceZS1kz1WHzrCC2wJWLosQzfJ
-r+XhhL1LA4ZeHmhaIFIBq0kY46K05uJOllaCpN39P38Cb82qzaLVH1ZCs1zfU3q6
-KzH6M3yvXxVlU6X8he0+ycK63pAeQBqXxEfo22gWqudScjBHa3OsMDp1igkiZvwI
-6gWFbkRcSuMk94Wrvzm2WFx4ClGB5A65aTt9nIr68ipJvmOrAA43bd0zZpKHxQtP
-3lJznewo8TQ9ypryePMxlgWYD+6HAYkCHAQQAQIABgUCU6PKNgAKCRCEb/rGNK7q
+Sx/NMHb1/PXQJokCPQQTAQoAJwUCURLC3QIbAwUJAeEzgAULCQgHAwUVCgkICwUW
+AgMBAAIeAQIXgAAKCRAeNKGCjiB5AZBiD/wJwUVZjfNeWdpKrYy9HtZExtTcU/94
+3lgRUNinUuLPFU4i2s+hR3h5fzXR15nUD+IBJlXlzLV2G/IjXYPTp4a0gqHpWULa
+b5Stu7AzFiO42/RWUAzWD1Fyh6SuZ3FDERvheid8s4SXoe6y4cJ5ErfSlJS6qqku
+8ss8mS8lM1Mp+lc9wYTWQ+8hmSUivAZb9WLEljFxhvEnvAKPwD18o7+S9GABFwYs
+xflQvKZHguaOVqBEksry+vu8okWNrg3Ll3dDQEeahr7nrLrHe8gqONJgOE9jjxRv
+bJmGtIUTyGqgWZZzBfQXL/6uXL23bWkYZDkQNhfsm+colAV8gpj+/E3q/uMXwqz1
+bv06K/LsK3NHzBNE57kJHEhg9K3Uw2Wx5qwFMU1GDxsB3P9p+TyqAboEZAB2irTR
+y9k8peFB7wwf0sW3Eg78XFsfy4gyV619VnBR+PbfOpKqFFXAodF1mFiIrPeefaVp
+F9fiQ5Owt0sJjDaJnYT83ksAO2Aj+VsY3UjnDrGFaiV8Neit9y/8W8DqmZ3EZEF/
+M3iS0yDjqqt9ACFD+jkGlKYsyHv7gbpTq0yi6u/kRXHUTIvVwFL9M6Z6AUcG8gzo
+qbKhXGfWKEq0lN5HAjJ//V9ro3DekFd0A+NQOlFV6XtspZwphVdtW1WS078HmVlw
+F5dbD8pcfT/RjYkCHAQQAQoABgUCU4eKwAAKCRCMv5oyKGGnkL6sD/4+jhdGUEO+
+n20VXPWZ7hV4GzVezVV2yLHd3kCfG+wKQPtpY9Qxc+3gyI5rOKxyIp2sYh0xpMkT
+bEy7HjFJq3gFtAC/lQQfoncZUrGL6xsh6PmYx3MzXQteoJ/u94c6LXyZoYhYfSi6
+jv4/DASeIdxDZwaaVm7WRb/FcT54l1iazevjJp4h/+udPeGjsS2c9cUu2URJYv2D
+lxO6JyKRdv6H4e/RgzUmf5LJ83LLQ3V2BUrpZSnpw1YZkdUESNyNAKXfdAkNOTZX
+HM7BbmBSg7MSpaz2PZXgf51CfoKYkNtfyIppiTNxRlmImwXKl9+efQUOiWokuQGb
+683bUMRbq2S08CSzrvTAXuDLTrro3emAvhO+NxFQN7Lf5s8eElcTH/dDG12HlMSZ
+cQU2S9mEl/N+LwdOpOP84hHU7or6q5riUcALYIYPRcaU8O4QqHKPOId2G60f4S2g
+7hHVTi3B7IXCgSzusciSVCiol8Q5jqngBSu3qySjuGtF2CHaz36Qr5cdRSJSAPgm
+2mquVOdUtY87a4+662bHmf3w5Ma8cTjnoCntEmXL5YzxMmPWhCR7aNvrL8/TPUwI
+PFQfbG+CDgg5hgjJ+gM3tlm4x2LyAcWqJJSua6u58TGEdNKe3c1jJuub32/D0xqI
+JF6PA63sIIDHal1488NvPMI32HDITm8H9IkCHAQQAQgABgUCU44YbwAKCRC9aMeq
+mX+nf6J8D/sFps0R7GCzzEKgIdDCA4lAWj5XXa5PkGAoZAcPj0kbn3x+lrLtScjA
+oDXRFjoJpP+bqh1tBHvLPn849mIcX+jKgTh/HvSWSc4ShSt/4ejKagDUdxHzKipv
+H9A73FmVJI4DVTthjLl9d3EK2+de02jzQsHh8mzTjKJPnUUUI61BmdGyQCA+COaV
+G66tjZBMb8LuQoXQqgxpzYfDW3EC0IT5MdDu3wDFxOVCVLja0wPsOfp4K4XRsfkA
+Ok3AaXVt2DQv4LCEa02FfrKDrsJECRgWfiu4kxVzxR8A5O2ZgPreOh8sWRnDIt2e
+Mmzj651hB+W+ym3A9o6WoileJ3yQHfOqK+4gvreTzaQERtR3Bj2YgphlnIi/Mwbu
+ofjBhVbM+Zg55D6HS+g12xadxAsFJJ9Z1lhLINgOP+W6pZTU3zgktEc93IagU5Dy
+QN2d0nl0Mc9yQHQhYzpDBF2Ub4Czk7uFmTmRVGf8xE9VThv4WeTA60zuonh3hZGr
+dkgdgp6xrZ5jJs8SJLxXsIX1umrRSJxCxOJ4FfmsTRDtUlJdOFEg7qmXpjKYe5MH
+Gx8PnS6tRiCy+0JnDUXnA2hDBESSrvXcTUQ4iPTpWGluq3vicle7OmKU3Gzxu9VF
+ETOGZbZKEbdU9btswvSNaQ+Yat+mr9hJKEbXS1XS6srpT2FwBBhK9IkBHAQQAQgA
+BgUCU44c8gAKCRBC6GoqEfSNNttyB/9jiQeAfppuZVfobn4mdMiolTJemB2umaXx
+qmP6Pa+UTALhJ+OJFM1j3LBGXChVcU/kox84ndRmjByiP/PlN2yQAZuOMTr0JZis
+1Ht+s8o+zE9nFBppFdZa8AsY1ke+4FDz3zqBhAIEL+MNfGlvaBzdWK4MowQzOa/h
+r+q1Ysm6gT9RUOaNedUAroHCbGtbbQLCP7fF3muIMD3ItgdiFtqFZp58mlq1OQGG
+6qA1EBSy2uinFwaniu87uI4/GIIbRnzjev5q0AfOuPP9996CAbiMvVhs+JjHuAOq
+L5G0UY0lysqGJcuZxtYVS/ZfGUQlAzKmjCTKCZrAiqRrTxJMdcBgiQIiBBABCgAM
+BQJTjh+mBYMDwmcAAAoJEMzS7ZTSFznprd4QAI/TP9vUqTEm/4Rdzh6oEu7M15f9
+4ErZJHQ5vSR5Z5gzXy4TEnNrMcKLRcYPGLsNJYHxG/H0mCwckPLLSOHwiBjCMuwG
+458p8HjfCB49BgLwLjobuXuaOpOmIWIzgUU97ylSn46MI436HLRdcryghEaATXgo
+XkTdNX+2WDapG7nbMb7IF4rsvNSNMmgLsbXV2pTMk+wDDZZz3R3Dj/b1XA1aKFhV
+3aJU2G8Q1VBwmGESB55OP91IAWQ0LzQpD+K99GPNE9TdA42VLPruQ2Rw8gdP3CU4
+W4+KjgGyX/aFjJTsgid/XPnCWKBLSPto6t/vRePy5FqlzzwcT9rjVxXSFvLnIhMT
+C8tp6gfe9Bzx2VXjKENKhLoaYZZLlUkS816b20ebVCcBscjja4CGK1kwyMn6F6FP
+abTk/RcakO+M9+JlY/YwCaIeQ5nf15IpMJuBvV1e0Ex4STeIf9VGgL3+mVQpavqA
+wl4ks+knJssVF/VYx+doUpVKrj+h4nLM+OAEnEoBKPaOPTnnLPZNQupklSMapdsd
+rmkVYuzZFbMjJXa3kFyfynVejgeJxLOPOPbSpeOjOa39CjeE7l0MtN+tDzCeOqrt
+tK7h3sy/5KOfNcFp27xxlwRUWipJjQyRzxHKUyL1sSChdNTJozWnLiU3fOb7PUWY
+7YogPiVak9tkOiAjiQEcBBABAgAGBQJTjlvwAAoJEAwyonG9PMeAAgUH/i8DN3Fk
+74sCBb/eQmUQBeYfNcNvItj4bR17om2R/nvxtNp/RYrJywWwT95rL1gmOwbNtGpT
+h8P/34bH5JbagPQZCq2TVVgOgPOa78ljhsx4iTd3jK/oYnJapkCm6JypZ88XudMu
+3bciGV6khpZ01KtzJCjV7hsF1HAogU815ivdKv8uBGa8H4og3ooEbE0Yc1byOCk6
+m210ru5Oe3OoK0MjV3F0b2q8Bs8Dzy0b+5kPdL6QCDgErx6TqaniKX7lqPI+GoCp
+2IIdacWkhCVjCwKGsDIplruJ108BCV79FJ08ZmSzN/Qyt6VuvWghchPtPWwmCTG3
+MqAdjtyizNX75uOJAhwEEAECAAYFAlOOH/4ACgkQobTFvX+/A7P2Dw//Qp6r2e+K
+oxjYQaHJX3Bp0aH90NKqVD//hwF1vLLSQhbFj6HreULbweyjkRVzQtNDVr3xzDKu
+Cs05DiTls1NT4p5ujMQllInIZDcFMjkzN6f50RXvI19UE0iBigu72TE4IWerFHNG
+vTFM+XtmXe44+G9iD8G76NCnmSxFvszZO+JX+YUrP7/juoMvUsK2ayCo05UQ0PS9
+OmsIZWg0Y47WLAv3TyixeQxe/auX0XcL5fk4Ehv5N1jW7NSukP7MaqX+KZeeC+7B
+PWzK321Ofq1/6S/eipmr6cN0t5O3CvP9spJ/4DLUbhsHYrm1qFqD1xDLK/lR0EVP
+5qp0s4iSCVjUYUv1VAFAQzu+LtQ90SubzAvjCShQlMB7j4XHqikG3qugnMYuQNzd
+oMokATXLsXEhKDkN6tiqFzGmsF7JwyC8cWIDyCZ/X+4O3HmUtZM9Vh86wgtsCVi6
+LEM3ya/l4YS9SwOGXh5oWiBSAatJGOOitObiTpZWgqTd/T9/Am/Nqs2i1R9WQrNc
+31N6uisx+jN8r18VZVOl/IXtPsnCut6QHkAal8RH6NtoFqrnUnIwR2tzrDA6dYoJ
+Imb8COoFhW5EXErjJPeFq785tlhceApRgeQOuWk7fZyK+vIqSb5jqwAON23dM2aS
+h8ULT95Sc53sKPE0Pcqa8njzMZYFmA/uhwGJAhwEEAEIAAYFAlOO1jwACgkQxzKx
+0cKPTi9E2g/7BTEDp7obR4wWFSY0MQAWsLTbKe1bVD/fIYH3IXNohnl7uSA7t34K
+Mn++vYgBaucdSutsj9YDqBG5NXwp+UbWU+KUNA2fsKSsRC6ZMFMHPEef2kjmmMcZ
+ek8lQ03hILjEJFmIg4FQt0mgwk4ejsZh6yBETp4goSPdqAfVV70+mzdsHsNrBMGO
+5O2wk7ro7MsFv2s7HPKI3N1r8HXwxJa4mwpfHhQh2BiEIPmFnESL9D0tk8CaBKqY
+ypC0igDTXgx8AhV+kDcG3SSVU3y9AaBCjVMShvi3OmO+PIeQ6QOJ3z+9992enqAM
+mjngkA0nACclVttNzkdpljb7Oz1ootvoL6/Npj3tbZ3EoawOoHZ/Mhn9W5ncjTqg
+6Zzs9l6QyoIMu7ZSJQViD879oPO7Gkv4I3Q/89dQ1yXRvHdJSctrMCpFg7VGW59O
+DMNksJGdsXkrn6ynyTfNZCxDP8wLXw9pAk79yopTZ44y0TTKzNOqm8K7scOxvcet
+ZC6yyZQmUxul0Z6pp9NzomigAp3qUGOt8k2cp4V8LVj+FcR5sU6Lyk+00mDfr0qJ
+lUYwL3nJvxFc+B+tDoM80QK1p08drZrJ7bc6Eh7JgNezu0wNiAQUqxdgWOPjoBL0
+kIlJXbHxAv6j8JUj9NemdaA99AweW1ezwZtFIXjpedQdkodRPzeANbKJAhwEEAEK
+AAYFAlOQULEACgkQ1FUjZ27WELeQfg/8C9Tosw7E7+n8fo2z/P/w6XcjvfGGoGAg
+MaF02yeVkC5E16VllTBzY4aPMsPR+XfR0BK9DZHcglhEHaKHGjh/qaN9PI3gIodL
+o2y5hgtCYxTMeICmHRsqh/1biMMeKHT85ZpoHDA74wB+8p7oY21941aUZM/tKkpN
+uE8mriFxpkDB1A+vXe6G3JJi8z0S7QWT/2UleVpo7eXihiC5o3AZmQHXuTyF0UXn
+8zLYLHstJpC/AFMi20Pv7jUcroxr3BLaJ23ai2ks15UueczgHLzjPyIg/4zNawpD
+fX2r4whbWA/+KC7VyAkR5lQ4i438bKhPPmYkbAP3g2WHqow34dXNaQm/eSLz/+fi
+1l3UtgjpNVvxYHj5Sg7q5bz0ZkTjS+jWsc/sIb2lPlwL0u7i7+Jb7njlbJqaiNPZ
+sIoM284SKTj9oWrz9KOqerRA3kc4xFH2oh8Acqc+h67MiNCOnHUmKNgtZobe10qT
+GCYhCV7CDp7XYZikDGeUyhri2sxASRVruHGlv9qKGbmZyNmoBPhjhyHtY6HZg4lv
+SOaZSJ47fCSfTN712sJE6pArsMK2o5hI9Nh/4LgmYiDQYwYGKhB5KeRE82jyATvf
+/om1EaEcVD0QyrF4oNcHioNcznQNFhcP49DNjVWTdqrgxQ6vr4+6avwAW2wyOsW+
+cpShmueTf6SJAhwEEAEKAAYFAlOh6LIACgkQTQVh6fnb7hNfYhAAv6dqpWvHDuF4
+QtNxk9vUUgV3RFPIxeVKf5mI9RSU+9Kk/fxSxmqnAXhghqN1SAZyw4jh1A0emQNQ
+xldoXAq9G8I539UcA0qQMfoH5YzD21CRNlgHJ/f4fexqZM9aRiMmVGJiAkr7Ih6u
+HgLohH0Qjfa02GL/qoxNpGiBcpJ6y6KLuNMi/E572UYugxsYdnRct12jzfkErGdx
+rRZlwNsZHdYszxnTCdS6zT1jp3IY5yO8gRcrcazJUo0HK0CEs85nHM7JesVbwkC9
+Qyg1Tn0katx+7NGm22Bytk4sMXnZ1OUcRC1zkGFAu5KXaSPqrLEsdM1sXQuxaXjh
+G0GeIflEzuXTNsSPS0UwAirvu9/hjsh4yEvvYhdmwaSaB9rZqIlJxCtO8VPcNXYo
+Dz8UEiHxQvzVmm2d2PS/LOXnyod3TdFnM6McDVmb4qiJPGgS0ZBIeHH2wla1cqli
+zWK1nCSL+aBPDJHAl+7U1WmokCVJWC4TDarjOnZauEMr6VRKaYE9tAQsP1h/EWtO
+J9NSkZRZN6eBCnO5PREw6pznR0IR5ciwQcrYAecYKadwyFl7KTKFXCWV/7v1023U
+Q8QunMsATVISQH4VWPDl8ANqy1vqdSgYv9g0/ho84dBWbXmlMmFGuySEwg2KGeYY
+1hWgmIfRLbsoqxWdrpkpD2+qAZDYSm+IXQQQEQgABgUCU6MneAAKCRCcAqxiqPWk
+3xK8AQCwKzsh41vFnJJ7zTNf4DHzHdBVJNj3WkJKd9aTW9QRogD46xmr0lT1wDS+
+9aKssk6p8qRF0C9bKvxjLI0FLw7oH4kCHAQQAQIABgUCU6PKNgAKCRCEb/rGNK7q
 P75REACeQFrfO0xSXZysAboGdzv6I7ZE8YYW3/rd5+RKY/m8F374MXf3YN7KiIdh
 g71h/sN4/lzgJl48so9B86Z84pmUOGPVaIGmqzDJBGBY1Z2ULU+sagy8ti94kdES
 LLVencI/dQXaL/dxoOerMgULGjNvuftZNFebwMdf0VjUCvWkV6T7pubEgyN8h4Mo
@@ -84,234 +151,166 @@ VAnPhoFFd5OIzmJikocfYZkuuIw5EveQ+l5GAroO4TytdfGwYl0KhNAqExgbkWT4
 UVQwin24B+1MHN0Iwqg9zupQI0+IjZeWyzkmuHek6sphXC33HarRYeytte2HP35w
 MmALHeADTVrngSCsckzbVL5GCV5voiLaplqS4vqE6liqW1pEXWOYwfoPipyVDZxZ
 d9EsmErW4FPotht7rWKeizZqAdyQQft07dAckwKF92bG4cez3fFvW1hQKYHM61a6
-91qG8TRybZvnBh8aemrS5o8QChTk0UFQUjpRBbAOb+ayf/dgjIkCHAQQAQIABgUC
-U6V1nAAKCRB4YIWsINNFfeXiEACXy45MLSpjTfAF6xuxtlN2zBuo7gP3VNboIq0M
-ZcD1yxRIhSwKS1QAeWso2a7YJ6Kzp/HG2hi60Zi/Hd1vXSnNYwLD50GszInc8iNA
-2OEZUuDiw7c65lWxOdjc9jbnd4tbEBiupfqZ/15R+R7gmeOVElW5d3owC+ENgbPO
-hmZ3AH5cx4QdXtmPy5oWpHyU13izxvV934aY5OXcvsCYwIt7DCISEgiuPJ2azkzX
-7ak8C8U+diHF5M5Ps+6nBmNQ9bpHHwZ7hZOUQGs/1UW5cEeWwJEMcTEPLwvs3qjt
-K1L/k8DS6t95hr7xiNiyojCpC4L1XwT05MxGHKwY5qXMw4bqInyGsnf28NuoaUk+
-V+fqIS6uC+p7/D2l9RU206R93vGTOwIxxEaehy8i7GadhiHOKGADm7yatlmOJfMx
-+9D/X7q2wWB+t0Hu5fr34NwEaMfJJgjOHhLqtBiuPsrr6D7+sNKIXkZcJNKE9nf+
-Nef1jygPjDF2O6AcHl2P6vPoKUwEAYYUyYB2ku/pm5wJ3V1bbXkTsYse8bWCUf6j
-SSWIacIoHAXtZjOe3BhKGKxG84h/7i/054SYI0+IIuec3zwiy+te+V5cyGbutaVg
-4WndnH/j27B7oEWmwstsu7i0EIO1dw3WwjhjiXsflaseWoB5LrOHaHpRccEeiRdl
-lka4uYkCHAQQAQIABgUCU6h3iQAKCRCDgslcKQI9+WQgD/9kFhcS5qu+l0RsHNmK
-fhk6RMlnPs0jY6E2BxdXbJaNBFN1NW3kIVNYPFflvazCowBP2ek+gtiJW5/uH3C2
-FAW//Dt2pVcjRN8tIqqrvMRJxLQEP2zJ1YFKnbYl30+ehHWlUUyleKzIBA/6GbiA
-ig/TbaA1cOgZNVDdtfJUxLphzNZ7FGatfjkKEYP8+xd/3Oj/Wba8F4cNhMUbsV2q
-Os3nXlnVt2hKVB9kOpUJQdjlJp3DKbim6uj/sLs9KRLdBfhrezd2KoIpvvGDo/V4
-xqdhW/J/vwjrISOQ05YsrCMOL2O9/Sdron+gA1zm/xQfC9k/Nv6lcCaOLywdcaYd
-3XJqXZBuZy5KEljm5Nyo4Hxhd9ZJiXw+pMzX75NLZr6XnZz7/t/8FbRKhlHfAl/6
-hoPK3f31os8KHyj6YrqGDGg8dwvhxMsHpPlvsx4jpIsbcE7kTwidvhJwe8qet4Xi
-cTxnF43irlAk0xIbmxnSgH6XX4G6vejPsqr89p9pCWLjURTT+tr+U1XiNfehomdh
-DUYXZv1Sg5pK2HNEqkGKQTsjzb29t6kiGA1JsmBCPP5SPGdHDagMfa+VFlT/+bmw
-Wsad5R+f3vhTQJ4GBcpBgMpQwEX5wHSGs7dpKxUaL2kinRR7wBBtPLO0P0GLJ6vf
-kBhrtfA4gQCGqT+cOEdHlH8gC4kCHAQQAQgABgUCU44YbwAKCRC9aMeqmX+nf6J8
-D/sFps0R7GCzzEKgIdDCA4lAWj5XXa5PkGAoZAcPj0kbn3x+lrLtScjAoDXRFjoJ
-pP+bqh1tBHvLPn849mIcX+jKgTh/HvSWSc4ShSt/4ejKagDUdxHzKipvH9A73FmV
-JI4DVTthjLl9d3EK2+de02jzQsHh8mzTjKJPnUUUI61BmdGyQCA+COaVG66tjZBM
-b8LuQoXQqgxpzYfDW3EC0IT5MdDu3wDFxOVCVLja0wPsOfp4K4XRsfkAOk3AaXVt
-2DQv4LCEa02FfrKDrsJECRgWfiu4kxVzxR8A5O2ZgPreOh8sWRnDIt2eMmzj651h
-B+W+ym3A9o6WoileJ3yQHfOqK+4gvreTzaQERtR3Bj2YgphlnIi/MwbuofjBhVbM
-+Zg55D6HS+g12xadxAsFJJ9Z1lhLINgOP+W6pZTU3zgktEc93IagU5DyQN2d0nl0
-Mc9yQHQhYzpDBF2Ub4Czk7uFmTmRVGf8xE9VThv4WeTA60zuonh3hZGrdkgdgp6x
-rZ5jJs8SJLxXsIX1umrRSJxCxOJ4FfmsTRDtUlJdOFEg7qmXpjKYe5MHGx8PnS6t
-RiCy+0JnDUXnA2hDBESSrvXcTUQ4iPTpWGluq3vicle7OmKU3Gzxu9VFETOGZbZK
-EbdU9btswvSNaQ+Yat+mr9hJKEbXS1XS6srpT2FwBBhK9IkCHAQQAQgABgUCU47W
-PAAKCRDHMrHRwo9OL0TaD/sFMQOnuhtHjBYVJjQxABawtNsp7VtUP98hgfchc2iG
-eXu5IDu3fgoyf769iAFq5x1K62yP1gOoEbk1fCn5RtZT4pQ0DZ+wpKxELpkwUwc8
-R5/aSOaYxxl6TyVDTeEguMQkWYiDgVC3SaDCTh6OxmHrIEROniChI92oB9VXvT6b
-N2wew2sEwY7k7bCTuujsywW/azsc8ojc3WvwdfDElribCl8eFCHYGIQg+YWcRIv0
-PS2TwJoEqpjKkLSKANNeDHwCFX6QNwbdJJVTfL0BoEKNUxKG+Lc6Y748h5DpA4nf
-P7333Z6eoAyaOeCQDScAJyVW203OR2mWNvs7PWii2+gvr82mPe1tncShrA6gdn8y
-Gf1bmdyNOqDpnOz2XpDKggy7tlIlBWIPzv2g87saS/gjdD/z11DXJdG8d0lJy2sw
-KkWDtUZbn04Mw2SwkZ2xeSufrKfJN81kLEM/zAtfD2kCTv3KilNnjjLRNMrM06qb
-wruxw7G9x61kLrLJlCZTG6XRnqmn03OiaKACnepQY63yTZynhXwtWP4VxHmxTovK
-T7TSYN+vSomVRjAvecm/EVz4H60OgzzRArWnTx2tmsnttzoSHsmA17O7TA2IBBSr
-F2BY4+OgEvSQiUldsfEC/qPwlSP016Z1oD30DB5bV7PBm0UheOl51B2Sh1E/N4A1
-sokCHAQQAQgABgUCU6Mo0wAKCRCl5rymKbpBJy+OEADI3UuK8K8IdayCpC9UOwuA
-/LDF01RW2EoogmwLywSS0ipf+D0rEvH9EtqXbz2ibOBhZIxtYzXXEx0Kx3fnYQvI
-nm8wdnc0650tGMCyU8sBTaV9B0mdYakMmQZc8Hbwd88fLnwEFn+qHJ0ac31geIxD
-N7vfgKeqea+4VGKnNbG1h0bRn2CK2pccnp8sm1eHJ/u25X05Z0Ofrx4It53OhO5R
-TSHGhHM62+48FcdEYtm6jPcS6RY/mXWBWPJsjmvvtQ+67PfJVHVJMDVFJV98PSqL
-bD69doz+golpESEdO5uWrLJEXMj8O154HQg5xnOXWurzNG4FdL6eeXk7+1UfXSXL
-UzGkaMgB6HjNTTrjJG19B/+9F4nbItN2EOJ4lVEvDCL5uE0CBxvG9y04dxzI8jCg
-1/hPjYyd4Qb7N6CDDoo7M0lhm5QSlDa0NDfaIpxEPBtcb0wOKaJUHfDMertl0mWv
-YbPhP5Lftq+h4syvQ9iu0gitGCGW6O/GXH3/ZhnyjVJRJnFkcYIeckKXVK7aCEty
-S8adffjrwYvH681P5d+EwDxY2B8UJE9sPx+Bz5mpsETSVbm+aA0KsCwc9jLnJcDB
-84/7ovuRXdP0C06Q+YC8fY8QQZmIl/bkzwAWWyZVSw4O9/3pWnjXvqSu/6xOSVfF
-0455bMvyv+MOiTlx8NqfgYkCHAQQAQgABgUCU6f59gAKCRDfoyRRwJ6+uqx7EADL
-COXDrUmHbHQzOn5B+uVfDQJrtVz3jNFdHb3p4qRD01tJ67/GhcoZ7NUVo79ELuWJ
-alQaIM9agmYZa5CsJIULRI8JtalcLRXCxFX4ls7L/XRRO0atwzpt/K9hao6Taewp
-+J0Vy+TVLVeh2jcajRL6DfrlawMDpD2OxDw16KGMZagmNoWcuMZqK6PRXBnFGy6l
-EL7+gCy+vHe30nl9R64qMhTxnpCFvK1UCk2Khzz/7nUNwXw4McU2KYnU7AiSMNdf
-PWv/AW0m0MyWRBLmEy/nen+hIEmoxIomifroX3PuyChjZ2FaNWs3Kb7HKhXGSeCl
-1UkLBPeZa+obfP0D57qODeXMUxny8yOGOXOrHlRhdJz01qZ9v0UCfwnBJo1ewLaa
-cJ1l5Va26GwDbCh03mhwSE+AWXZbVTuemzUS5QBBYzC+SBxSqF+sE1hFy9okReGF
-Y+AjsjI+uu3A9ht3+vmvcgLWPyvkxIVksnvcmPp/k2RLkyk/tQWA31pNRMyqaReR
-esg4mFszKEtbC+tFVqucpCxd/Rvvvz918lkEFjIPN0yQoRenb/bKB4i3jbKIKMnJ
-zCsNeaobdpsNcAdl0DOpLMfo+RFzheQnMkwBQgI0XNxz3ZNMPN+BkEFWs7u7mfpK
-k+ZnU/9fKOyrOC1z2KZwNhjOF9oHv+wfa3ZQ7I/nkokCHAQQAQoABgUCU4eKwAAK
-CRCMv5oyKGGnkL6sD/4+jhdGUEO+n20VXPWZ7hV4GzVezVV2yLHd3kCfG+wKQPtp
-Y9Qxc+3gyI5rOKxyIp2sYh0xpMkTbEy7HjFJq3gFtAC/lQQfoncZUrGL6xsh6PmY
-x3MzXQteoJ/u94c6LXyZoYhYfSi6jv4/DASeIdxDZwaaVm7WRb/FcT54l1iazevj
-Jp4h/+udPeGjsS2c9cUu2URJYv2DlxO6JyKRdv6H4e/RgzUmf5LJ83LLQ3V2BUrp
-ZSnpw1YZkdUESNyNAKXfdAkNOTZXHM7BbmBSg7MSpaz2PZXgf51CfoKYkNtfyIpp
-iTNxRlmImwXKl9+efQUOiWokuQGb683bUMRbq2S08CSzrvTAXuDLTrro3emAvhO+
-NxFQN7Lf5s8eElcTH/dDG12HlMSZcQU2S9mEl/N+LwdOpOP84hHU7or6q5riUcAL
-YIYPRcaU8O4QqHKPOId2G60f4S2g7hHVTi3B7IXCgSzusciSVCiol8Q5jqngBSu3
-qySjuGtF2CHaz36Qr5cdRSJSAPgm2mquVOdUtY87a4+662bHmf3w5Ma8cTjnoCnt
-EmXL5YzxMmPWhCR7aNvrL8/TPUwIPFQfbG+CDgg5hgjJ+gM3tlm4x2LyAcWqJJSu
-a6u58TGEdNKe3c1jJuub32/D0xqIJF6PA63sIIDHal1488NvPMI32HDITm8H9IkC
-HAQQAQoABgUCU5BQsQAKCRDUVSNnbtYQt5B+D/wL1OizDsTv6fx+jbP8//DpdyO9
-8YagYCAxoXTbJ5WQLkTXpWWVMHNjho8yw9H5d9HQEr0NkdyCWEQdoocaOH+po308
-jeAih0ujbLmGC0JjFMx4gKYdGyqH/VuIwx4odPzlmmgcMDvjAH7ynuhjbX3jVpRk
-z+0qSk24TyauIXGmQMHUD69d7obckmLzPRLtBZP/ZSV5Wmjt5eKGILmjcBmZAde5
-PIXRRefzMtgsey0mkL8AUyLbQ+/uNRyujGvcEtonbdqLaSzXlS55zOAcvOM/IiD/
-jM1rCkN9favjCFtYD/4oLtXICRHmVDiLjfxsqE8+ZiRsA/eDZYeqjDfh1c1pCb95
-IvP/5+LWXdS2COk1W/FgePlKDurlvPRmRONL6Naxz+whvaU+XAvS7uLv4lvueOVs
-mpqI09mwigzbzhIpOP2havP0o6p6tEDeRzjEUfaiHwBypz6HrsyI0I6cdSYo2C1m
-ht7XSpMYJiEJXsIOntdhmKQMZ5TKGuLazEBJFWu4caW/2ooZuZnI2agE+GOHIe1j
-odmDiW9I5plInjt8JJ9M3vXawkTqkCuwwrajmEj02H/guCZiINBjBgYqEHkp5ETz
-aPIBO9/+ibURoRxUPRDKsXig1weKg1zOdA0WFw/j0M2NVZN2quDFDq+vj7pq/ABb
-bDI6xb5ylKGa55N/pIkCHAQQAQoABgUCU6HosgAKCRBNBWHp+dvuE19iEAC/p2ql
-a8cO4XhC03GT29RSBXdEU8jF5Up/mYj1FJT70qT9/FLGaqcBeGCGo3VIBnLDiOHU
-DR6ZA1DGV2hcCr0bwjnf1RwDSpAx+gfljMPbUJE2WAcn9/h97Gpkz1pGIyZUYmIC
-SvsiHq4eAuiEfRCN9rTYYv+qjE2kaIFyknrLoou40yL8TnvZRi6DGxh2dFy3XaPN
-+QSsZ3GtFmXA2xkd1izPGdMJ1LrNPWOnchjnI7yBFytxrMlSjQcrQISzzmcczsl6
-xVvCQL1DKDVOfSRq3H7s0abbYHK2TiwxednU5RxELXOQYUC7kpdpI+qssSx0zWxd
-C7FpeOEbQZ4h+UTO5dM2xI9LRTACKu+73+GOyHjIS+9iF2bBpJoH2tmoiUnEK07x
-U9w1digPPxQSIfFC/NWabZ3Y9L8s5efKh3dN0WczoxwNWZviqIk8aBLRkEh4cfbC
-VrVyqWLNYrWcJIv5oE8MkcCX7tTVaaiQJUlYLhMNquM6dlq4QyvpVEppgT20BCw/
-WH8Ra04n01KRlFk3p4EKc7k9ETDqnOdHQhHlyLBBytgB5xgpp3DIWXspMoVcJZX/
-u/XTbdRDxC6cywBNUhJAfhVY8OXwA2rLW+p1KBi/2DT+Gjzh0FZteaUyYUa7JITC
-DYoZ5hjWFaCYh9EtuyirFZ2umSkPb6oBkNhKb4kCHAQQAQoABgUCU6xtjAAKCRCq
-aOzI6YAJU6erEACj8z2iMep2PzgcnpHz8csKlAmTrBRmNgErJNWfSPG5Uw1wvf6R
-zcD5iZ9D9Xu6SCcZ0DVtLdho9Z1/Zb22ocOxTBd40DkryDdO9ANSHj/bw4tYzTtW
-mftoU5qMdD7nQgp+2fMTuptASAx/WK/n1tWam9XyM/i9fdD4iu2pzbBdX0F2RgmM
-S197fQgAAVMfDDHjgquiyGBefCaMxv4FEM/Omn5ipkhrmPpsqTmZJNxAusiOiPJS
-+pjl18Xjf+VKtRgLtr4pu0y+NVVXmI9IvncFlR1viyaKDoudB0K9UXlVKUURP7am
-bdS/yginiVbgaZ9Tx5STFC1FYKk69JdouvzYQc9vWW3C0cv68GWivpdFQMHrDAjA
-y9rFpeqs9UBbHpxCQ38ReoYDyxL4QJulEv3HpIRRt+UV7NE+3+Ln3a3/nTnUKJZ3
-m+kX6qKh875Td1OBZAmgfy8zlDdd50n0bQjSt8/DZsRdpFq5LG5vXA80Y+Tpn3i0
-jTJ37JGV+7+Yxb3qXM8XY0DFnn/cf/BFbbqLwEUxalooKp8eOO1G8yW8kqBdxGe6
-I1gJEaht5hkbrh7LOzjs22Tyz+DN6uo3Lm+cIu2YmC1j38x9LzVxUJHIxFA0XTur
-wsMDMB4RvSs+jdWCCdkQM+1StiYeYDC7+dG2FquqpbsFl6fsoICKCksvVIkCHAQQ
-AQoABgUCU7TR8wAKCRB3w9S09qPTPwxAD/9Yt9gFoQptDzAEEzbTICYmA8zj2fyv
-PmSFCYfMQfAEOH0oJerU7ux/7zr3XnzekFd1NPomHhJuGBLyftHYJvird9KafLzn
-BW8NB54kCHARHqdyqQYoEs1qUIuBNn3TGW+7Ao1qjXkUr59PzFqILJH1aCYelgy/
-NN81NNTESw2in0xZ/OliVGZuXtTbYiS4js0p2bkPfzT/f8FeMGwzAX5RrvP7of6l
-W2U9pslpUf0g+3m77/G3nwQkV70e8NvL7j9Q+zkH33IMlnrbDPiIhwgjnrtokUbG
-bs4XHyhFZxoSMddOy75lRs3YhS+vGIEvfLo/P3aiMIDLEupdYR6ZbYZxCF2y/+h/
-KKgypirzK3Z3zePA3KQeEIvlq+vo0nxJCyfnj9wzM7AJ3IJKzMkvmvYSVqaX1OCB
-aTLeTUkpFUh4Nq2fv62RRtlRqdIzish3bqlmHwFBApQwvm0/uH2k3lucl9Kz7S+u
-nh1h9NR4BVY2l+f8Oi4T4Irut3qJnsrZXunPBMJrKkPYU8iKEVmSM6E+M4T1yGoV
-se3JAIFpDVNHlZfckOYmqYG3NAvuralw3mis/eaGlnBrBI9zp66FzZpoqaATzz6/
-EIbuZ2vs47xIIgVUoW9NZwGo5igYhW9ixUURznFDPRrg5+UfoBoCcQ4i2wVvciqb
-TaetJ6+QuqCadYkCHAQQAQoABgUCU7u12wAKCRDnvXCXmESXmUfAEACrMuez//Vq
-yvynY5ADBUMytq2jrK8GUqfbxDOzeRe9++16xIYJZ5qNsdFBL2ezryvuafcPsIqM
-BvwucEJ88jU7/BaUClJo2QPD+WLUit99J/O68DTi2m9Jxn+EUi/L2d0e+Kcb17zb
-Efbcg42+TZfxQhf1kUWLH71UsDwAiiSnfy6dkIDgwPnlTpuerRmsgI5dkFeCt8bo
-YFRXatVrjzJsX6rBp+CEasAXHuhAQvIoqepi3CTAUo5gPHSF+aldAD2SRw3xegmR
-nJkKNOYu4RfCUi3iRLV7Lm898pL82659jSUQMo7aZevwhaKQU/gm0LBbXHGizV7J
-uKyYE5vzEpAEA+ChOntE4dcsN2B5m81lD0ra8HbbqTO2AVlp/BJxNueGm/WdYHXd
-pGwLvWWBP5ZMqaPhqBdQ/5DMzkeyZnSBjykMNIFQIi2jRLe6/poReh9ieIuzO8QI
-MA4X3QTsRv3qaF/TkjTzUpB0x13fXWuyp4mrSEbFmsgMEdsHqOLkBAa2w1RLgvPQ
-21FKewWyasv2T8NdvuZT0sARuirvxLMFrb8fMC4Ly8xBhXVbpWpFz6eo8leygqSS
-NSsMzzCtm6yJ0sO9ufQWrQZMmcqV5ERGecnjYJ6QCPWEC+xCKGS2W4PmnkO96alE
-fDjEKsA6uGi4z1FYvx9macKX35Hx1cXsUIkCHAQSAQgABgUCVAJs5gAKCRAIlNrg
-SWRisWpGD/4lp2TRzpJkSpn/MKcMDPjxu3eJbZLISDHeerVhVU7BpyaxUpAHaFyv
-5eTi2SoTXIWPFUGzZXj0kREmWBQLk/OM2VcLpN4oSt2b05TPWNXatIve6Zlg1AMJ
-Xz+i7iTTLCgjYUhL6uvfIczX3Khx0VwfOZ1xT+VNJqyXXlL/eONc/+a/VB/ZikvY
-789VfgS/Xq3JTNQpUnGFf87YBrThd9xLsaVgpTNhmOQpAEHLaZIRw778roAcQWyZ
-+/apIRuMUcOyishyT9p68DDu5N91TYfXayy2ckgmAt7Cf6j70YT9Xc2u374F/Avt
-XHHlnX3/hTI3cVKF+Wio8L95aM4BDmoHkk/7x2S6TUiHDiBQnLgSuwLdYr9eQKSZ
-Ijek94y5nz9KabKwj09vqW1b6jbt1eEsoeBdFGfL1GgmrSMO/erz7a+KrLgn+4Ld
-6GB/dLLhPCbf1ILe6oyThzvt+9vGsUqSNw6R3O1J1VYZBBHaDMZwvLRZcYOTfdpX
-OtmV5mNRCvDHyVR1OpsAY9m7EpF7npsgJa3UD+kaf9krVvua+aAR1Cj462M+UAcF
-FTOBQ5PciWtxKm6R1tFI23K9zqIGl+7VnrgiOiwQdEByFtdOnAOcbXf+iCyYZY4i
-v3ZzDt5ybREdPxgf+6LUVoKBh+Yy70ut/HmEI0P1exJc3k8ZoZtQUYkCHAQTAQIA
-BgUCU7GS8AAKCRAjY4v3LFk7wWflD/oDgQNEhpD6EFFCQ/y3g5PtOVjeF349vuTI
-XcTcQI657s7K5ftCYgWu1NNYUyLFiQJ1siRVZCqq39k7SIG3+4X9mUvGubqXog3+
-YZRy4FwnLGizr6PwEHsLeHoFiGAlbyaBrojgSgwVi5sir7JsH2PugxEFCZj9l6F3
-RbslBpDW0QwSsdenw1GQJrejZC3HkuE+D0U2cQ/YMebUaKiIi535H1N1oimcVpow
-RSX1NoyYI69w1JSyvc0fau7KfQua0+iGhyicL1BecGPKF+YIns6fuunnZuwsH+K3
-5cUu2tpi58bO42bbfirpn57LF/a7+o2pjUSMzez06aUqS4WZjw47bnpIm92gUarM
-41ExXuXLXZlEofeiUnWbVkJ5+MWeBKEfTBeqHToESEYoFSVgfszCR/0hQNy7E5AD
-OPorbvJaqUlNL6/cDURnQKe85QFi8y+oOzEkf7D6XvouMGQyxsYVjHEpEZdN63ev
-Te99Ir1nFc+FUCgch0wLPTKlYDpQBsYiZRYrZMG/pvKvu9+ig2sqRjI6nlARN6Ho
-cMoAGViK23JGikC5B15lblCGTL8bmiDMtd0+JccCSLv7dAJI1FSJEFqyI2CAGm0R
-j5Qh2/Zfu6XlsJdlnaCIXsqMB+5N50uXY4VuZ0L2+cokpYm+Pn9zJBFyxX3C2F7r
-1Vsuysds4okCHAQTAQIABgUCU/Dt2QAKCRBtnoZL9ilTXmhID/9PzhdXfJKYQLzR
-9/NBX05SlWVrQU8KOA4KtaOE9AVCVgD4bcIuH5Sf437xtaLUChw/x112y37kT6i8
-+NzyedmLjXvZ59bmaUEzrLw3aZUZ9vNdkLeqQgmk2t0tIfQjVssv3qFqbHmdRT3p
-XqMRz4JzyA8Q1ogM3C6Ng7qv1bpQS0JerfSchGrINGSRWIrbsguhmAIiJ/Vt0X8y
-ALzqmg6kt0Lnz5VnG7dMpIfDqyef761o/wbAvVx9WphEmlCqiMd/r9kThQT2rQnq
-jvi2pFnUEwUj1zQf7ArpErcB50OfBFh9o4OPt8BPYdOkXprsIl+MI7Ax3C+Nu08+
-jtyKZxTL4gQ6lBvzjQyseX2tmw3LMd4nekrJhifF406zUY4uDEVINLyDCOyaelKz
-SsOk92vHD17s6h33PxyS5oUZl8ieM7E7s2ibJAa6BAKWXBsQ9JTpKDb7csFz+TOW
-vqsUMQZVGiINe/YAfcGQWLOK6NHbEnIOZ5dRSPXKxmWyXKe7KvZBRNExZfE494/Z
-hKC+Z9/wRRfg7B72fkFghwuwuxsmjuEv3DXXqfLeyGgTRQgF2LnFAoShjrJDJUE+
-ZCtZ2cmdfLDy9wdLZ0cRHbW26FzP26MUxiQmeOUiJnh2F6uKuF5XbFHipKVmSz0B
-cP0rNui1+Rq9Uc+jJunKkuGZ8QRTDIkCHAQTAQgABgUCU8F/NwAKCRDYolbJslup
-1C3WD/4kJ9NqhgjBBdW1Qk1VimzcDnMu2HRJOSYNqp/UVV8DRoet+f+507VCYaNg
-rczhKUra8wHQjiXg5blBAa/Y4rXxSFP+Yhow4e9DM+0CW3SLWByxXkNfGFtAufla
-OFYqbH6fn+1T2meuktXqVZroK2gXG1SDKHarg/XAK8QN1ism+tuGHSaO4ry1WLy8
-Ok94xPG2ca+2ViRhZm9FBqX+b4++3sIwycWIoo4MV7QzmFAJR1YxD2neSFp5hul9
-BgwUM0RLwW2DfbKB6fBCwVsZBBYRNs3gyrBAguZHi1hb2KGnHZAEgY9XEqfFlUon
-2A9VGs3MEq0eO67MpRNvcuVWr79i5stQL2FSj2+U44YlpOjY9zoqQE3ISerOQ/cj
-7ryqogQqDzbC8C9MPHCKI+2k6CvX2Bzk5HJWk7KNOM9n94VAiRD8a6NrpBTWrql5
-DSF46cVyQhUU56AKEL10tYBbtvm+QkhFvUudcomCxY1WJiNqOZQ0wO18Lw8gyNsy
-mEaija3z/ANIbGUQOQN4zqKOJ2TrhrTrZ50JUO6umHRbmObMZ3Y+G/R8WhgKs5kp
-JjZsvGnCNmi6cVeCKbLWtlevs0S5lfLafVX4/rGSkrD4TJk9mgzjLygYWiKqygmI
-2NaIKWslYua93V91SMSeSCz5w3Qzc1SRPjLJaeyNEX+cnO1aYIkCHAQTAQgABgUC
-U8kmlgAKCRBDYhta0kTdB4ruD/wKAy1lg71RR5uVOsoeM40WKCkaqF/G+9RDRtYx
-Xaj6LKSv7CQ3dVDuNlAbJXZOt6j3BPFtUSvcZaeSRtvuF3oQDJF78Zhc3UpMEpgc
-s4k86OOaspNAwb8B1clh9Yf5qCingQp3nr63a75d7d+5O8hDmqgREqsVHI4XPFz+
-/rlEQrwxkWaK2ht7fP2ARLCcfWccr9m2k4zPyacgjc6u7u3mdLcSiADsVcraoqBI
-aw/VLP3VBi+cv0B+Z99RBbvGgzdnkY1kOESEwmXJAMwv5pwxBXzI0ooVzMJM1pbG
-Tmec9pB4z3FzShsIwISHV+Z9HPsO+mkJ4W/LhGUZhrc9Fas+zk8loqCuI4u9hDoo
-apkIwwBgeR1O/GeaNwDU2qLYRmmv3PLATv+bi4qmYXsLbOMgvEEM59WqJxJMGx8Q
-mavFprVCRaO4yTsqIh482wFHbOHSZLOXGpzxggaLvveIVTncUhpFVOumCxLblOV0
-dyqjdCY0xQQC4YiBN4IH+3u4uwEG34htyZo6US57ilXxCW7nBDVFsKGUpgm5gs4Q
-USIfK4bpFOVOfKF9tyTzwF8NM10HB4HP3AnglgNCsxxoWhtY9H9rqwVxdxBfSmtx
-ureQFSVNUy6JxyfJrq+Io3c3oAIlCAJ76IMal7p9XvF2uMsVDnfkvSvcgF3Ba8U2
-AiJMYokCHAQTAQoABgUCU/yTLAAKCRCL3If7chXhiap8EACdzs4+K8bjmXcStt6O
-NKhWG086FXNDCAre5PuQ5k4NDqwYvQUBbJ6T1yrSuSa/FNmM+uKwfp3AEAqwNCWr
-ZQHxVagsfSJLcNhPhc6uON3twtJuC8eIKnXOIob1ITQEwMSGdW4dqR2w3jcwfCLE
-x2wvlxjFYN7yHYj+QdxaidWONjep5VSAt/noovt8WPZgBBoX126QV0gvKF1AQNpq
-OtiRFRLRceXFfrnNUuWCchZ6SzGxyer40tphmposQ4Ikehh2NQxTMx9ivbnKpfEY
-OhffDcSRcUMtYe0q/XqxcPcas/+Q0BhJ7LD7Tzw5huLRne80d5pX0SSkuPjsZJVS
-3ZzxQdI+1UYjJrvDCL0xIFg95JpGsEmeaWc3WsZVnQwVUjhd+yzgE+7jmEFLzlk/
-j4x1Ofg9Gn1TH72kXBZb1gqQZa/nI1daydUZu6JuoXLbGrBn3tdalEIagz23SWvM
-pz6L/yNU56quv0kVlCv8tEzCojQP6a6TkBIuvtCgjjKEIROqCQQbmGGxZpNVukXC
-6P8+3Tva305iT+SOYvQ8VYOh0zPMAt3xjN1fU1/MdaSlZ7n3utF64yp4OkvAzugn
-13AjHXlYvy09dC9TRGOyAK8j/YYJ0YBdApBOrLdz3Rja1Xfc2x3WWtcTXigDiScp
-T9afUXrKSHHAi5xkia94q8dGAYkCIgQQAQoADAUCU44fpgWDA8JnAAAKCRDM0u2U
-0hc56a3eEACP0z/b1KkxJv+EXc4eqBLuzNeX/eBK2SR0Ob0keWeYM18uExJzazHC
-i0XGDxi7DSWB8Rvx9JgsHJDyy0jh8IgYwjLsBuOfKfB43wgePQYC8C46G7l7mjqT
-piFiM4FFPe8pUp+OjCON+hy0XXK8oIRGgE14KF5E3TV/tlg2qRu52zG+yBeK7LzU
-jTJoC7G11dqUzJPsAw2Wc90dw4/29VwNWihYVd2iVNhvENVQcJhhEgeeTj/dSAFk
-NC80KQ/ivfRjzRPU3QONlSz67kNkcPIHT9wlOFuPio4Bsl/2hYyU7IInf1z5wlig
-S0j7aOrf70Xj8uRapc88HE/a41cV0hby5yITEwvLaeoH3vQc8dlV4yhDSoS6GmGW
-S5VJEvNem9tHm1QnAbHI42uAhitZMMjJ+hehT2m05P0XGpDvjPfiZWP2MAmiHkOZ
-39eSKTCbgb1dXtBMeEk3iH/VRoC9/plUKWr6gMJeJLPpJybLFRf1WMfnaFKVSq4/
-oeJyzPjgBJxKASj2jj055yz2TULqZJUjGqXbHa5pFWLs2RWzIyV2t5Bcn8p1Xo4H
-icSzjzj20qXjozmt/Qo3hO5dDLTfrQ8wnjqq7bSu4d7Mv+SjnzXBadu8cZcEVFoq
-SY0Mkc8RylMi9bEgoXTUyaM1py4lN3zm+z1FmO2KID4lWpPbZDogI4kCHAQQAQIA
-BgUCU6/1AAAKCRABogUB6BpLumA4D/4hW/M4AcQ+uZHnWmA+N+JC3WbWnjOcHcrL
-plpxSY5paom8nHGOfdSivqpDNaY+5yQLz1i6DFp0bj4c7zL+g7s7hRDz1Qf4S0e+
-dy96NleRkf2RVijhtkNxeyISaHEU7wImFdrrsycP7OImvvZvJk6bpWljk9FsXamL
-EySRKtq0WSa/UdcrLkR/93Wo2PLPpXoMRX8+jV8nLpL9RYkRThH05bgaYzGPPGyS
-H4pIkR8RlIvzd170glzNbuuPhhAV8kJUtXsj6W71AWLypnMkrUKseVL1t4iN+nf3
-ZFo6y/+s2MIzgiEHN3Ju+aJ+uSNpJdSwD2S89vhsHT22dQOqDHWdUo1DRYcL9kEu
-g3navGxVUKZ2etjaeT1PFfweLacwl+Uu45RCbmQD6pFzda7Wng8GbDERndUQ7qA/
-DCSBfnmJBNhXIMWJd8lA0puzd1wP189ZUzbge7AVLXJfFFuj5hVqkTKeWW8kodSz
-YKVfS1lq/jT2rtMDLK6k7vyf0Gjor5XJhfla68BtBNxn0+dUq25FOTAPy5ETf8BF
-L0Au8CboxnOMju02WBFb5Q5oNs7fk17hvzR7Ou/f/wMVQDZ16lGRROPsvN6wi6z1
-j04V4QNqOd60JnBVq+O2qmbtXjou7qxHR0ZBwI/qPaktwFJIAXmeOFdKQyl+I7TI
-6FmdpUB6x4kCHAQQAQoABgUCVHNXLgAKCRA1Dr6IHnUkHiwrEADJGKIoU5qyXiSi
+91qG8TRybZvnBh8aemrS5o8QChTk0UFQUjpRBbAOb+ayf/dgjIkCHAQQAQgABgUC
+U6Mo0wAKCRCl5rymKbpBJy+OEADI3UuK8K8IdayCpC9UOwuA/LDF01RW2EoogmwL
+ywSS0ipf+D0rEvH9EtqXbz2ibOBhZIxtYzXXEx0Kx3fnYQvInm8wdnc0650tGMCy
+U8sBTaV9B0mdYakMmQZc8Hbwd88fLnwEFn+qHJ0ac31geIxDN7vfgKeqea+4VGKn
+NbG1h0bRn2CK2pccnp8sm1eHJ/u25X05Z0Ofrx4It53OhO5RTSHGhHM62+48FcdE
+Ytm6jPcS6RY/mXWBWPJsjmvvtQ+67PfJVHVJMDVFJV98PSqLbD69doz+golpESEd
+O5uWrLJEXMj8O154HQg5xnOXWurzNG4FdL6eeXk7+1UfXSXLUzGkaMgB6HjNTTrj
+JG19B/+9F4nbItN2EOJ4lVEvDCL5uE0CBxvG9y04dxzI8jCg1/hPjYyd4Qb7N6CD
+Doo7M0lhm5QSlDa0NDfaIpxEPBtcb0wOKaJUHfDMertl0mWvYbPhP5Lftq+h4syv
+Q9iu0gitGCGW6O/GXH3/ZhnyjVJRJnFkcYIeckKXVK7aCEtyS8adffjrwYvH681P
+5d+EwDxY2B8UJE9sPx+Bz5mpsETSVbm+aA0KsCwc9jLnJcDB84/7ovuRXdP0C06Q
++YC8fY8QQZmIl/bkzwAWWyZVSw4O9/3pWnjXvqSu/6xOSVfF0455bMvyv+MOiTlx
+8NqfgYkCHAQQAQIABgUCU6/1AAAKCRABogUB6BpLumA4D/4hW/M4AcQ+uZHnWmA+
+N+JC3WbWnjOcHcrLplpxSY5paom8nHGOfdSivqpDNaY+5yQLz1i6DFp0bj4c7zL+
+g7s7hRDz1Qf4S0e+dy96NleRkf2RVijhtkNxeyISaHEU7wImFdrrsycP7OImvvZv
+Jk6bpWljk9FsXamLEySRKtq0WSa/UdcrLkR/93Wo2PLPpXoMRX8+jV8nLpL9RYkR
+ThH05bgaYzGPPGySH4pIkR8RlIvzd170glzNbuuPhhAV8kJUtXsj6W71AWLypnMk
+rUKseVL1t4iN+nf3ZFo6y/+s2MIzgiEHN3Ju+aJ+uSNpJdSwD2S89vhsHT22dQOq
+DHWdUo1DRYcL9kEug3navGxVUKZ2etjaeT1PFfweLacwl+Uu45RCbmQD6pFzda7W
+ng8GbDERndUQ7qA/DCSBfnmJBNhXIMWJd8lA0puzd1wP189ZUzbge7AVLXJfFFuj
+5hVqkTKeWW8kodSzYKVfS1lq/jT2rtMDLK6k7vyf0Gjor5XJhfla68BtBNxn0+dU
+q25FOTAPy5ETf8BFL0Au8CboxnOMju02WBFb5Q5oNs7fk17hvzR7Ou/f/wMVQDZ1
+6lGRROPsvN6wi6z1j04V4QNqOd60JnBVq+O2qmbtXjou7qxHR0ZBwI/qPaktwFJI
+AXmeOFdKQyl+I7TI6FmdpUB6x4kCHAQQAQIABgUCU6h3iQAKCRCDgslcKQI9+WQg
+D/9kFhcS5qu+l0RsHNmKfhk6RMlnPs0jY6E2BxdXbJaNBFN1NW3kIVNYPFflvazC
+owBP2ek+gtiJW5/uH3C2FAW//Dt2pVcjRN8tIqqrvMRJxLQEP2zJ1YFKnbYl30+e
+hHWlUUyleKzIBA/6GbiAig/TbaA1cOgZNVDdtfJUxLphzNZ7FGatfjkKEYP8+xd/
+3Oj/Wba8F4cNhMUbsV2qOs3nXlnVt2hKVB9kOpUJQdjlJp3DKbim6uj/sLs9KRLd
+Bfhrezd2KoIpvvGDo/V4xqdhW/J/vwjrISOQ05YsrCMOL2O9/Sdron+gA1zm/xQf
+C9k/Nv6lcCaOLywdcaYd3XJqXZBuZy5KEljm5Nyo4Hxhd9ZJiXw+pMzX75NLZr6X
+nZz7/t/8FbRKhlHfAl/6hoPK3f31os8KHyj6YrqGDGg8dwvhxMsHpPlvsx4jpIsb
+cE7kTwidvhJwe8qet4XicTxnF43irlAk0xIbmxnSgH6XX4G6vejPsqr89p9pCWLj
+URTT+tr+U1XiNfehomdhDUYXZv1Sg5pK2HNEqkGKQTsjzb29t6kiGA1JsmBCPP5S
+PGdHDagMfa+VFlT/+bmwWsad5R+f3vhTQJ4GBcpBgMpQwEX5wHSGs7dpKxUaL2ki
+nRR7wBBtPLO0P0GLJ6vfkBhrtfA4gQCGqT+cOEdHlH8gC4kCHAQQAQIABgUCU6V1
+nAAKCRB4YIWsINNFfeXiEACXy45MLSpjTfAF6xuxtlN2zBuo7gP3VNboIq0MZcD1
+yxRIhSwKS1QAeWso2a7YJ6Kzp/HG2hi60Zi/Hd1vXSnNYwLD50GszInc8iNA2OEZ
+UuDiw7c65lWxOdjc9jbnd4tbEBiupfqZ/15R+R7gmeOVElW5d3owC+ENgbPOhmZ3
+AH5cx4QdXtmPy5oWpHyU13izxvV934aY5OXcvsCYwIt7DCISEgiuPJ2azkzX7ak8
+C8U+diHF5M5Ps+6nBmNQ9bpHHwZ7hZOUQGs/1UW5cEeWwJEMcTEPLwvs3qjtK1L/
+k8DS6t95hr7xiNiyojCpC4L1XwT05MxGHKwY5qXMw4bqInyGsnf28NuoaUk+V+fq
+IS6uC+p7/D2l9RU206R93vGTOwIxxEaehy8i7GadhiHOKGADm7yatlmOJfMx+9D/
+X7q2wWB+t0Hu5fr34NwEaMfJJgjOHhLqtBiuPsrr6D7+sNKIXkZcJNKE9nf+Nef1
+jygPjDF2O6AcHl2P6vPoKUwEAYYUyYB2ku/pm5wJ3V1bbXkTsYse8bWCUf6jSSWI
+acIoHAXtZjOe3BhKGKxG84h/7i/054SYI0+IIuec3zwiy+te+V5cyGbutaVg4Wnd
+nH/j27B7oEWmwstsu7i0EIO1dw3WwjhjiXsflaseWoB5LrOHaHpRccEeiRdllka4
+uYkCHAQQAQgABgUCU6f59gAKCRDfoyRRwJ6+uqx7EADLCOXDrUmHbHQzOn5B+uVf
+DQJrtVz3jNFdHb3p4qRD01tJ67/GhcoZ7NUVo79ELuWJalQaIM9agmYZa5CsJIUL
+RI8JtalcLRXCxFX4ls7L/XRRO0atwzpt/K9hao6Taewp+J0Vy+TVLVeh2jcajRL6
+DfrlawMDpD2OxDw16KGMZagmNoWcuMZqK6PRXBnFGy6lEL7+gCy+vHe30nl9R64q
+MhTxnpCFvK1UCk2Khzz/7nUNwXw4McU2KYnU7AiSMNdfPWv/AW0m0MyWRBLmEy/n
+en+hIEmoxIomifroX3PuyChjZ2FaNWs3Kb7HKhXGSeCl1UkLBPeZa+obfP0D57qO
+DeXMUxny8yOGOXOrHlRhdJz01qZ9v0UCfwnBJo1ewLaacJ1l5Va26GwDbCh03mhw
+SE+AWXZbVTuemzUS5QBBYzC+SBxSqF+sE1hFy9okReGFY+AjsjI+uu3A9ht3+vmv
+cgLWPyvkxIVksnvcmPp/k2RLkyk/tQWA31pNRMyqaReResg4mFszKEtbC+tFVquc
+pCxd/Rvvvz918lkEFjIPN0yQoRenb/bKB4i3jbKIKMnJzCsNeaobdpsNcAdl0DOp
+LMfo+RFzheQnMkwBQgI0XNxz3ZNMPN+BkEFWs7u7mfpKk+ZnU/9fKOyrOC1z2KZw
+NhjOF9oHv+wfa3ZQ7I/nkokCHAQQAQoABgUCU6xtjAAKCRCqaOzI6YAJU6erEACj
+8z2iMep2PzgcnpHz8csKlAmTrBRmNgErJNWfSPG5Uw1wvf6RzcD5iZ9D9Xu6SCcZ
+0DVtLdho9Z1/Zb22ocOxTBd40DkryDdO9ANSHj/bw4tYzTtWmftoU5qMdD7nQgp+
+2fMTuptASAx/WK/n1tWam9XyM/i9fdD4iu2pzbBdX0F2RgmMS197fQgAAVMfDDHj
+gquiyGBefCaMxv4FEM/Omn5ipkhrmPpsqTmZJNxAusiOiPJS+pjl18Xjf+VKtRgL
+tr4pu0y+NVVXmI9IvncFlR1viyaKDoudB0K9UXlVKUURP7ambdS/yginiVbgaZ9T
+x5STFC1FYKk69JdouvzYQc9vWW3C0cv68GWivpdFQMHrDAjAy9rFpeqs9UBbHpxC
+Q38ReoYDyxL4QJulEv3HpIRRt+UV7NE+3+Ln3a3/nTnUKJZ3m+kX6qKh875Td1OB
+ZAmgfy8zlDdd50n0bQjSt8/DZsRdpFq5LG5vXA80Y+Tpn3i0jTJ37JGV+7+Yxb3q
+XM8XY0DFnn/cf/BFbbqLwEUxalooKp8eOO1G8yW8kqBdxGe6I1gJEaht5hkbrh7L
+Ozjs22Tyz+DN6uo3Lm+cIu2YmC1j38x9LzVxUJHIxFA0XTurwsMDMB4RvSs+jdWC
+CdkQM+1StiYeYDC7+dG2FquqpbsFl6fsoICKCksvVIkCHAQTAQIABgUCU7GS8AAK
+CRAjY4v3LFk7wWflD/oDgQNEhpD6EFFCQ/y3g5PtOVjeF349vuTIXcTcQI657s7K
+5ftCYgWu1NNYUyLFiQJ1siRVZCqq39k7SIG3+4X9mUvGubqXog3+YZRy4FwnLGiz
+r6PwEHsLeHoFiGAlbyaBrojgSgwVi5sir7JsH2PugxEFCZj9l6F3RbslBpDW0QwS
+sdenw1GQJrejZC3HkuE+D0U2cQ/YMebUaKiIi535H1N1oimcVpowRSX1NoyYI69w
+1JSyvc0fau7KfQua0+iGhyicL1BecGPKF+YIns6fuunnZuwsH+K35cUu2tpi58bO
+42bbfirpn57LF/a7+o2pjUSMzez06aUqS4WZjw47bnpIm92gUarM41ExXuXLXZlE
+ofeiUnWbVkJ5+MWeBKEfTBeqHToESEYoFSVgfszCR/0hQNy7E5ADOPorbvJaqUlN
+L6/cDURnQKe85QFi8y+oOzEkf7D6XvouMGQyxsYVjHEpEZdN63evTe99Ir1nFc+F
+UCgch0wLPTKlYDpQBsYiZRYrZMG/pvKvu9+ig2sqRjI6nlARN6HocMoAGViK23JG
+ikC5B15lblCGTL8bmiDMtd0+JccCSLv7dAJI1FSJEFqyI2CAGm0Rj5Qh2/Zfu6Xl
+sJdlnaCIXsqMB+5N50uXY4VuZ0L2+cokpYm+Pn9zJBFyxX3C2F7r1Vsuysds4okC
+HAQSAQgABgUCVAJs5gAKCRAIlNrgSWRisWpGD/4lp2TRzpJkSpn/MKcMDPjxu3eJ
+bZLISDHeerVhVU7BpyaxUpAHaFyv5eTi2SoTXIWPFUGzZXj0kREmWBQLk/OM2VcL
+pN4oSt2b05TPWNXatIve6Zlg1AMJXz+i7iTTLCgjYUhL6uvfIczX3Khx0VwfOZ1x
+T+VNJqyXXlL/eONc/+a/VB/ZikvY789VfgS/Xq3JTNQpUnGFf87YBrThd9xLsaVg
+pTNhmOQpAEHLaZIRw778roAcQWyZ+/apIRuMUcOyishyT9p68DDu5N91TYfXayy2
+ckgmAt7Cf6j70YT9Xc2u374F/AvtXHHlnX3/hTI3cVKF+Wio8L95aM4BDmoHkk/7
+x2S6TUiHDiBQnLgSuwLdYr9eQKSZIjek94y5nz9KabKwj09vqW1b6jbt1eEsoeBd
+FGfL1GgmrSMO/erz7a+KrLgn+4Ld6GB/dLLhPCbf1ILe6oyThzvt+9vGsUqSNw6R
+3O1J1VYZBBHaDMZwvLRZcYOTfdpXOtmV5mNRCvDHyVR1OpsAY9m7EpF7npsgJa3U
+D+kaf9krVvua+aAR1Cj462M+UAcFFTOBQ5PciWtxKm6R1tFI23K9zqIGl+7Vnrgi
+OiwQdEByFtdOnAOcbXf+iCyYZY4iv3ZzDt5ybREdPxgf+6LUVoKBh+Yy70ut/HmE
+I0P1exJc3k8ZoZtQUYkCHAQQAQoABgUCU7TR8wAKCRB3w9S09qPTPwxAD/9Yt9gF
+oQptDzAEEzbTICYmA8zj2fyvPmSFCYfMQfAEOH0oJerU7ux/7zr3XnzekFd1NPom
+HhJuGBLyftHYJvird9KafLznBW8NB54kCHARHqdyqQYoEs1qUIuBNn3TGW+7Ao1q
+jXkUr59PzFqILJH1aCYelgy/NN81NNTESw2in0xZ/OliVGZuXtTbYiS4js0p2bkP
+fzT/f8FeMGwzAX5RrvP7of6lW2U9pslpUf0g+3m77/G3nwQkV70e8NvL7j9Q+zkH
+33IMlnrbDPiIhwgjnrtokUbGbs4XHyhFZxoSMddOy75lRs3YhS+vGIEvfLo/P3ai
+MIDLEupdYR6ZbYZxCF2y/+h/KKgypirzK3Z3zePA3KQeEIvlq+vo0nxJCyfnj9wz
+M7AJ3IJKzMkvmvYSVqaX1OCBaTLeTUkpFUh4Nq2fv62RRtlRqdIzish3bqlmHwFB
+ApQwvm0/uH2k3lucl9Kz7S+unh1h9NR4BVY2l+f8Oi4T4Irut3qJnsrZXunPBMJr
+KkPYU8iKEVmSM6E+M4T1yGoVse3JAIFpDVNHlZfckOYmqYG3NAvuralw3mis/eaG
+lnBrBI9zp66FzZpoqaATzz6/EIbuZ2vs47xIIgVUoW9NZwGo5igYhW9ixUURznFD
+PRrg5+UfoBoCcQ4i2wVvciqbTaetJ6+QuqCadYkCHAQQAQoABgUCU7u12wAKCRDn
+vXCXmESXmUfAEACrMuez//VqyvynY5ADBUMytq2jrK8GUqfbxDOzeRe9++16xIYJ
+Z5qNsdFBL2ezryvuafcPsIqMBvwucEJ88jU7/BaUClJo2QPD+WLUit99J/O68DTi
+2m9Jxn+EUi/L2d0e+Kcb17zbEfbcg42+TZfxQhf1kUWLH71UsDwAiiSnfy6dkIDg
+wPnlTpuerRmsgI5dkFeCt8boYFRXatVrjzJsX6rBp+CEasAXHuhAQvIoqepi3CTA
+Uo5gPHSF+aldAD2SRw3xegmRnJkKNOYu4RfCUi3iRLV7Lm898pL82659jSUQMo7a
+ZevwhaKQU/gm0LBbXHGizV7JuKyYE5vzEpAEA+ChOntE4dcsN2B5m81lD0ra8Hbb
+qTO2AVlp/BJxNueGm/WdYHXdpGwLvWWBP5ZMqaPhqBdQ/5DMzkeyZnSBjykMNIFQ
+Ii2jRLe6/poReh9ieIuzO8QIMA4X3QTsRv3qaF/TkjTzUpB0x13fXWuyp4mrSEbF
+msgMEdsHqOLkBAa2w1RLgvPQ21FKewWyasv2T8NdvuZT0sARuirvxLMFrb8fMC4L
+y8xBhXVbpWpFz6eo8leygqSSNSsMzzCtm6yJ0sO9ufQWrQZMmcqV5ERGecnjYJ6Q
+CPWEC+xCKGS2W4PmnkO96alEfDjEKsA6uGi4z1FYvx9macKX35Hx1cXsUIkCHAQT
+AQIABgUCU/Dt2QAKCRBtnoZL9ilTXmhID/9PzhdXfJKYQLzR9/NBX05SlWVrQU8K
+OA4KtaOE9AVCVgD4bcIuH5Sf437xtaLUChw/x112y37kT6i8+NzyedmLjXvZ59bm
+aUEzrLw3aZUZ9vNdkLeqQgmk2t0tIfQjVssv3qFqbHmdRT3pXqMRz4JzyA8Q1ogM
+3C6Ng7qv1bpQS0JerfSchGrINGSRWIrbsguhmAIiJ/Vt0X8yALzqmg6kt0Lnz5Vn
+G7dMpIfDqyef761o/wbAvVx9WphEmlCqiMd/r9kThQT2rQnqjvi2pFnUEwUj1zQf
+7ArpErcB50OfBFh9o4OPt8BPYdOkXprsIl+MI7Ax3C+Nu08+jtyKZxTL4gQ6lBvz
+jQyseX2tmw3LMd4nekrJhifF406zUY4uDEVINLyDCOyaelKzSsOk92vHD17s6h33
+PxyS5oUZl8ieM7E7s2ibJAa6BAKWXBsQ9JTpKDb7csFz+TOWvqsUMQZVGiINe/YA
+fcGQWLOK6NHbEnIOZ5dRSPXKxmWyXKe7KvZBRNExZfE494/ZhKC+Z9/wRRfg7B72
+fkFghwuwuxsmjuEv3DXXqfLeyGgTRQgF2LnFAoShjrJDJUE+ZCtZ2cmdfLDy9wdL
+Z0cRHbW26FzP26MUxiQmeOUiJnh2F6uKuF5XbFHipKVmSz0BcP0rNui1+Rq9Uc+j
+JunKkuGZ8QRTDIkCHAQTAQgABgUCU8F/NwAKCRDYolbJslup1C3WD/4kJ9NqhgjB
+BdW1Qk1VimzcDnMu2HRJOSYNqp/UVV8DRoet+f+507VCYaNgrczhKUra8wHQjiXg
+5blBAa/Y4rXxSFP+Yhow4e9DM+0CW3SLWByxXkNfGFtAuflaOFYqbH6fn+1T2meu
+ktXqVZroK2gXG1SDKHarg/XAK8QN1ism+tuGHSaO4ry1WLy8Ok94xPG2ca+2ViRh
+Zm9FBqX+b4++3sIwycWIoo4MV7QzmFAJR1YxD2neSFp5hul9BgwUM0RLwW2DfbKB
+6fBCwVsZBBYRNs3gyrBAguZHi1hb2KGnHZAEgY9XEqfFlUon2A9VGs3MEq0eO67M
+pRNvcuVWr79i5stQL2FSj2+U44YlpOjY9zoqQE3ISerOQ/cj7ryqogQqDzbC8C9M
+PHCKI+2k6CvX2Bzk5HJWk7KNOM9n94VAiRD8a6NrpBTWrql5DSF46cVyQhUU56AK
+EL10tYBbtvm+QkhFvUudcomCxY1WJiNqOZQ0wO18Lw8gyNsymEaija3z/ANIbGUQ
+OQN4zqKOJ2TrhrTrZ50JUO6umHRbmObMZ3Y+G/R8WhgKs5kpJjZsvGnCNmi6cVeC
+KbLWtlevs0S5lfLafVX4/rGSkrD4TJk9mgzjLygYWiKqygmI2NaIKWslYua93V91
+SMSeSCz5w3Qzc1SRPjLJaeyNEX+cnO1aYIkCHAQTAQgABgUCU8kmlgAKCRBDYhta
+0kTdB4ruD/wKAy1lg71RR5uVOsoeM40WKCkaqF/G+9RDRtYxXaj6LKSv7CQ3dVDu
+NlAbJXZOt6j3BPFtUSvcZaeSRtvuF3oQDJF78Zhc3UpMEpgcs4k86OOaspNAwb8B
+1clh9Yf5qCingQp3nr63a75d7d+5O8hDmqgREqsVHI4XPFz+/rlEQrwxkWaK2ht7
+fP2ARLCcfWccr9m2k4zPyacgjc6u7u3mdLcSiADsVcraoqBIaw/VLP3VBi+cv0B+
+Z99RBbvGgzdnkY1kOESEwmXJAMwv5pwxBXzI0ooVzMJM1pbGTmec9pB4z3FzShsI
+wISHV+Z9HPsO+mkJ4W/LhGUZhrc9Fas+zk8loqCuI4u9hDooapkIwwBgeR1O/Gea
+NwDU2qLYRmmv3PLATv+bi4qmYXsLbOMgvEEM59WqJxJMGx8QmavFprVCRaO4yTsq
+Ih482wFHbOHSZLOXGpzxggaLvveIVTncUhpFVOumCxLblOV0dyqjdCY0xQQC4YiB
+N4IH+3u4uwEG34htyZo6US57ilXxCW7nBDVFsKGUpgm5gs4QUSIfK4bpFOVOfKF9
+tyTzwF8NM10HB4HP3AnglgNCsxxoWhtY9H9rqwVxdxBfSmtxureQFSVNUy6JxyfJ
+rq+Io3c3oAIlCAJ76IMal7p9XvF2uMsVDnfkvSvcgF3Ba8U2AiJMYokCHAQTAQoA
+BgUCU/yTLAAKCRCL3If7chXhiap8EACdzs4+K8bjmXcStt6ONKhWG086FXNDCAre
+5PuQ5k4NDqwYvQUBbJ6T1yrSuSa/FNmM+uKwfp3AEAqwNCWrZQHxVagsfSJLcNhP
+hc6uON3twtJuC8eIKnXOIob1ITQEwMSGdW4dqR2w3jcwfCLEx2wvlxjFYN7yHYj+
+QdxaidWONjep5VSAt/noovt8WPZgBBoX126QV0gvKF1AQNpqOtiRFRLRceXFfrnN
+UuWCchZ6SzGxyer40tphmposQ4Ikehh2NQxTMx9ivbnKpfEYOhffDcSRcUMtYe0q
+/XqxcPcas/+Q0BhJ7LD7Tzw5huLRne80d5pX0SSkuPjsZJVS3ZzxQdI+1UYjJrvD
+CL0xIFg95JpGsEmeaWc3WsZVnQwVUjhd+yzgE+7jmEFLzlk/j4x1Ofg9Gn1TH72k
+XBZb1gqQZa/nI1daydUZu6JuoXLbGrBn3tdalEIagz23SWvMpz6L/yNU56quv0kV
+lCv8tEzCojQP6a6TkBIuvtCgjjKEIROqCQQbmGGxZpNVukXC6P8+3Tva305iT+SO
+YvQ8VYOh0zPMAt3xjN1fU1/MdaSlZ7n3utF64yp4OkvAzugn13AjHXlYvy09dC9T
+RGOyAK8j/YYJ0YBdApBOrLdz3Rja1Xfc2x3WWtcTXigDiScpT9afUXrKSHHAi5xk
+ia94q8dGAYkCHAQQAQoABgUCVHNXLgAKCRA1Dr6IHnUkHiwrEADJGKIoU5qyXiSi
 kVtmBdYmZilF9T9fzfcrL4TNmL/V/VCZgd9zRANBN+saSXkgm0CG+3jLIBlFhg/+
 zBlxceGrnDMB3M7C5n9kvymh5pAGzOVlYwfR5QICvJ+nEmk/WcaxiEUzGj04i5VO
 uRUr0aEVbVqubznnFtc+qEntQ1oWNW/fSvMmfBHBxSLRbqDBUGciDizh1R5XuJBM
@@ -334,6 +333,18 @@ Bjtql7TRWrmQuhuFnBbL7Iq5GXovlnp7YSqtxBvA+1uneM2Fp419krP0Wd6WxkXn
 K91Nul9jkjN7afnAc4mAjUSmJfeZH8rkQ3Wv8iHEFkVUNd60ELICuIAtQSwlxsYR
 y0vpJP5RAzFgVCGukPnAKlnB653vBPGYb7PgCmYFrQ2A/q2TDlIkP3VlCNmvlSdm
 A9zIIl75Zi1qgDeOqTKuygQK95BfGbIUMeiJmI7zTnwdAzaPg4kCPQQTAQoAJwIb
+AwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVO8/PgUJB57jXQAKCRAeNKGCjiB5
+Aa3dD/9zk64GNdJbN4sxdXQ/Np48wXwnOxCY9AYTRP7rJDjqnGqeJo6+5koHbPVw
+bUZCzU4ZcI71MUm3fvit+qedmwJskp+8B9WvGkK2mPCAdkCxXjp9UCx9XSV55Jyc
+yXTp2O3oVrm9n9YWmhA0FWssE8qsVaoWAXYIuobDlk3t8Tb978Nug7FYFPmRHB8v
+x3pOta8UMmFQ0sREbjwFgrbM+TH9gM4zL5pX4rzWQaIO/0gDaNJWETNNbVbTcXxC
+m2r78D/IflRLKSxKAp8e/le5M+WyawJnCydoBrNysXxyI8YDFVsCjXEB0RQ2SC/3
+pFpUGISGdV+iWDrfjv4rKNCjJNC8CKRZG4txNojCJy1HsS3jcslzdHX4uyXTdRN7
+wmeFRwVIYsDw3saqF2F2ajivU7k+pGcl509cOuvFy7aSy4o1QkIvOpQ12ljPC99V
+0443qF9DDlhfi9+gesUJyiQbq7x3TTNzZce7mkWjABKGt+u1t8V0KO81DYVjy3td
+QfBp7xAjqQvqJnWXhxNjOKVhiha9E5n+1n8ZmScmT3Udy7n0qbQbZvkofaJa9wNi
+S3BBl+Lr+ScMdLUhMIus5RGn/5x9a7XL7a+W2vtpBlx5r90CWI1XnOadauzP0m0Y
+mervzkNDZq1r8Nh3fGVNv/MM3DGISAAhmx7xCtflGbDDwv0aMYkCPQQTAQoAJwIb
 AwULCQgHAwUVCgkICwUWAgMBAAIeAQIXgAUCVMvC/gUJBZoznQAKCRAeNKGCjiB5
 AbOiD/9uuAChZPgW6Sn96awak3mpeaKLE6MsOCRI++ahc6RGUEz+8ny3frzQSruW
 IutcRtLSRGKuNAaITku7CErjdyrWcAcL7YW1YU8+911U4tEI9rC/Qcy3/T4ULH7M
@@ -356,30 +367,7 @@ qyFqmEHr9JxIa3DTV8w/a0Y4hX2bczL9Y1cB6n8qOA68aAn+xerJcSOroTIJh83D
 /7OguexGGYoZBDvX6dWguf8udFPeYpJvkT6TSYF9U0JpVTtlCNutjScUO2uaV9+u
 DqACngwqbzBTjL8UucAleVcFfOi48yepnOd11YFYxbw+/BcqLNhi1eP2AaGxIgXb
 R88tF9OC0SXaCH+1Z1bbalOmQNYstOv9BbsHvW7mPgX2xhyoDkVRWaNAQoDLbnJr
-4gi9cD8/kQMzdlGOzt2ist/+xueblXJs5TOO80Rw+AEAEQEAAYkCJQQYAQoADwUC
-URLC3QIbDAUJAeEzgAAKCRAeNKGCjiB5AdMqD/9SXulJq6Q4U7aN6o7TLMU2Mgqe
-WqtBqwTNIisBoSJjXq9Od4iN2S5Akwo/ZQO01nRNPPc9yjwidgb7wCUFDNglUDuG
-S2nXaQ0XAO83qHMOsORN2S93dO6xVRX2Chhzl9bUr1WIQcM+lIs/LZCX2rvKlsFY
-mZQHX/ibhQs7T01RXajwJqwxyXyVPL+kPNeowva4ZUf6rzdqKZLfFgyJyGdHI18b
-F6lahgHdN2OOawEeU2K+MlluR3ZahoyN4u1Mqijf6snmfd0++EIqDHwYPn70F4JP
-dMhyuVpYBVyVtsgHy9W5fS+zSj+vX+qj6MBXdFBs+a9nr8GZJO4BUP2mtyNgmEfU
-VQefSHnq+0OlGPZG4raxTEqJfp2KTRCGB4hIzYWO1g1cOBeXxFfXJdkX8LoKbP5s
-2Kzn9sAK6BxmazOvSNpuimCDNvKjR00iKNS4Dxix2FBXQU/4pVpGHjXTQP6RqeTr
-AedXvpgCHWP1UIlswIQecGmQcJ/hRZjd+0vlcjfCYhZHr7N96Da6Cy8v2fZiZHaS
-At7T2oIZ9X3gEh/kOlLDcuIdvMHUfojn0MrPCe1AqOHyQQqhkVylvZpS0PdE0VW3
-PmJ98uKfX2FVAOTUD4Rw3n9Ew7bfM249HuP4JOXi/Skp4sBB/xgrtV1u+E+BW0SS
-/BOiwfrI4xUy+MrWu4kCJQQYAQoADwIbDAUCU3Zl0QUJBETWQQAKCRAeNKGCjiB5
-AVyfEACZN/cEPfHGRT2XSPS7GSLNUhayHiOn4Y1WEPzSvVBnpdR9BaU1lLTDzBAD
-KZ9wPy7kRASeQh6BoF5wQhUFMBxfG5KpYQJqoPYvtL4DwnfuAor7BDxM9C76FCK8
-adHlJOMj91Zn2KrJHlkuu8rfyht6jKWx1Ew6dwiAnUnn9k7IfgigARsjBput8n+9
-n/ZH+VBeegT1y7/T3mkQLAdHkBQeX4VwbsHko9ihjblwjxksyfZv02Xdorz9viVW
-clg31fpzvFzIqFyhQ5bUp99VH1fuKKpa4tplBVXgdf5+XGwbpauZC8bDNdxtxbT8
-BADhGB3xHPdf7nO+DZht2NQx50LUL6dgnj+cpAabS6ED6nn2O9Bf3kTb4GyHhhPD
-n+8aocpGPYg6FE59cQ9S00sigVu+JH+4gQZppd2Fj9chef0B6YkVe3BXiQEKapuC
-i7kMIqHkxUvxqrpwp9hSEOaWqTZ9Ls41VSgxR1qfg23P0I6YI1Pox1y/2NpkiOGS
-rNU5bhxCcwbB5M0Uaev26cfHO0MD2leuPIg1wRlyoIRc00RiiFrRFB1m8RnPN537
-rlgiDBW9zHSfh2g6ImYIjRY0+ezWaHMrEOovPwh9ynFYLWgIIUY/yKzsWCzRQ9eg
-d6bUixO57s+dFQfs8hYA2DjrjIuVMKqv6EuGwsaPDsPQFH3zMIkCUwQoAQoAPQUC
+4gi9cD8/kQMzdlGOzt2ist/+xueblXJs5TOO80Rw+AEAEQEAAYkCUwQoAQoAPQUC
 U4eKeDYdA1NpZ25pbmctb25seSBrZXksIHJldm9raW5nIGVuY3J5cHRpb24gY2Fw
 YWJsZSBzdWJrZXkACgkQHjShgo4geQGeGw//fLw5CXRJ/aqz8qgEtI2+9O+Jxh6+
 Jiqyu7cYrRwcuTQLUXAjkE3ZrPRmWGHKL2xsshfO4D2R2KCU7eiy1J0WWvJrMQe6
@@ -392,6 +380,64 @@ ZjTYYez6lbHkJ7icPo5IGb3xxjsXB7vrDOWSIqNptsaRBSjQthsX8NUD8AC/qeSE
 K7YL0J3tbuwBYUz3QN5Jk3nmZi+WLBHb9Gz6XruoUN5Cp0PZmYiLQjpU+ZNp2Nb2
 fVNZ/FurSHgu28VZN3fFdW7sQ5/moBLWP/8KK+yMWpJ6Aj5162dOL0+41y9w+u+c
 xHuEZsOXFixgubFcljipTDNRfeHNZlsyuWubwYfiHMCFgArktdFRnmtDAnjDqTOk
-8ENKxCfgWSoZztc=
-=6255
+8ENKxCfgWSoZzteJAiUEGAEKAA8CGwwFAlN2ZdEFCQRE1kEACgkQHjShgo4geQFc
+nxAAmTf3BD3xxkU9l0j0uxkizVIWsh4jp+GNVhD80r1QZ6XUfQWlNZS0w8wQAymf
+cD8u5EQEnkIegaBecEIVBTAcXxuSqWECaqD2L7S+A8J37gKK+wQ8TPQu+hQivGnR
+5STjI/dWZ9iqyR5ZLrvK38obeoylsdRMOncIgJ1J5/ZOyH4IoAEbIwabrfJ/vZ/2
+R/lQXnoE9cu/095pECwHR5AUHl+FcG7B5KPYoY25cI8ZLMn2b9Nl3aK8/b4lVnJY
+N9X6c7xcyKhcoUOW1KffVR9X7iiqWuLaZQVV4HX+flxsG6WrmQvGwzXcbcW0/AQA
+4Rgd8Rz3X+5zvg2YbdjUMedC1C+nYJ4/nKQGm0uhA+p59jvQX95E2+Bsh4YTw5/v
+GqHKRj2IOhROfXEPUtNLIoFbviR/uIEGaaXdhY/XIXn9AemJFXtwV4kBCmqbgou5
+DCKh5MVL8aq6cKfYUhDmlqk2fS7ONVUoMUdan4Ntz9COmCNT6Mdcv9jaZIjhkqzV
+OW4cQnMGweTNFGnr9unHxztDA9pXrjyINcEZcqCEXNNEYoha0RQdZvEZzzed+65Y
+IgwVvcx0n4doOiJmCI0WNPns1mhzKxDqLz8IfcpxWC1oCCFGP8is7Fgs0UPXoHem
+1IsTue7PnRUH7PIWANg464yLlTCqr+hLhsLGjw7D0BR98zCZAg0EURLC3QEQALYJ
+H5eBbTgNXBPjbu/ZPj6rP47/EY7BBxqVVpI5S6C5iB/b16cClvqZSpE45O4lY3Wf
+DWW9eIDqIXGDoOMNSGynqPnhfsYAACNn1C5q8+Byytpy2wktHP1ZJaoOM4BixvgH
+mnCZI8Api2ZEDEtXN3FSy4ezYfFE7hVado0lAQGPuPvO4ayC9IkFKr1WJyLpwYj1
+zV+xbIqyentHozniaZBFuwKDb4b83SGo7PQcTpmUkpUppmq5Os/EZYW5TeYBSnMU
+trpaPwNJRiJZn/GuqIV1sHi3Ucze+UoH0sSD3cMS4b/xDRODYpLSURbF6q4FfITr
+6OSUM2ol7IeZ+CS4B8WWQ1hrnzvRdPzszMYT+FLjSVuaFBUceXDEyQCIRExzRiz4
+5+BQkxsgNAE1EWDdD9uNqMWhUGAGgoWnsLbbOCgmRQ1P7sdi/+3rN4OUjM2GBiaz
+l3SASIB4tq7CO7foGbBSxtAfB6NYo/ykANFkvVtOPQT6tFQzgUU2H0PZdMUUppo2
+5u5vy1Saj5lQgQQp8+E0cr3BL9uwXI+/3Lcct7Zvc1gYUrn4fOeqDw3Qf7b0jvMv
+HtWk6HeJE3ctvG/10ya6RUm3DxGr9R2mt3dnmnygKKwWj6Sdj4n4iA2MLR6eI3yu
+SSX/isg3l++85HxgK2znSEvV8DLd138woTHP5BNdABEBAAG0KUxFQVAgYXJjaGl2
+ZSBzaWduaW5nIGtleSA8c3lzZGV2QGxlYXAuc2U+iQI9BBMBCgAnBQJREsLdAhsD
+BQkB4TOABQsJCAcDBRUKCQgLBRYCAwEAAh4BAheAAAoJEB40oYKOIHkBkGIP/AnB
+RVmN815Z2kqtjL0e1kTG1NxT/3jeWBFQ2KdS4s8VTiLaz6FHeHl/NdHXmdQP4gEm
+VeXMtXYb8iNdg9OnhrSCoelZQtpvlK27sDMWI7jb9FZQDNYPUXKHpK5ncUMRG+F6
+J3yzhJeh7rLhwnkSt9KUlLqqqS7yyzyZLyUzUyn6Vz3BhNZD7yGZJSK8Blv1YsSW
+MXGG8Se8Ao/APXyjv5L0YAEXBizF+VC8pkeC5o5WoESSyvL6+7yiRY2uDcuXd0NA
+R5qGvuesusd7yCo40mA4T2OPFG9smYa0hRPIaqBZlnMF9Bcv/q5cvbdtaRhkORA2
+F+yb5yiUBXyCmP78Ter+4xfCrPVu/Tor8uwrc0fME0TnuQkcSGD0rdTDZbHmrAUx
+TUYPGwHc/2n5PKoBugRkAHaKtNHL2Tyl4UHvDB/SxbcSDvxcWx/LiDJXrX1WcFH4
+9t86kqoUVcCh0XWYWIis9559pWkX1+JDk7C3SwmMNomdhPzeSwA7YCP5WxjdSOcO
+sYVqJXw16K33L/xbwOqZncRkQX8zeJLTIOOqq30AIUP6OQaUpizIe/uBulOrTKLq
+7+RFcdRMi9XAUv0zpnoBRwbyDOipsqFcZ9YoSrSU3kcCMn/9X2ujcN6QV3QD41A6
+UVXpe2ylnCmFV21bVZLTvweZWXAXl1sPylx9P9GNuQINBFESwt0BEADcWvD6Pof0
+xwQiL+COIbC/Gch0ZzwxxZyGcWk5a92FNb3Tnq/7LbYOgptQuNPyT7wbO5FDTGnh
+XAILWtfdQTHBx5zPMaz61Iq4gaaDUQvKCxo5kd1AE0sY++f5Nk0aVphc+VCjubxi
+FcYfCBCt0rKNwUPnGc4fF73zUtOr4hDqNViGGjv9CKT2tUTVcfGg59i+c1kkPRwV
+1/05xfjtiiqYzixlg8yg6YqhVBOwABDnbvDPvjYF3pKm6GoGl0TDpiIJjESijmQF
+jciE/cvk5NLi3OE6R1/XGWFZKcIUTs2Q9wrqj6vqoJxSpEZX2NHAj3smU8p6AQdh
+a8sPhKTfWlaLw1nS2hT+epG/FuGG0fG41/eN4ADPFAGEZWLQL8gGvi+rIWqYQev0
+nEhrcNNXzD9rRjiFfZtzMv1jVwHqfyo4DrxoCf7F6slxI6uhMgmHzcP/s6C57EYZ
+ihkEO9fp1aC5/y50U95ikm+RPpNJgX1TQmlVO2UI262NJxQ7a5pX364OoAKeDCpv
+MFOMvxS5wCV5VwV86LjzJ6mc53XVgVjFvD78Fyos2GLV4/YBobEiBdtHzy0X04LR
+JdoIf7VnVttqU6ZA1iy06/0Fuwe9buY+BfbGHKgORVFZo0BCgMtucmviCL1wPz+R
+AzN2UY7O3aKy3/7G55uVcmzlM47zRHD4AQARAQABiQIlBBgBCgAPBQJREsLdAhsM
+BQkB4TOAAAoJEB40oYKOIHkB0yoP/1Je6UmrpDhTto3qjtMsxTYyCp5aq0GrBM0i
+KwGhImNer053iI3ZLkCTCj9lA7TWdE089z3KPCJ2BvvAJQUM2CVQO4ZLaddpDRcA
+7zeocw6w5E3ZL3d07rFVFfYKGHOX1tSvVYhBwz6Uiz8tkJfau8qWwViZlAdf+JuF
+CztPTVFdqPAmrDHJfJU8v6Q816jC9rhlR/qvN2opkt8WDInIZ0cjXxsXqVqGAd03
+Y45rAR5TYr4yWW5HdlqGjI3i7UyqKN/qyeZ93T74QioMfBg+fvQXgk90yHK5WlgF
+XJW2yAfL1bl9L7NKP69f6qPowFd0UGz5r2evwZkk7gFQ/aa3I2CYR9RVB59Ieer7
+Q6UY9kbitrFMSol+nYpNEIYHiEjNhY7WDVw4F5fEV9cl2Rfwugps/mzYrOf2wAro
+HGZrM69I2m6KYIM28qNHTSIo1LgPGLHYUFdBT/ilWkYeNdNA/pGp5OsB51e+mAId
+Y/VQiWzAhB5waZBwn+FFmN37S+VyN8JiFkevs33oNroLLy/Z9mJkdpIC3tPaghn1
+feASH+Q6UsNy4h28wdR+iOfQys8J7UCo4fJBCqGRXKW9mlLQ90TRVbc+Yn3y4p9f
+YVUA5NQPhHDef0TDtt8zbj0e4/gk5eL9KSniwEH/GCu1XW74T4FbRJL8E6LB+sjj
+FTL4yta7
+=DRTl
 -----END PGP PUBLIC KEY BLOCK-----
-- 
cgit v1.2.3


From 060ff4f8c901c4cd54189f8c075614082eabe1ae Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 3 Mar 2015 10:34:07 +0100
Subject: Vagrant: Install leap_cli from source

The develop branch of leap_platform needs leap_cli >= v1.6.3.
The leap_cli gem is only 1.6.2, because it needs to work together
with the master branch of leap_platform.
Therefore we need to install leap_cli from it's develop branch from
source.

Change-Id: I78b433bfa31ad42f78c49949c757bcfb6cd5c30b
---
 vagrant/install-platform.pp | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/vagrant/install-platform.pp b/vagrant/install-platform.pp
index 30f0b1e6..465ca78a 100755
--- a/vagrant/install-platform.pp
+++ b/vagrant/install-platform.pp
@@ -11,10 +11,23 @@ file { '/etc/gemrc':
   content => "---\n:sources:\n  - https://rubygems.org/"
 }
 
-package { 'leap_cli':
-  ensure   => latest,
-  provider => 'gem',
-  require  => [ Package['ruby1.9.1-dev'], File['/etc/gemrc'] ]
+vcsrepo { '/srv/leap/leap_cli':
+  ensure   => present,
+  force    => true,
+  revision => 'develop',
+  provider => 'git',
+  source   => 'https://leap.se/git/leap_cli.git',
+  owner    => 'root',
+  group    => 'root',
+  notify   => Exec['install_leap_cli'],
+  require  => Package['git']
+}
+
+exec { 'install_leap_cli':
+  command     => '/usr/bin/rake build && /usr/bin/rake install',
+  cwd         => '/srv/leap/leap_cli',
+  refreshonly => true,
+  require     => [ Package['ruby1.9.1-dev'], File['/etc/gemrc'], Package['rake'] ]
 }
 
 file { [ '/srv/leap', '/srv/leap/configuration', '/var/log/leap' ]:
-- 
cgit v1.2.3


From b08c796bb09d8345b971674f5957fcc11510c60a Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 3 Mar 2015 16:55:53 -0500
Subject: pin client version to >=0.7 (#6743)

Change-Id: I66f12a04bf92fbda77284665bc1186b10f4c2e15
---
 provider_base/provider.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/provider_base/provider.json b/provider_base/provider.json
index f8d2715f..60ad2a9e 100644
--- a/provider_base/provider.json
+++ b/provider_base/provider.json
@@ -57,7 +57,7 @@
     }
   },
   "client_version": {
-    "min": "0.5",
+    "min": "0.7",
     "max": null
   }
 }
-- 
cgit v1.2.3


From c9a9132d107d99a2f303fa766dae87397ac18274 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 4 Mar 2015 10:58:24 -0800
Subject: temporarily increase the delay between soledad / web api tests to 60
 minutes, until we are able to fix the issue with the test users creating db
 bloat.

---
 puppet/modules/site_check_mk/files/extra_service_conf.mk | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/puppet/modules/site_check_mk/files/extra_service_conf.mk b/puppet/modules/site_check_mk/files/extra_service_conf.mk
index 03d1ea76..61b0dd39 100644
--- a/puppet/modules/site_check_mk/files/extra_service_conf.mk
+++ b/puppet/modules/site_check_mk/files/extra_service_conf.mk
@@ -1,13 +1,18 @@
 # retry 3 times before setting a service into a hard state
 # and send out notification
-extra_service_conf["max_check_attempts"] = [ 
-  ("4", ALL_HOSTS , ALL_SERVICES ) 
+extra_service_conf["max_check_attempts"] = [
+  ("4", ALL_HOSTS , ALL_SERVICES )
 ]
 
-# run check_mk_agent every 2 minutes if it terminates
-# successfully.
+#
+# run check_mk_agent every 2 minutes if it terminates successfully.
 # see https://leap.se/code/issues/6539 for the rationale
+#
+# update: temporarily set interval to 60 minutes until we solve the
+#         issue with the users db getting bloated with deleted
+#         test users.
+#
 extra_service_conf["normal_check_interval"] = [
-  ("2", ALL_HOSTS , "Check_MK" )
+  ("60", ALL_HOSTS , "Check_MK" )
 ]
 
-- 
cgit v1.2.3


From 96882181d7cdcdf2c10918c007ae15dfd566410a Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 5 Mar 2015 12:59:34 -0500
Subject: change default MTU to 1400 (#6745)

Change-Id: Ia4b93776c6ae316b47f6e0b8e2763aa6fa9cab92
---
 provider_base/services/openvpn.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/provider_base/services/openvpn.json b/provider_base/services/openvpn.json
index 11cb0dc2..127f5890 100644
--- a/provider_base/services/openvpn.json
+++ b/provider_base/services/openvpn.json
@@ -25,7 +25,7 @@
       "cipher": "AES-128-CBC",
       "keepalive": "10 30",
       "tun-ipv6": true,
-      "fragment": 1500
+      "fragment": 1400
     }
   },
   "obfsproxy": {
-- 
cgit v1.2.3


From 0c916d8e70bdb6165fe25d6f4e3ceadb1c0622a0 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 10 Mar 2015 22:51:31 +0100
Subject: Use augeas instead of file_line to configure entries in
 /etc/check_mk/mrpe.cfg (Bug #6788)

We used file_line before, but when the some check parameters change, a
new line would be added, leaving the old line there, resulting in two
checks with the same name but with different parameters.

Augeas can handle this better, but it is important to use 'rm' to
remove all old lines with different parameters before adding the
new line.

Change-Id: Iad69dfd20f487a16d372a4f4a4bc53299f9e4a66
---
 .../site_check_mk/manifests/agent/couchdb.pp       | 25 +++++++++++++++-------
 .../site_check_mk/manifests/agent/haproxy.pp       | 10 +++++----
 .../site_check_mk/manifests/agent/haveged.pp       | 10 ++++++---
 .../modules/site_check_mk/manifests/agent/mrpe.pp  | 12 ++++++++---
 puppet/modules/site_check_mk/manifests/agent/mx.pp | 10 +++++----
 .../site_check_mk/manifests/agent/soledad.pp       | 12 ++++++-----
 .../site_check_mk/manifests/agent/tapicero.pp      | 16 ++++++++------
 7 files changed, 61 insertions(+), 34 deletions(-)

diff --git a/puppet/modules/site_check_mk/manifests/agent/couchdb.pp b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
index ee0268a3..979a02d7 100644
--- a/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
@@ -12,13 +12,19 @@ class site_check_mk::agent::couchdb {
 
 
   # check bigcouch processes
-  file_line {
+  augeas {
     'Bigcouch_epmd_procs':
-      line => 'Bigcouch_epmd_procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/epmd',
-      path => '/etc/check_mk/mrpe.cfg';
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => [
+        'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_epmd_procs',
+        'set Bigcouch_epmd_procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/epmd\'' ];
     'Bigcouch_beam_procs':
-      line => 'Bigcouch_beam_procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/beam',
-      path => '/etc/check_mk/mrpe.cfg';
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => [
+        'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_beam_procs',
+        'set Bigcouch_beam_procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/beam\'' ];
   }
 
   # check open files for bigcouch proc
@@ -27,10 +33,13 @@ class site_check_mk::agent::couchdb {
     source => 'puppet:///modules/site_check_mk/agent/nagios_plugins/check_unix_open_fds.pl',
     mode   => '0755'
   }
-  file_line {
+  augeas {
     'Bigcouch_open_files':
-      line => 'Bigcouch_open_files /srv/leap/nagios/plugins/check_unix_open_fds.pl -a beam -w 28672,28672 -c 30720,30720',
-      path => '/etc/check_mk/mrpe.cfg';
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => [
+        'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_open_files',
+        'set Bigcouch_open_files \'/srv/leap/nagios/plugins/check_unix_open_fds.pl -a beam -w 28672,28672 -c 30720,30720\'' ];
   }
 
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/haproxy.pp b/puppet/modules/site_check_mk/manifests/agent/haproxy.pp
index e7986db1..5e7215b4 100644
--- a/puppet/modules/site_check_mk/manifests/agent/haproxy.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/haproxy.pp
@@ -3,10 +3,12 @@ class site_check_mk::agent::haproxy {
   include site_check_mk::agent::package::nagios_plugins_contrib
 
   # local nagios plugin checks via mrpe
-  file_line {
-    'haproxy':
-      line => 'Haproxy  /usr/lib/nagios/plugins/check_haproxy -u "http://localhost:8000/haproxy;csv"',
-      path => '/etc/check_mk/mrpe.cfg';
+  augeas { 'haproxy':
+    incl    => '/etc/check_mk/mrpe.cfg',
+    lens    => 'Spacevars.lns',
+    changes => [
+      'rm /files/etc/check_mk/mrpe.cfg/Haproxy',
+      'set Haproxy \'/usr/lib/nagios/plugins/check_haproxy -u "http://localhost:8000/haproxy;csv"\'' ];
   }
 
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/haveged.pp b/puppet/modules/site_check_mk/manifests/agent/haveged.pp
index 92e77faa..62facd9a 100644
--- a/puppet/modules/site_check_mk/manifests/agent/haveged.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/haveged.pp
@@ -1,9 +1,13 @@
 class site_check_mk::agent::haveged {
 
 # check haveged process
-  file_line {
+  augeas {
     'haveged_proc':
-      line => 'haveged_proc  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /usr/sbin/haveged',
-      path => '/etc/check_mk/mrpe.cfg';
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => [
+        'rm /files/etc/check_mk/mrpe.cfg/haveged_proc',
+        'set haveged_proc \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /usr/sbin/haveged\'' ];
   }
+
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/mrpe.pp b/puppet/modules/site_check_mk/manifests/agent/mrpe.pp
index 6921574f..5e1f087a 100644
--- a/puppet/modules/site_check_mk/manifests/agent/mrpe.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/mrpe.pp
@@ -11,8 +11,14 @@ class site_check_mk::agent::mrpe {
     ensure  => present,
     require => Package['check-mk-agent']
   } ->
-  file_line { 'Apt':
-    line => 'APT    /usr/lib/nagios/plugins/check_apt',
-    path => '/etc/check_mk/mrpe.cfg',
+
+  augeas {
+    'Apt':
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => [
+        'rm /files/etc/check_mk/mrpe.cfg/APT',
+        'set APT \'/usr/lib/nagios/plugins/check_apt\'' ];
   }
+
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/mx.pp b/puppet/modules/site_check_mk/manifests/agent/mx.pp
index 1e370125..8215cb21 100644
--- a/puppet/modules/site_check_mk/manifests/agent/mx.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/mx.pp
@@ -6,13 +6,15 @@ class site_check_mk::agent::mx {
   }
 
   # local nagios plugin checks via mrpe
-  file_line {
+  augeas {
     'Leap_MX_Procs':
-      line => 'Leap_MX_Procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a \'/usr/bin/python /usr/bin/twistd --pidfile=/var/run/leap_mx.pid --rundir=/var/lib/leap_mx/ --python=/usr/share/app/leap_mx.tac --logfile=/var/log/leap_mx.log\'',
-      path => '/etc/check_mk/mrpe.cfg';
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => [
+        'rm /files/etc/check_mk/mrpe.cfg/Leap_MX_Procs',
+        'set Leap_MX_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --pidfile=/var/run/leap_mx.pid --rundir=/var/lib/leap_mx/ --python=/usr/share/app/leap_mx.tac --logfile=/var/log/leap_mx.log"\'' ];
   }
 
-
   # check stale files in queue dir
   file { '/usr/lib/check_mk_agent/local/check_leap_mx.sh':
     source  => 'puppet:///modules/site_check_mk/agent/local_checks/mx/check_leap_mx.sh',
diff --git a/puppet/modules/site_check_mk/manifests/agent/soledad.pp b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
index 512d1a3d..e0d00332 100644
--- a/puppet/modules/site_check_mk/manifests/agent/soledad.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
@@ -5,10 +5,12 @@ class site_check_mk::agent::soledad {
   }
 
   # local nagios plugin checks via mrpe
-  file_line {
-    'Soledad_Procs':
-      line => 'Soledad_Procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a \'/usr/bin/python /usr/bin/twistd --pidfile=/var/run/soledad.pid --logfile=/var/log/soledad.log web --wsgi=leap.soledad.server.application\'',
-      path => '/etc/check_mk/mrpe.cfg';
-  }
 
+  augeas { 'Soledad_Procs':
+    incl    => '/etc/check_mk/mrpe.cfg',
+    lens    => 'Spacevars.lns',
+    changes => [
+      'rm /files/etc/check_mk/mrpe.cfg/Soledad_Procs',
+      'set Soledad_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --pidfile=/var/run/soledad.pid --logfile=/var/log/soledad.log web --wsgi=leap.soledad.server.application"\'' ]
+  }
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/tapicero.pp b/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
index ffd11100..39651567 100644
--- a/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
@@ -9,14 +9,16 @@ class site_check_mk::agent::tapicero {
   }
 
   # local nagios plugin checks via mrpe
-  file_line {
+  augeas {
     'Tapicero_Procs':
-      line => 'Tapicero_Procs  /usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a tapicero',
-      path => '/etc/check_mk/mrpe.cfg';
-
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => [
+        'rm /files/etc/check_mk/mrpe.cfg/Tapicero_Procs',
+        'set Tapicero_Procs "/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a tapicero"' ];
     'Tapicero_Heartbeat':
-      line => 'Tapicero_Heartbeat  /usr/local/lib/nagios/plugins/check_last_regex_in_log -f /var/log/syslog -r "tapicero" -w 300 -c 600',
-      path => '/etc/check_mk/mrpe.cfg';
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => 'set Tapicero_Heartbeat \'/usr/local/lib/nagios/plugins/check_last_regex_in_log -f /var/log/syslog -r "tapicero" -w 300 -c 600\'';
   }
-
 }
-- 
cgit v1.2.3


From b973fa14258ea8101433a325554ad8445b0c8820 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 11 Mar 2015 22:29:26 +0100
Subject: Change nagios to be aware of soledad user change (Bug #6612)

Change-Id: Id53d6432a58006653f4d9ddd6355ae505a5273eb
---
 puppet/modules/site_check_mk/manifests/agent/soledad.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/site_check_mk/manifests/agent/soledad.pp b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
index e0d00332..ad8c23a1 100644
--- a/puppet/modules/site_check_mk/manifests/agent/soledad.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
@@ -11,6 +11,6 @@ class site_check_mk::agent::soledad {
     lens    => 'Spacevars.lns',
     changes => [
       'rm /files/etc/check_mk/mrpe.cfg/Soledad_Procs',
-      'set Soledad_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --pidfile=/var/run/soledad.pid --logfile=/var/log/soledad.log web --wsgi=leap.soledad.server.application"\'' ]
+      'set Soledad_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --uid=soledad --gid=soledad --pidfile=/var/run/soledad.pid --logfile=/var/log/soledad.log web --wsgi=leap.soledad.server.application --port=ssl:2323:privateKey=/etc/x509/keys/leap.key:certKey=/etc/x509/certs/leap.crt:sslmethod=SSLv23_METHOD"\'' ]
   }
 }
-- 
cgit v1.2.3


From 69a56322084c74b8d4b94eac107679889fce26a8 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 12 Mar 2015 11:24:12 +0100
Subject: Update augeas submodule, pulling in the changes from camptocamp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mainly because we want to have the augeas packages installed
before any augeas resource is called, fixed by this commit:

  commit 616b59bead6a57f71b4b4e59aaf080cd130ab250
  Author: Raphaël Pinson <raphael.pinson@camptocamp.com>
  Date:   Thu Mar 14 09:42:08 2013

      Abstract package name for ruby-augeas, define dependency for all
      Augeas resources

see https://leap.se/code/issues/6788#note-6

Change-Id: I62af667cb93b6a9b51e1b7163d225b4ccae0312f
---
 puppet/modules/augeas | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/augeas b/puppet/modules/augeas
index 4d8c8ba3..58ab2b90 160000
--- a/puppet/modules/augeas
+++ b/puppet/modules/augeas
@@ -1 +1 @@
-Subproject commit 4d8c8ba362cc57c12451e581f27feea97797e8c0
+Subproject commit 58ab2b90c52a5d951fa41596827bc3b6f52310e7
-- 
cgit v1.2.3


From 6d4dcb83118e3d88aed49347690babd69eb56c91 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 12 Mar 2015 11:30:47 +0100
Subject: require file for augeas resources in site_check_mk::agent::*

Change-Id: Ia5ac6f50e023d7d358d17c661b71c6a5880ec445
---
 puppet/modules/site_check_mk/manifests/agent/couchdb.pp  | 9 ++++++---
 puppet/modules/site_check_mk/manifests/agent/haproxy.pp  | 3 ++-
 puppet/modules/site_check_mk/manifests/agent/haveged.pp  | 4 +++-
 puppet/modules/site_check_mk/manifests/agent/mx.pp       | 3 ++-
 puppet/modules/site_check_mk/manifests/agent/soledad.pp  | 3 ++-
 puppet/modules/site_check_mk/manifests/agent/tapicero.pp | 6 ++++--
 6 files changed, 19 insertions(+), 9 deletions(-)

diff --git a/puppet/modules/site_check_mk/manifests/agent/couchdb.pp b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
index 979a02d7..2dfe16fa 100644
--- a/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
@@ -18,13 +18,15 @@ class site_check_mk::agent::couchdb {
       lens    => 'Spacevars.lns',
       changes => [
         'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_epmd_procs',
-        'set Bigcouch_epmd_procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/epmd\'' ];
+        'set Bigcouch_epmd_procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/epmd\'' ],
+      require => File['/etc/check_mk/mrpe.cfg'];
     'Bigcouch_beam_procs':
       incl    => '/etc/check_mk/mrpe.cfg',
       lens    => 'Spacevars.lns',
       changes => [
         'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_beam_procs',
-        'set Bigcouch_beam_procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/beam\'' ];
+        'set Bigcouch_beam_procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /opt/bigcouch/erts-5.9.1/bin/beam\'' ],
+      require => File['/etc/check_mk/mrpe.cfg'];
   }
 
   # check open files for bigcouch proc
@@ -39,7 +41,8 @@ class site_check_mk::agent::couchdb {
       lens    => 'Spacevars.lns',
       changes => [
         'rm /files/etc/check_mk/mrpe.cfg/Bigcouch_open_files',
-        'set Bigcouch_open_files \'/srv/leap/nagios/plugins/check_unix_open_fds.pl -a beam -w 28672,28672 -c 30720,30720\'' ];
+        'set Bigcouch_open_files \'/srv/leap/nagios/plugins/check_unix_open_fds.pl -a beam -w 28672,28672 -c 30720,30720\'' ],
+      require => File['/etc/check_mk/mrpe.cfg'];
   }
 
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/haproxy.pp b/puppet/modules/site_check_mk/manifests/agent/haproxy.pp
index 5e7215b4..6d52efba 100644
--- a/puppet/modules/site_check_mk/manifests/agent/haproxy.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/haproxy.pp
@@ -8,7 +8,8 @@ class site_check_mk::agent::haproxy {
     lens    => 'Spacevars.lns',
     changes => [
       'rm /files/etc/check_mk/mrpe.cfg/Haproxy',
-      'set Haproxy \'/usr/lib/nagios/plugins/check_haproxy -u "http://localhost:8000/haproxy;csv"\'' ];
+      'set Haproxy \'/usr/lib/nagios/plugins/check_haproxy -u "http://localhost:8000/haproxy;csv"\'' ],
+    require => File['/etc/check_mk/mrpe.cfg'];
   }
 
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/haveged.pp b/puppet/modules/site_check_mk/manifests/agent/haveged.pp
index 62facd9a..cacbea8c 100644
--- a/puppet/modules/site_check_mk/manifests/agent/haveged.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/haveged.pp
@@ -7,7 +7,9 @@ class site_check_mk::agent::haveged {
       lens    => 'Spacevars.lns',
       changes => [
         'rm /files/etc/check_mk/mrpe.cfg/haveged_proc',
-        'set haveged_proc \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /usr/sbin/haveged\'' ];
+        'set haveged_proc \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a /usr/sbin/haveged\'' ],
+      require => File['/etc/check_mk/mrpe.cfg'];
+
   }
 
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/mx.pp b/puppet/modules/site_check_mk/manifests/agent/mx.pp
index 8215cb21..da66c549 100644
--- a/puppet/modules/site_check_mk/manifests/agent/mx.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/mx.pp
@@ -12,7 +12,8 @@ class site_check_mk::agent::mx {
       lens    => 'Spacevars.lns',
       changes => [
         'rm /files/etc/check_mk/mrpe.cfg/Leap_MX_Procs',
-        'set Leap_MX_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --pidfile=/var/run/leap_mx.pid --rundir=/var/lib/leap_mx/ --python=/usr/share/app/leap_mx.tac --logfile=/var/log/leap_mx.log"\'' ];
+        'set Leap_MX_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --pidfile=/var/run/leap_mx.pid --rundir=/var/lib/leap_mx/ --python=/usr/share/app/leap_mx.tac --logfile=/var/log/leap_mx.log"\'' ],
+      require => File['/etc/check_mk/mrpe.cfg'];
   }
 
   # check stale files in queue dir
diff --git a/puppet/modules/site_check_mk/manifests/agent/soledad.pp b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
index ad8c23a1..f4a3f3a6 100644
--- a/puppet/modules/site_check_mk/manifests/agent/soledad.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/soledad.pp
@@ -11,6 +11,7 @@ class site_check_mk::agent::soledad {
     lens    => 'Spacevars.lns',
     changes => [
       'rm /files/etc/check_mk/mrpe.cfg/Soledad_Procs',
-      'set Soledad_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --uid=soledad --gid=soledad --pidfile=/var/run/soledad.pid --logfile=/var/log/soledad.log web --wsgi=leap.soledad.server.application --port=ssl:2323:privateKey=/etc/x509/keys/leap.key:certKey=/etc/x509/certs/leap.crt:sslmethod=SSLv23_METHOD"\'' ]
+      'set Soledad_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --uid=soledad --gid=soledad --pidfile=/var/run/soledad.pid --logfile=/var/log/soledad.log web --wsgi=leap.soledad.server.application --port=ssl:2323:privateKey=/etc/x509/keys/leap.key:certKey=/etc/x509/certs/leap.crt:sslmethod=SSLv23_METHOD"\'' ],
+    require => File['/etc/check_mk/mrpe.cfg'];
   }
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/tapicero.pp b/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
index 39651567..5c14b460 100644
--- a/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
@@ -15,10 +15,12 @@ class site_check_mk::agent::tapicero {
       lens    => 'Spacevars.lns',
       changes => [
         'rm /files/etc/check_mk/mrpe.cfg/Tapicero_Procs',
-        'set Tapicero_Procs "/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a tapicero"' ];
+        'set Tapicero_Procs "/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a tapicero"' ],
+      require => File['/etc/check_mk/mrpe.cfg'];
     'Tapicero_Heartbeat':
       incl    => '/etc/check_mk/mrpe.cfg',
       lens    => 'Spacevars.lns',
-      changes => 'set Tapicero_Heartbeat \'/usr/local/lib/nagios/plugins/check_last_regex_in_log -f /var/log/syslog -r "tapicero" -w 300 -c 600\'';
+      changes => 'set Tapicero_Heartbeat \'/usr/local/lib/nagios/plugins/check_last_regex_in_log -f /var/log/syslog -r "tapicero" -w 300 -c 600\'',
+      require => File['/etc/check_mk/mrpe.cfg'];
   }
 }
-- 
cgit v1.2.3


From e7313cf255cfe4ebaab7b27e41eddd98285977fc Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 17 Mar 2015 11:34:11 +0100
Subject: updated README.md with contributing section how to use a pre-commit
 hook for syntax and style guide checking

Change-Id: Ia03321d71cce39f643ec7248361c156e34fe0d09
---
 README.md | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/README.md b/README.md
index c3770de6..1d58b5eb 100644
--- a/README.md
+++ b/README.md
@@ -78,6 +78,15 @@ Special Environments
 . When deploying to OpenStack release "nova" or newer, you will need to do an initial deploy, then when it has finished run `leap facts update` and then deploy again (see: https://leap.se/code/issues/3020)
 
 
+Contributing
+============
+
+In order to validate the syntax and style guide compliance
+before you commit,
+clone https://github.com/pixelated-team/puppet-git-hooks.git
+and link `pre-commit` to `.git/hooks/pre-commit`.
+
+
 Changelog
 =========
 
-- 
cgit v1.2.3


From 473e3a9a65bfe0cf7c66512de56e0e5efdbc3f71 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 17 Mar 2015 16:12:52 +0100
Subject: updated README.md to point to installation doc of puppet-git-hooks
 README

Change-Id: I3138f249167a4e0183724574971bb206b164b09a
---
 README.md | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 1d58b5eb..a64962ca 100644
--- a/README.md
+++ b/README.md
@@ -82,9 +82,7 @@ Contributing
 ============
 
 In order to validate the syntax and style guide compliance
-before you commit,
-clone https://github.com/pixelated-team/puppet-git-hooks.git
-and link `pre-commit` to `.git/hooks/pre-commit`.
+before you commit, see https://github.com/pixelated-project/puppet-git-hooks#installation
 
 
 Changelog
-- 
cgit v1.2.3


From 5398a55d0b7b60a321b08454885134e3297311b3 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 18 Mar 2015 12:27:26 -0700
Subject: pin webapp to version/0.6.1

---
 provider_base/common.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/provider_base/common.json b/provider_base/common.json
index 74c09efe..6ad8a2e6 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -80,7 +80,7 @@
     "webapp": {
       "type": "git",
       "source": "https://leap.se/git/leap_web",
-      "revision": "origin/version/0.6"
+      "revision": "origin/version/0.6.1"
     }
   }
 }
-- 
cgit v1.2.3


From 3172444652af71bd771609d6b80258e70cc82ce9 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 19 Mar 2015 13:44:45 -0700
Subject: don't set a lower --fragment by default yet (not compatible with
 android client)

---
 provider_base/services/openvpn.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/provider_base/services/openvpn.json b/provider_base/services/openvpn.json
index 127f5890..11cb0dc2 100644
--- a/provider_base/services/openvpn.json
+++ b/provider_base/services/openvpn.json
@@ -25,7 +25,7 @@
       "cipher": "AES-128-CBC",
       "keepalive": "10 30",
       "tun-ipv6": true,
-      "fragment": 1400
+      "fragment": 1500
     }
   },
   "obfsproxy": {
-- 
cgit v1.2.3


From 252bb2121c87a2c650551fc306f7ee41c17e8d9f Mon Sep 17 00:00:00 2001
From: guido <guido@bruo.org>
Date: Mon, 30 Mar 2015 16:55:27 -0300
Subject: Adds apache support for webapp.domain if defined on :80, completes
 fix for #6632

---
 puppet/modules/site_apache/templates/vhosts.d/common.conf.erb | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
index 87c40005..43bd1076 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
@@ -1,5 +1,7 @@
 <VirtualHost *:80>
-  ServerName <%= domain %>
+  ServerName <%= webapp_domain %>
+  ServerAlias <%= domain_name %>
+  ServerAlias <%= domain %>
   ServerAlias www.<%= domain %>
   RewriteEngine On
   RewriteRule ^.*$ https://<%= domain -%>%{REQUEST_URI} [R=permanent,L]
@@ -7,7 +9,6 @@
 </VirtualHost>
 
 <VirtualHost *:443>
-
   ServerName <%= webapp_domain %>
   ServerAlias <%= domain_name %>
   ServerAlias <%= domain %>
-- 
cgit v1.2.3


From b64940c1de7cf42acef018ca2fbf5beff4f48e80 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Mon, 30 Mar 2015 22:33:05 -0700
Subject: added support for rotating couchdb databases.

---
 provider_base/services/webapp.json                        |  7 ++-----
 .../site_couchdb/files/designs/tmp_users/User.json        |  1 +
 puppet/modules/site_couchdb/manifests/create_dbs.pp       |  7 +++++++
 puppet/modules/site_webapp/manifests/couchdb.pp           |  9 +++++++++
 puppet/modules/site_webapp/manifests/cron.pp              | 12 ++++++++++++
 puppet/modules/site_webapp/manifests/init.pp              | 15 ++++++++++++++-
 .../modules/site_webapp/templates/couchdb.admin.yml.erb   |  9 +++++++++
 7 files changed, 54 insertions(+), 6 deletions(-)
 create mode 120000 puppet/modules/site_couchdb/files/designs/tmp_users/User.json
 create mode 100644 puppet/modules/site_webapp/templates/couchdb.admin.yml.erb

diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json
index e80a758a..b0646579 100644
--- a/provider_base/services/webapp.json
+++ b/provider_base/services/webapp.json
@@ -4,11 +4,8 @@
     "forbidden_usernames": ["admin", "administrator", "arin-admin", "certmaster", "contact", "info", "maildrop", "postmaster", "ssladmin", "www-data"],
     "domain": "= domain.full_suffix",
     "modules": ["user", "billing", "help"],
-    "couchdb_webapp_user": {
-      "username": "= global.services[:couchdb].couch.users[:webapp].username",
-      "password": "= secret :couch_webapp_password",
-      "salt": "= hex_secret :couch_webapp_password_salt, 128"
-    },
+    "couchdb_webapp_user": "= global.services[:couchdb].couch.users[:webapp]",
+    "couchdb_admin_user": "= global.services[:couchdb].couch.users[:admin]",
     "customization_dir": "= file_path 'webapp'",
     "client_certificates": "= provider.ca.client_certificates",
     "allow_limited_certs": "= provider.service.allow_limited_bandwidth",
diff --git a/puppet/modules/site_couchdb/files/designs/tmp_users/User.json b/puppet/modules/site_couchdb/files/designs/tmp_users/User.json
new file mode 120000
index 00000000..ed3d0af9
--- /dev/null
+++ b/puppet/modules/site_couchdb/files/designs/tmp_users/User.json
@@ -0,0 +1 @@
+../users/User.json
\ No newline at end of file
diff --git a/puppet/modules/site_couchdb/manifests/create_dbs.pp b/puppet/modules/site_couchdb/manifests/create_dbs.pp
index 40148b8e..f9a08807 100644
--- a/puppet/modules/site_couchdb/manifests/create_dbs.pp
+++ b/puppet/modules/site_couchdb/manifests/create_dbs.pp
@@ -64,6 +64,13 @@ class site_couchdb::create_dbs {
     require => Couchdb::Query::Setup['localhost']
   }
 
+  ## tmp_users database
+  ## r/w: webapp
+  couchdb::create_db { 'tmp_users':
+    members => "{ \"names\": [], \"roles\": [\"replication\", \"users\"] }",
+    require => Couchdb::Query::Setup['localhost']
+  }
+
   ## messages db
   ## store messages to the clients such as payment reminders
   ## r/w: webapp
diff --git a/puppet/modules/site_webapp/manifests/couchdb.pp b/puppet/modules/site_webapp/manifests/couchdb.pp
index 3ae4d266..1dbc745d 100644
--- a/puppet/modules/site_webapp/manifests/couchdb.pp
+++ b/puppet/modules/site_webapp/manifests/couchdb.pp
@@ -6,6 +6,8 @@ class site_webapp::couchdb {
   $couchdb_port            = '4096'
   $couchdb_webapp_user     = $webapp['couchdb_webapp_user']['username']
   $couchdb_webapp_password = $webapp['couchdb_webapp_user']['password']
+  $couchdb_admin_user      = $webapp['couchdb_admin_user']['username']
+  $couchdb_admin_password  = $webapp['couchdb_admin_user']['password']
 
   include x509::variables
 
@@ -17,6 +19,13 @@ class site_webapp::couchdb {
       mode    => '0600',
       require => Vcsrepo['/srv/leap/webapp'];
 
+    '/srv/leap/webapp/config/couchdb.admin.yml':
+      content => template('site_webapp/couchdb.admin.yml.erb'),
+      owner   => leap-webapp,
+      group   => leap-webapp,
+      mode    => '0600',
+      require => Vcsrepo['/srv/leap/webapp'];
+
     '/srv/leap/webapp/log':
       ensure  => directory,
       owner   => leap-webapp,
diff --git a/puppet/modules/site_webapp/manifests/cron.pp b/puppet/modules/site_webapp/manifests/cron.pp
index 811ad11d..bdf0fb74 100644
--- a/puppet/modules/site_webapp/manifests/cron.pp
+++ b/puppet/modules/site_webapp/manifests/cron.pp
@@ -2,6 +2,18 @@ class site_webapp::cron {
 
   # cron tasks that need to be performed to cleanup the database
   cron {
+    'rotate_databases':
+      command     => 'cd /srv/leap/webapp && bundle exec rake db:rotate',
+      environment => 'RAILS_ENV=production',
+      hour        => [0,6,12,18],
+      minute      => 0;
+
+    'delete_tmp_databases':
+      command     => 'cd /srv/leap/webapp && bundle exec rake db:deletetmp',
+      environment => 'RAILS_ENV=production',
+      hour        => 1,
+      minute      => 1;
+
     'remove_expired_sessions':
       command     => 'cd /srv/leap/webapp && bundle exec rake cleanup:sessions',
       environment => 'RAILS_ENV=production',
diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index ea64048b..5071d9bc 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -50,7 +50,7 @@ class site_webapp {
     owner    => 'leap-webapp',
     group    => 'leap-webapp',
     require  => [ User['leap-webapp'], Group['leap-webapp'] ],
-    notify   => Exec['bundler_update']
+    notify   => [ Exec['bundler_update'], Exec['rotate_dbs'] ]
   }
 
   exec { 'bundler_update':
@@ -67,6 +67,19 @@ class site_webapp {
     notify  => Service['apache'];
   }
 
+  # this only needs to be called before the first time the web app is run.
+  # after that, the cron job will take care of running db:rotate regularly.
+  exec { 'rotate_dbs':
+    cwd     => '/srv/leap/webapp',
+    command => '/bin/bash -c "RAILS_ENV=production /usr/bin/bundle exec rake db:rotate"',
+    user    => 'leap-webapp',
+    timeout => 600,
+    refreshonly => true,
+    require => [
+      Vcsrepo['/srv/leap/webapp'],
+      Class['site_config::ruby::dev']];
+  }
+
   #
   # NOTE: in order to support a webapp that is running on a subpath and not the
   # root of the domain assets:precompile needs to be run with
diff --git a/puppet/modules/site_webapp/templates/couchdb.admin.yml.erb b/puppet/modules/site_webapp/templates/couchdb.admin.yml.erb
new file mode 100644
index 00000000..a0921add
--- /dev/null
+++ b/puppet/modules/site_webapp/templates/couchdb.admin.yml.erb
@@ -0,0 +1,9 @@
+production:
+  prefix: ""
+  protocol: 'http'
+  host: <%= @couchdb_host %>
+  port: <%= @couchdb_port %>
+  auto_update_design_doc: false
+  username: <%= @couchdb_admin_user %>
+  password: <%= @couchdb_admin_password %>
+
-- 
cgit v1.2.3


From 1f3a09047dbc0b411fc78233301f8440957ee6b8 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Mon, 30 Mar 2015 22:33:39 -0700
Subject: set platform version 0.7

---
 platform.rb               | 2 +-
 provider_base/common.json | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/platform.rb b/platform.rb
index 1466b33c..2f7b36eb 100644
--- a/platform.rb
+++ b/platform.rb
@@ -4,7 +4,7 @@
 #
 
 Leap::Platform.define do
-  self.version = "0.6.1"
+  self.version = "0.7"
   self.compatible_cli = "1.6.3".."1.99"
 
   #
diff --git a/provider_base/common.json b/provider_base/common.json
index 6ad8a2e6..4a5406a0 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -75,12 +75,12 @@
     "tapicero": {
       "type": "git",
       "source": "https://leap.se/git/tapicero",
-      "revision": "origin/version/0.6.1"
+      "revision": "origin/version/0.7"
     },
     "webapp": {
       "type": "git",
       "source": "https://leap.se/git/leap_web",
-      "revision": "origin/version/0.6.1"
+      "revision": "origin/version/0.7"
     }
   }
 }
-- 
cgit v1.2.3


From a434d299225d4dfe6b2ef23859ab8d573e9a7575 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Tue, 31 Mar 2015 14:07:06 -0700
Subject: tapicero: make config compatible with 0.7

---
 puppet/modules/tapicero/templates/tapicero.yaml.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/tapicero/templates/tapicero.yaml.erb b/puppet/modules/tapicero/templates/tapicero.yaml.erb
index 40048a5e..fb3b93aa 100644
--- a/puppet/modules/tapicero/templates/tapicero.yaml.erb
+++ b/puppet/modules/tapicero/templates/tapicero.yaml.erb
@@ -17,7 +17,7 @@ connection:
 
 # file to store the last processed user record in so we can resume after
 # a restart:
-seq_file: "/var/lib/leap/tapicero/tapicero.seq"
+seq_dir: "/var/lib/leap/tapicero/"
 
 # Configure log_file like this if you want to log to a file instead of syslog:
 # log_file: "/var/leap/log/tapicero.log"
-- 
cgit v1.2.3


From de9d9526e799c19d16dc4451e1dc307d3073a9eb Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 1 Apr 2015 15:41:11 -0700
Subject: added CHANGES.md

---
 CHANGES.md | 68 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 README.md  | 10 ++++-----
 2 files changed, 72 insertions(+), 6 deletions(-)
 create mode 100644 CHANGES.md

diff --git a/CHANGES.md b/CHANGES.md
new file mode 100644
index 00000000..4382463b
--- /dev/null
+++ b/CHANGES.md
@@ -0,0 +1,68 @@
+Platform 0.7
+-------------------------------------
+
+CouchDB improvements: CouchDB is not designed to handle ephemeral data, like
+sessions, because documents are never really deleted (a tombstone document is
+always kept to record the deletion). To overcome this limitation, we now
+rotate the `sessions` and `tokens` databases monthly. The new database names
+are `tokens_XXX` and `sessions_XXX` where XXX is counter since the epoch that
+increments every month (not a calendar month, but a month's worth of seconds).
+
+Additionally, nagios monitor and `leap test run` now will create and destroy
+test users in the `tmp_users` database, which will get periodically deleted
+and recreated.
+
+Compatibility:
+
+* requires leap_cli version 1.7
+* requires bitmask client version >= 0.7
+
+Commits: https://leap.se/git/leap_platform.git/shortlog/refs/tags/0.7.0
+
+Upgrading:
+
+* `gem install leap_cli --version 1.7` or run leap_cli from current master branch.
+* `cd leap_platform; git pull; git checkout 0.7.0` or checkout current master branch.
+* `leap deploy`
+* `leap db destroy --db sessions,tokens` You can ignore message about needing
+  to redeploy (since, in this case, we just want to permanently delete those
+  databases).
+
+New features:
+
+* rotating couchdb databases
+* deployment logging: information on every deploy is logged to
+  `/var/log/leap`, including the user, leap_cli version, and platform version.
+* you must now run `leap deploy --downgrade` if you want to deploy an older
+  version over a newer platform version.
+* the install source each custom daemons (e.g. tapicero, etc) is now
+  configured on `common.json`.
+* you can configure apt sources in common.json
+* many bug fixes
+
+Platform 0.6
+-------------------------------------
+
+Compatibility:
+
+* requires leap_cli version 1.6
+* requires bitmask client version >= 0.5
+
+Commits: https://leap.se/git/leap_platform.git/shortlog/refs/tags/0.6.0
+
+New features:
+
+* single node deployment
+* include custom puppet modules and manifests
+* couch flexibility
+* stunnel rework
+* new debian repository structure
+* dependency pinning
+* leap_cli modularization
+* improved cert generation
+* monitoring improvements such as per-environment tooling and notifications
+* tor hidden service support
+* switch away from NIST curve and ensure TLSv1 is used
+* tests made significantly more robust
+* add support for webapp deployment to a subdomain
+* many, many bugfixes and stability improvements
diff --git a/README.md b/README.md
index a64962ca..9b33e9e8 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ You can't deploy new couchdb nodes after one or more have been deployed. Make *s
 User setup and ssh
 ------------------
 
-. if you aren't using a single ssh key, but have different ones, you will need to define the following at the top of your ~/.ssh/config: 
+. if you aren't using a single ssh key, but have different ones, you will need to define the following at the top of your ~/.ssh/config:
   HostName <ip address>
   IdentityFile <path to identity file>
 
@@ -52,7 +52,7 @@ User setup and ssh
 
 . At the moment, only ECDSA ssh host keys are supported. If you get the following error: `= FAILED ssh-keyscan: no hostkey alg (must be missing an ecdsa public host key)` then you should confirm that you have the following line defined in your server's **/etc/ssh/sshd_config**: `HostKey /etc/ssh/ssh_host_ecdsa_key`. If that file doesn't exist, run `ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N ""` in order to create it. If you made a change to your sshd_config, then you need to run `/etc/init.d/ssh restart` (see: https://leap.se/code/issues/2373)
 
-. To remove an admin's access to your servers, please remove the directory for that user under the `users/` subdirectory in your provider directory and then remove that user's ssh keys from files/ssh/authorized_keys. When finished you *must* run a `leap deploy` to update that information on the servers. 
+. To remove an admin's access to your servers, please remove the directory for that user under the `users/` subdirectory in your provider directory and then remove that user's ssh keys from files/ssh/authorized_keys. When finished you *must* run a `leap deploy` to update that information on the servers.
 
 . At the moment, it is only possible to add an admin who will have access to all LEAP servers (see: https://leap.se/code/issues/2280)
 
@@ -85,12 +85,10 @@ In order to validate the syntax and style guide compliance
 before you commit, see https://github.com/pixelated-project/puppet-git-hooks#installation
 
 
-Changelog
+Changes
 =========
 
-For a changelog of the current branch:
-
-    git log
+Read CHANGES.md or run `git log`.
 
 Authors and Credits
 ===================
-- 
cgit v1.2.3


From 0215d430334b5f155dc0f6c193ed0103672d3069 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 1 Apr 2015 16:01:51 -0700
Subject: always use full domain for FACTOR_fqdn (closes #6700)

---
 bin/puppet_command | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bin/puppet_command b/bin/puppet_command
index bc4bfc5b..ce56fe51 100755
--- a/bin/puppet_command
+++ b/bin/puppet_command
@@ -132,7 +132,7 @@ def puppet_apply(options={}, &block)
   options = {:verbosity => @verbosity, :tags => @tags}.merge(options)
   manifest = options[:manifest] || SITE_MANIFEST
   modulepath = options[:module_path] || SITE_MODULES + CUSTOM_MODULES
-  fqdn = hiera_file['domain']['name']
+  fqdn = hiera_file['domain']['full']
   domain = hiera_file['domain']['full_suffix']
   Dir.chdir(PUPPET_DIRECTORY) do
     return run("FACTER_fqdn='#{fqdn}' FACTER_domain='#{domain}' #{PUPPET_BIN} apply #{custom_parameters(options)} --modulepath='#{modulepath}' #{PUPPET_PARAMETERS} #{manifest}", &block)
-- 
cgit v1.2.3


From eeb5fd763d7f78d6dcff252981cc9e38dd446fa6 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 1 Apr 2015 22:26:56 -0700
Subject: run check_mk tests every 10 minutes

---
 puppet/modules/site_check_mk/files/extra_service_conf.mk | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/puppet/modules/site_check_mk/files/extra_service_conf.mk b/puppet/modules/site_check_mk/files/extra_service_conf.mk
index 61b0dd39..a4c6e769 100644
--- a/puppet/modules/site_check_mk/files/extra_service_conf.mk
+++ b/puppet/modules/site_check_mk/files/extra_service_conf.mk
@@ -5,14 +5,10 @@ extra_service_conf["max_check_attempts"] = [
 ]
 
 #
-# run check_mk_agent every 2 minutes if it terminates successfully.
+# run check_mk_agent every 10 minutes if it terminates successfully.
 # see https://leap.se/code/issues/6539 for the rationale
 #
-# update: temporarily set interval to 60 minutes until we solve the
-#         issue with the users db getting bloated with deleted
-#         test users.
-#
 extra_service_conf["normal_check_interval"] = [
-  ("60", ALL_HOSTS , "Check_MK" )
+  ("10", ALL_HOSTS , "Check_MK" )
 ]
 
-- 
cgit v1.2.3


From f8c359d8795d216dd5ce1cc9e3e14b3b7933a718 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 2 Apr 2015 15:46:16 -0700
Subject: static: restart apache when tls certs change

---
 puppet/modules/site_static/manifests/domain.pp | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/puppet/modules/site_static/manifests/domain.pp b/puppet/modules/site_static/manifests/domain.pp
index 6941b1a3..b9177f25 100644
--- a/puppet/modules/site_static/manifests/domain.pp
+++ b/puppet/modules/site_static/manifests/domain.pp
@@ -12,9 +12,18 @@ define site_static::domain (
 
   create_resources(site_static::location, $locations)
 
-  x509::cert { $domain: content => $cert }
-  x509::key  { $domain: content => $key }
-  x509::ca   { "${domain}_ca": content => $ca_cert }
+  x509::cert { $domain:
+    content => $cert,
+    notify => Service[apache]
+  }
+  x509::key { $domain:
+    content => $key,
+    notify => Service[apache]
+  }
+  x509::ca { "${domain}_ca":
+    content => $ca_cert,
+    notify => Service[apache]
+  }
 
   apache::vhost::file { $domain:
     content => template('site_static/apache.conf.erb')
-- 
cgit v1.2.3


From 6019eff30ef839e5c6a603fde7fe3fc98d4d4f47 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sun, 1 Mar 2015 10:16:44 +0100
Subject: added local check_mk couchdb script (#6749)

leap_couch_stats.sh is a local check_mk agent script
which provides per-db stats as well as global stats.

Change-Id: I1eba19a3a0210d3127acbad119dfd2918414ff4a
---
 .../agent/local_checks/couchdb/leap_couch_stats.sh | 106 +++++++++++++++++++++
 .../site_check_mk/manifests/agent/couchdb.pp       |   7 ++
 2 files changed, 113 insertions(+)
 create mode 100755 puppet/modules/site_check_mk/files/agent/local_checks/couchdb/leap_couch_stats.sh

diff --git a/puppet/modules/site_check_mk/files/agent/local_checks/couchdb/leap_couch_stats.sh b/puppet/modules/site_check_mk/files/agent/local_checks/couchdb/leap_couch_stats.sh
new file mode 100755
index 00000000..51a8ac52
--- /dev/null
+++ b/puppet/modules/site_check_mk/files/agent/local_checks/couchdb/leap_couch_stats.sh
@@ -0,0 +1,106 @@
+#!/bin/bash
+#
+# todo:
+#  - thresholds
+#  - couch response time
+#  - make CURL/URL/DBLIST_EXCLUDE vars configurable
+#  - move load_nagios_utils() to helper library so we can use it from multiple scripts
+
+start_time=$(date +%s.%N)
+
+CURL='curl -s --netrc-file /etc/couchdb/couchdb.netrc'
+URL='http://127.0.0.1:5984'
+TMPFILE=$(mktemp)
+DBLIST_EXCLUDE='user-'
+PREFIX='Couchdb_'
+
+
+load_nagios_utils () {
+  # load the nagios utils
+  # in debian, the package nagios-plugins-common installs utils.sh to /usr/lib/nagios/plugins/utils.sh
+  utilsfn=
+  for d in $PROGPATH /usr/lib/nagios/plugins /usr/lib64/nagios/plugins /usr/local/nagios/libexec /opt/nagios-plugins/libexec . ; do
+    if [ -f "$d/utils.sh" ]; then
+      utilsfn=$d/utils.sh;
+    fi
+  done
+  if [ "$utilsfn" = "" ]; then
+    echo "UNKNOWN - cannot find utils.sh (part of nagios plugins)";
+    exit 3;
+  fi
+  . "$utilsfn";
+  STATE[$STATE_OK]='OK'
+  STATE[$STATE_WARNING]='Warning'
+  STATE[$STATE_CRITICAL]='Critical'
+  STATE[$STATE_UNKNOWN]='Unknown'
+  STATE[$STATE_DEPENDENT]='Dependend'
+}
+
+get_global_stats_perf () {
+  trap "localexit=3" ERR
+  local localexit db_count
+  localexit=0
+
+  # get a list of all dbs
+  $CURL -X GET $URL/_all_dbs | json_pp | egrep -v '(\[|\])' > $TMPFILE
+
+  db_count=$( wc -l < $TMPFILE)
+  excluded_db_count=$( grep -c "$DBLIST_EXCLUDE" $TMPFILE )
+
+  echo "db_count=$db_count|excluded_db_count=$excluded_db_count"
+  return ${localexit}
+}
+
+db_stats () {
+  trap "localexit=3" ERR
+  local db db_stats doc_count del_doc_count localexit
+  localexit=0
+
+  db=$1
+  perf="$perf|${db}_docs=$( $CURL -s -X GET ${URL}/$db | json_pp |grep 'doc_count' | sed 's/[^0-9]//g' )"
+  db_stats=$( $CURL -s -X GET ${URL}/$db | json_pp )
+
+  doc_count=$( echo "$db_stats" | grep 'doc_count' | grep -v 'deleted_doc_count' | sed 's/[^0-9]//g' )
+  del_doc_count=$( echo "$db_stats" | grep 'doc_del_count' | sed 's/[^0-9]//g' )
+
+  # don't divide by zero
+  if [ $del_doc_count -eq 0 ]
+  then
+    del_doc_perc=0
+  else
+    del_doc_perc=$(( del_doc_count * 100 / doc_count ))
+  fi
+
+  bytes=$( echo "$db_stats" | grep disk_size | sed 's/[^0-9]//g' )
+  disk_size=$( echo "scale = 2; $bytes / 1024 / 1024" | bc -l )
+
+  echo -n "${localexit} ${PREFIX}${db}_database ${db}_docs=$doc_count|${db}_deleted_docs=$del_doc_count|${db}_deleted_docs_percentage=${del_doc_perc}%"
+  printf "|${db}_disksize_mb=%02.2fmb ${STATE[localexit]}: database $db\n" "$disk_size"
+
+  return ${localexit}
+}
+
+# main
+
+load_nagios_utils
+
+# per-db stats
+# get a list of all dbs
+$CURL -X GET $URL/_all_dbs | json_pp | egrep -v '(\[|\])' > $TMPFILE
+
+# get list of dbs to check
+dbs=$( grep -v "${DBLIST_EXCLUDE}" $TMPFILE | tr -d '\n"' | sed 's/,/ /g' )
+
+for db in $dbs
+do
+  db_stats "$db"
+done
+
+# show global couchdb stats
+global_stats_perf=$(get_global_stats_perf)
+exitcode=$?
+
+end_time=$(date +%s.%N)
+duration=$( echo "scale = 2; $end_time - $start_time" | bc -l )
+
+printf "${exitcode} ${PREFIX}global_stats ${global_stats_perf}|script_duration=%02.2fs ${STATE[exitcode]}: global couchdb status\n" "$duration"
diff --git a/puppet/modules/site_check_mk/manifests/agent/couchdb.pp b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
index 2dfe16fa..abfc7ad0 100644
--- a/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/couchdb.pp
@@ -45,4 +45,11 @@ class site_check_mk::agent::couchdb {
       require => File['/etc/check_mk/mrpe.cfg'];
   }
 
+
+  # check different couchdb stats
+  file { '/usr/lib/check_mk_agent/local/leap_couch_stats.sh':
+    source  => 'puppet:///modules/site_check_mk/agent/local_checks/couchdb/leap_couch_stats.sh',
+    mode    => '0755',
+    require => Package['check_mk-agent']
+  }
 }
-- 
cgit v1.2.3


From c79e0282d5b5db3aba0167f13648ccc676fcb96b Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Tue, 7 Apr 2015 09:49:52 -0700
Subject: rotate deploy logs by size instead of by date.

---
 bin/puppet_command                             | 30 +++++++++++++++-----------
 puppet/modules/site_config/manifests/syslog.pp | 20 +++++++++++++++--
 2 files changed, 36 insertions(+), 14 deletions(-)

diff --git a/bin/puppet_command b/bin/puppet_command
index ce56fe51..1e74522a 100755
--- a/bin/puppet_command
+++ b/bin/puppet_command
@@ -24,6 +24,7 @@ HIERA_FILE        = '/etc/leap/hiera.yaml'
 LOG_DIR           = '/var/log/leap'
 DEPLOY_LOG        = '/var/log/leap/deploy.log'
 SUMMARY_LOG       = '/var/log/leap/deploy-summary.log'
+SUMMARY_LOG_1     = '/var/log/leap/deploy-summary.log.1'
 APPLY_START_STR   = "STARTING APPLY"
 APPLY_FINISH_STR  = "APPLY COMPLETE"
 
@@ -161,18 +162,23 @@ end
 #
 PLATFORM_RE = /\{.*platform: ([0-9\.]+)[ ,\}].*[\}$]/
 def platform_version_check!
-  if @info["platform"]
-    new_version = @info["platform"].split(' ').first
-    if File.exists?(SUMMARY_LOG) && new_version
-      most_recent_line = `tail '#{SUMMARY_LOG}'`.split("\n").grep(PLATFORM_RE).last
-      if most_recent_line
-        prior_version = most_recent_line.match(PLATFORM_RE)[1]
-        if Gem::Version.new(prior_version) > Gem::Version.new(new_version)
-          log("ERROR: You are attempting to deploy platform v#{new_version} but this node uses v#{prior_version}.")
-          log("       Run with --downgrade if you really want to deploy an older platform version.")
-          exit(0)
-        end
-      end
+  return unless @info["platform"]
+  new_version = @info["platform"].split(' ').first
+  return unless new_version
+  if File.exists?(SUMMARY_LOG) && File.size(SUMMARY_LOG) != 0
+    file = SUMMARY_LOG
+  elsif File.exists?(SUMMARY_LOG_1) && File.size(SUMMARY_LOG_1) != 0
+    file = SUMMARY_LOG_1
+  else
+    return
+  end
+  most_recent_line = `tail '#{file}'`.split("\n").grep(PLATFORM_RE).last
+  if most_recent_line
+    prior_version = most_recent_line.match(PLATFORM_RE)[1]
+    if Gem::Version.new(prior_version) > Gem::Version.new(new_version)
+      log("ERROR: You are attempting to deploy platform v#{new_version} but this node uses v#{prior_version}.")
+      log("       Run with --downgrade if you really want to deploy an older platform version.")
+      exit(0)
     end
   end
 end
diff --git a/puppet/modules/site_config/manifests/syslog.pp b/puppet/modules/site_config/manifests/syslog.pp
index 1b0c1e05..83b49c8e 100644
--- a/puppet/modules/site_config/manifests/syslog.pp
+++ b/puppet/modules/site_config/manifests/syslog.pp
@@ -15,8 +15,24 @@ action(type="mmanon" ipv4.bits="32" mode="rewrite")'
   augeas {
     'logrotate_leap_deploy':
       context => '/files/etc/logrotate.d/leap_deploy/rule',
-      changes => [ 'set file /var/log/leap/deploy*.log', 'set rotate 7',
-                   'set schedule daily', 'set compress compress',
+      changes => [ 'set file /var/log/leap/deploy.log',
+                   'set rotate 5',
+                   'set size 1M',
+                   'set compress compress',
+                   'set missingok missingok',
+                   'set copytruncate copytruncate' ];
+
+    # NOTE:
+    # the puppet_command script requires the option delaycompress
+    # be set on the summary log file.
+
+    'logrotate_leap_deploy_summary':
+      context => '/files/etc/logrotate.d/leap_deploy_summary/rule',
+      changes => [ 'set file /var/log/leap/deploy-summary.log',
+                   'set rotate 5',
+                   'set size 100k',
+                   'set delaycompress delaycompress',
+                   'set compress compress',
                    'set missingok missingok',
                    'set copytruncate copytruncate' ]
   }
-- 
cgit v1.2.3


From 424fd79912c760d734f606602aa81e26d44937e1 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 7 Apr 2015 16:20:39 -0400
Subject: Disable passenger when pnp4nagios is being fetched, this is part of

Change-Id: I21e9af3ef76f19924e58df5b40f4097d42fbf1cd
---
 puppet/modules/site_apache/templates/vhosts.d/common.conf.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
index 43bd1076..ee5cd707 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
@@ -57,7 +57,7 @@
 
 
 <% if (defined? @services) and (@services.include? 'monitor') -%>
- <DirectoryMatch (/usr/share/nagios3/htdocs|/usr/lib/cgi-bin/nagios3|/etc/nagios3/stylesheets)>
+ <DirectoryMatch (/usr/share/nagios3/htdocs|/usr/lib/cgi-bin/nagios3|/etc/nagios3/stylesheets|/usr/share/pnp4nagios)>
  <% if (defined? @services) and (@services.include? 'webapp') -%>
     PassengerEnabled off
  <% end -%>
-- 
cgit v1.2.3


From 75bdd84d642491166fa90ecff117e679b4af334a Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 8 Apr 2015 17:42:43 +0200
Subject: Fix for Tapicero heartbeat check that fails on days 1-9 of the month
 (#6832)

Change-Id: If9e17de438a4a6ac8e68877bfe0c5d13d45386ee
---
 puppet/modules/site_nagios/files/plugins/check_last_regex_in_log | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/site_nagios/files/plugins/check_last_regex_in_log b/puppet/modules/site_nagios/files/plugins/check_last_regex_in_log
index cf7c03e5..47569388 100755
--- a/puppet/modules/site_nagios/files/plugins/check_last_regex_in_log
+++ b/puppet/modules/site_nagios/files/plugins/check_last_regex_in_log
@@ -50,7 +50,7 @@ done
 [ $warn -eq 0 -o $crit -eq 0 -o -z "$regex" -o -z "$log" ] && ( usage; exit $STATE_UNKNOWN)
 [ -f "$log" ] || (echo "$log doesn't exist"; exit $STATE_UNKNOWN)
 
-lastmsg=$(tac $log | grep -i $regex | head -1 | cut -d' ' -f 1-3)
+lastmsg=$(tac $log | grep -i $regex | head -1 |  sed 's/  / /g' | cut -d' ' -f 1-3)
 
 if [ -z "$lastmsg" ]
 then
-- 
cgit v1.2.3


From 27cd49653769979c3797df340d761a184cea0fec Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 7 Apr 2015 16:20:39 -0400
Subject: Disable passenger when pnp4nagios is being fetched, this is part of

Change-Id: I21e9af3ef76f19924e58df5b40f4097d42fbf1cd
---
 puppet/modules/site_apache/templates/vhosts.d/common.conf.erb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
index 43bd1076..ee5cd707 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
@@ -57,7 +57,7 @@
 
 
 <% if (defined? @services) and (@services.include? 'monitor') -%>
- <DirectoryMatch (/usr/share/nagios3/htdocs|/usr/lib/cgi-bin/nagios3|/etc/nagios3/stylesheets)>
+ <DirectoryMatch (/usr/share/nagios3/htdocs|/usr/lib/cgi-bin/nagios3|/etc/nagios3/stylesheets|/usr/share/pnp4nagios)>
  <% if (defined? @services) and (@services.include? 'webapp') -%>
     PassengerEnabled off
  <% end -%>
-- 
cgit v1.2.3


From 5f237d891bebe8ac822e5a8182da0458ae0c10ef Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 8 Apr 2015 18:09:52 +0200
Subject: updated submodule nagios

Change-Id: I48aca2241b9f5b140723d1967a38dc2cd8bfc05f
---
 puppet/modules/nagios | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/nagios b/puppet/modules/nagios
index aaf9e3df..300f1d39 160000
--- a/puppet/modules/nagios
+++ b/puppet/modules/nagios
@@ -1 +1 @@
-Subproject commit aaf9e3df1c184c934f014f1003d8c2e2776b2b71
+Subproject commit 300f1d39682d47e7bcc66b82f21dec15bb41b4e9
-- 
cgit v1.2.3


From 7bb8b2e0685b3738c7842e86c09b826c2732e8bd Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 8 Apr 2015 20:36:27 +0200
Subject: set the 'logoutput' parameter for any exec type to 'on_error'

Change-Id: I04c796a502db52f3a594ef4c3cf08c330839bc13
---
 puppet/modules/site_config/manifests/default.pp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index aa49f930..c15080f5 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -1,6 +1,10 @@
 class site_config::default {
   tag 'leap_base'
 
+  # the logoutput exec parameter defaults to "on_error" in puppet 3,
+  # but to "false" in puppet 2.7, so we need to set this globally here
+  Exec<||> { logoutput => on_failure }
+
   $services    = hiera('services', [])
   $domain_hash = hiera('domain')
   include site_config::params
-- 
cgit v1.2.3


From e3cfc2e1e7055ce2640fcce5bf810d6bd7930d2f Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 8 Apr 2015 13:58:41 -0700
Subject: move rotated db creation to site_couchdb and fix rotated db tests

---
 .../site_couchdb/files/designs/tmp_users/User.json |  1 -
 .../lib/puppet/parser/functions/rotated_db_name.rb | 24 ++++++++++++++++
 .../modules/site_couchdb/manifests/create_dbs.pp   | 20 ++++++++++---
 puppet/modules/site_couchdb/manifests/designs.pp   | 33 +++++++++++++++++++---
 .../site_couchdb/manifests/upload_design.pp        | 13 +++++++++
 puppet/modules/site_webapp/manifests/init.pp       | 15 +---------
 .../modules/tapicero/templates/tapicero.yaml.erb   |  3 +-
 tests/white-box/couchdb.rb                         | 18 ++++++------
 8 files changed, 95 insertions(+), 32 deletions(-)
 delete mode 120000 puppet/modules/site_couchdb/files/designs/tmp_users/User.json
 create mode 100644 puppet/modules/site_couchdb/lib/puppet/parser/functions/rotated_db_name.rb
 create mode 100644 puppet/modules/site_couchdb/manifests/upload_design.pp

diff --git a/puppet/modules/site_couchdb/files/designs/tmp_users/User.json b/puppet/modules/site_couchdb/files/designs/tmp_users/User.json
deleted file mode 120000
index ed3d0af9..00000000
--- a/puppet/modules/site_couchdb/files/designs/tmp_users/User.json
+++ /dev/null
@@ -1 +0,0 @@
-../users/User.json
\ No newline at end of file
diff --git a/puppet/modules/site_couchdb/lib/puppet/parser/functions/rotated_db_name.rb b/puppet/modules/site_couchdb/lib/puppet/parser/functions/rotated_db_name.rb
new file mode 100644
index 00000000..6458ae81
--- /dev/null
+++ b/puppet/modules/site_couchdb/lib/puppet/parser/functions/rotated_db_name.rb
@@ -0,0 +1,24 @@
+module Puppet::Parser::Functions
+  newfunction(:rotated_db_name, :type => :rvalue, :doc => <<-EOS
+This function takes a database name string and returns a database name with the current rotation stamp appended.
+The first argument is the base name of the database. Subsequent arguments may contain these options:
+  * 'next'    -- return the db name for the next rotation, not the current one.
+  * 'monthly' -- rotate monthly (default)
+  * 'weekly'  -- rotate weekly
+*Examples:*
+    rotated_db_name('tokens') => 'tokens_551'
+    EOS
+  ) do |arguments|
+    if arguments.include?('weekly')
+      rotation_period = 604800 # 1 week
+    else
+      rotation_period = 2592000 # 1 month
+    end
+    suffix = Time.now.utc.to_i / rotation_period
+    if arguments.include?('next')
+      suffix += 1
+    end
+    "#{arguments.first}_#{suffix}"
+  end
+end
+
diff --git a/puppet/modules/site_couchdb/manifests/create_dbs.pp b/puppet/modules/site_couchdb/manifests/create_dbs.pp
index f9a08807..b743127a 100644
--- a/puppet/modules/site_couchdb/manifests/create_dbs.pp
+++ b/puppet/modules/site_couchdb/manifests/create_dbs.pp
@@ -4,8 +4,6 @@ class site_couchdb::create_dbs {
     -> Class['site_couchdb::bigcouch::settle_cluster']
     -> Class['site_couchdb::create_dbs']
 
-  # Couchdb databases
-
   ### customer database
   ### r/w: webapp,
   couchdb::create_db { 'customers':
@@ -30,7 +28,14 @@ class site_couchdb::create_dbs {
 
   ## sessions database
   ## r/w: webapp
-  couchdb::create_db { 'sessions':
+  $sessions_db = rotated_db_name('sessions', 'monthly')
+  couchdb::create_db { $sessions_db:
+    members => "{ \"names\": [\"$site_couchdb::couchdb_webapp_user\"], \"roles\": [\"replication\"] }",
+    require => Couchdb::Query::Setup['localhost']
+  }
+
+  $sessions_next_db = rotated_db_name('sessions', 'monthly', 'next')
+  couchdb::create_db { $sessions_next_db:
     members => "{ \"names\": [\"$site_couchdb::couchdb_webapp_user\"], \"roles\": [\"replication\"] }",
     require => Couchdb::Query::Setup['localhost']
   }
@@ -52,7 +57,14 @@ class site_couchdb::create_dbs {
   ## tokens database
   ## r: soledad - needs to be restricted with a design document
   ## r/w: webapp
-  couchdb::create_db { 'tokens':
+  $tokens_db = rotated_db_name('tokens', 'monthly')
+  couchdb::create_db { $tokens_db:
+    members => "{ \"names\": [], \"roles\": [\"replication\", \"tokens\"] }",
+    require => Couchdb::Query::Setup['localhost']
+  }
+
+  $tokens_next_db = rotated_db_name('tokens', 'monthly', 'next')
+  couchdb::create_db { $tokens_next_db:
     members => "{ \"names\": [], \"roles\": [\"replication\", \"tokens\"] }",
     require => Couchdb::Query::Setup['localhost']
   }
diff --git a/puppet/modules/site_couchdb/manifests/designs.pp b/puppet/modules/site_couchdb/manifests/designs.pp
index 9e88de64..1ab1c6a1 100644
--- a/puppet/modules/site_couchdb/manifests/designs.pp
+++ b/puppet/modules/site_couchdb/manifests/designs.pp
@@ -11,10 +11,35 @@ class site_couchdb::designs {
     mode    => '0755'
   }
 
-  exec { '/srv/leap/couchdb/scripts/load_design_documents.sh':
-    require     => Vcsrepo['/srv/leap/couchdb/scripts'],
-    refreshonly => false
+  site_couchdb::upload_design {
+    'customers':   design => 'customers/Customer.json';
+    'identities':  design => 'identities/Identity.json';
+    'tickets':     design => 'tickets/Ticket.json';
+    'messages':    design => 'messages/Message.json';
+    'users':       design => 'users/User.json';
+    'tmp_users':   design => 'users/User.json';
+    'shared_docs':
+      db => 'shared',
+      design => 'shared/docs.json';
+    'shared_syncs':
+      db => 'shared',
+      design => 'shared/syncs.json';
+    'shared_transactions':
+      db => 'shared',
+      design => 'shared/transactions.json';
   }
 
-}
+  $sessions_db      = rotated_db_name('sessions', 'monthly')
+  $sessions_next_db = rotated_db_name('sessions', 'monthly', 'next')
+  site_couchdb::upload_design {
+    $sessions_db:       design => 'sessions/Session.json';
+    $sessions_next_db:  design => 'sessions/Session.json';
+  }
 
+  $tokens_db       = rotated_db_name('tokens', 'monthly')
+  $tokens_next_db  = rotated_db_name('tokens', 'monthly', 'next')
+  site_couchdb::upload_design {
+    $tokens_db:      design => 'tokens/Token.json';
+    $tokens_next_db: design => 'tokens/Token.json';
+  }
+}
diff --git a/puppet/modules/site_couchdb/manifests/upload_design.pp b/puppet/modules/site_couchdb/manifests/upload_design.pp
new file mode 100644
index 00000000..7b0cabd7
--- /dev/null
+++ b/puppet/modules/site_couchdb/manifests/upload_design.pp
@@ -0,0 +1,13 @@
+define site_couchdb::upload_design($db = $title, $design) {
+  $design_name = regsubst($design, '^.*\/(.*)\.json$', '\1')
+  $id = "_design/${design_name}"
+  $file = "/srv/leap/couchdb/designs/${design}"
+  exec {
+    "upload_design_${name}":
+      command => "/usr/local/bin/couch-doc-update --host 127.0.0.1:5984 --db '${db}' --id '${id}' --data '{}' --file '${file}'",
+      refreshonly => false,
+      loglevel => debug,
+      logoutput => on_failure,
+      require => File['/srv/leap/couchdb/designs'];
+  }
+}
diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index 5071d9bc..ea64048b 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -50,7 +50,7 @@ class site_webapp {
     owner    => 'leap-webapp',
     group    => 'leap-webapp',
     require  => [ User['leap-webapp'], Group['leap-webapp'] ],
-    notify   => [ Exec['bundler_update'], Exec['rotate_dbs'] ]
+    notify   => Exec['bundler_update']
   }
 
   exec { 'bundler_update':
@@ -67,19 +67,6 @@ class site_webapp {
     notify  => Service['apache'];
   }
 
-  # this only needs to be called before the first time the web app is run.
-  # after that, the cron job will take care of running db:rotate regularly.
-  exec { 'rotate_dbs':
-    cwd     => '/srv/leap/webapp',
-    command => '/bin/bash -c "RAILS_ENV=production /usr/bin/bundle exec rake db:rotate"',
-    user    => 'leap-webapp',
-    timeout => 600,
-    refreshonly => true,
-    require => [
-      Vcsrepo['/srv/leap/webapp'],
-      Class['site_config::ruby::dev']];
-  }
-
   #
   # NOTE: in order to support a webapp that is running on a subpath and not the
   # root of the domain assets:precompile needs to be run with
diff --git a/puppet/modules/tapicero/templates/tapicero.yaml.erb b/puppet/modules/tapicero/templates/tapicero.yaml.erb
index fb3b93aa..8b08b49c 100644
--- a/puppet/modules/tapicero/templates/tapicero.yaml.erb
+++ b/puppet/modules/tapicero/templates/tapicero.yaml.erb
@@ -20,7 +20,8 @@ connection:
 seq_dir: "/var/lib/leap/tapicero/"
 
 # Configure log_file like this if you want to log to a file instead of syslog:
-# log_file: "/var/leap/log/tapicero.log"
+#log_file: "/var/log/leap/tapicero.log"
+#log_level: debug
 log_level: info
 
 # tapicero specific options
diff --git a/tests/white-box/couchdb.rb b/tests/white-box/couchdb.rb
index 450c4201..d0f5ce88 100644
--- a/tests/white-box/couchdb.rb
+++ b/tests/white-box/couchdb.rb
@@ -82,7 +82,10 @@ class CouchDB < LeapTest
   end
 
   def test_05_Do_required_databases_exist?
-    dbs_that_should_exist = ["customers","identities","keycache","sessions","shared","tickets","tokens","users"]
+    dbs_that_should_exist = ["customers","identities","keycache","shared","tickets","users", "tmp_users"]
+    rotation_suffix = Time.now.utc.to_i / 2592000 # monthly
+    dbs_that_should_exist << "tokens_#{rotation_suffix}"
+    dbs_that_should_exist << "sessions_#{rotation_suffix}"
     dbs_that_should_exist.each do |db_name|
       url = couchdb_url("/"+db_name, :username => 'admin')
       assert_get(url) do |body|
@@ -113,9 +116,9 @@ class CouchDB < LeapTest
   #end
 
   def test_07_Can_records_be_created?
-    token = Token.new
-    url = couchdb_url("/tokens", :username => 'admin')
-    assert_post(url, token, :format => :json) do |body|
+    record = DummyRecord.new
+    url = couchdb_url("/tmp_users", :username => 'admin')
+    assert_post(url, record, :format => :json) do |body|
       assert response = JSON.parse(body), "POST response should be JSON"
       assert response["ok"], "POST response should be OK"
       assert_delete(File.join(url, response["id"]), :rev => response["rev"]) do |body|
@@ -144,11 +147,10 @@ class CouchDB < LeapTest
 
   require 'securerandom'
   require 'digest/sha2'
-  class Token < Hash
+  class DummyRecord < Hash
     def initialize
-      self['token'] = SecureRandom.urlsafe_base64(32).gsub(/^_*/, '')
-      self['_id'] = Digest::SHA512.hexdigest(self['token'])
-      self['last_seen_at'] = Time.now
+      self['data'] = SecureRandom.urlsafe_base64(32).gsub(/^_*/, '')
+      self['_id'] = Digest::SHA512.hexdigest(self['data'])
     end
   end
 
-- 
cgit v1.2.3


From 051b80d25bd0fe400769976c3210718689f832b4 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 9 Apr 2015 09:38:56 -0700
Subject: fix tests (don't dump dummy records in tmp_users)

---
 tests/white-box/couchdb.rb | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tests/white-box/couchdb.rb b/tests/white-box/couchdb.rb
index d0f5ce88..5ee12ff3 100644
--- a/tests/white-box/couchdb.rb
+++ b/tests/white-box/couchdb.rb
@@ -83,7 +83,6 @@ class CouchDB < LeapTest
 
   def test_05_Do_required_databases_exist?
     dbs_that_should_exist = ["customers","identities","keycache","shared","tickets","users", "tmp_users"]
-    rotation_suffix = Time.now.utc.to_i / 2592000 # monthly
     dbs_that_should_exist << "tokens_#{rotation_suffix}"
     dbs_that_should_exist << "sessions_#{rotation_suffix}"
     dbs_that_should_exist.each do |db_name|
@@ -117,7 +116,7 @@ class CouchDB < LeapTest
 
   def test_07_Can_records_be_created?
     record = DummyRecord.new
-    url = couchdb_url("/tmp_users", :username => 'admin')
+    url = couchdb_url("/tokens_#{rotation_suffix}", :username => 'admin')
     assert_post(url, record, :format => :json) do |body|
       assert response = JSON.parse(body), "POST response should be JSON"
       assert response["ok"], "POST response should be OK"
@@ -145,6 +144,10 @@ class CouchDB < LeapTest
     couchdb_url(path, options)
   end
 
+  def rotation_suffix
+    rotation_suffix = Time.now.utc.to_i / 2592000 # monthly
+  end
+
   require 'securerandom'
   require 'digest/sha2'
   class DummyRecord < Hash
-- 
cgit v1.2.3


From 1db40688123b681d2c0cd1d20140cacb2916c396 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Tue, 14 Apr 2015 13:33:33 -0700
Subject: minor edits to CHANGES file.

---
 CHANGES.md | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 4382463b..7d2fe3f3 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -14,8 +14,9 @@ and recreated.
 
 Compatibility:
 
-* requires leap_cli version 1.7
-* requires bitmask client version >= 0.7
+* Requires leap_cli version 1.7
+* Requires bitmask client version >= 0.7
+* Previous releases supported cookies when using the provider API. Now, only tokens are supported.
 
 Commits: https://leap.se/git/leap_platform.git/shortlog/refs/tags/0.7.0
 
@@ -45,8 +46,8 @@ Platform 0.6
 
 Compatibility:
 
-* requires leap_cli version 1.6
-* requires bitmask client version >= 0.5
+* Requires leap_cli version 1.6
+* Requires bitmask client version >= 0.5
 
 Commits: https://leap.se/git/leap_platform.git/shortlog/refs/tags/0.6.0
 
-- 
cgit v1.2.3


From 00ff465519e2ac6d6c1b9beddbe5e51937d4825a Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 15 Apr 2015 03:16:59 -0700
Subject: disable 'rake cleanup:sessions' cron job.

---
 puppet/modules/site_webapp/manifests/cron.pp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/puppet/modules/site_webapp/manifests/cron.pp b/puppet/modules/site_webapp/manifests/cron.pp
index bdf0fb74..d26ee312 100644
--- a/puppet/modules/site_webapp/manifests/cron.pp
+++ b/puppet/modules/site_webapp/manifests/cron.pp
@@ -14,11 +14,14 @@ class site_webapp::cron {
       hour        => 1,
       minute      => 1;
 
+    # there is no longer a need to remove expired sessions, since the database
+    # will get destroyed.
     'remove_expired_sessions':
       command     => 'cd /srv/leap/webapp && bundle exec rake cleanup:sessions',
       environment => 'RAILS_ENV=production',
       hour        => 2,
-      minute      => 30;
+      minute      => 30,
+      ensure      => absent;
 
     'remove_expired_tokens':
       command     => 'cd /srv/leap/webapp && bundle exec rake cleanup:tokens',
-- 
cgit v1.2.3


From 7f069dc47c318e9047a3ae7a29a90f3471610e34 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 15 Apr 2015 09:36:30 -0700
Subject: fix tapicero & webapp logs: remove heartbeat log check, move to
 /var/log/tapicero, fix webapp logwatch location.

---
 .../files/agent/logwatch/syslog/tapicero.cfg       | 10 -------
 .../files/agent/logwatch/syslog/webapp.cfg         |  5 ----
 .../files/agent/logwatch/tapicero.cfg              | 11 ++++++++
 .../site_check_mk/files/agent/logwatch/webapp.cfg  |  6 +++++
 .../site_check_mk/manifests/agent/tapicero.pp      | 12 +++------
 .../site_check_mk/manifests/agent/webapp.pp        |  8 +++---
 puppet/modules/tapicero/manifests/init.pp          | 31 +++++++++++++++-------
 7 files changed, 45 insertions(+), 38 deletions(-)
 delete mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/syslog/tapicero.cfg
 delete mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/syslog/webapp.cfg
 create mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/tapicero.cfg
 create mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/webapp.cfg

diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/tapicero.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/syslog/tapicero.cfg
deleted file mode 100644
index e5721eea..00000000
--- a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/tapicero.cfg
+++ /dev/null
@@ -1,10 +0,0 @@
-# Ignore transient Tapicero errors when creating a db (#6511)
- I tapicero.*(Creating database|Checking security of|Writing security to|Uploading design doc to) user-.* failed (\(trying again soon\)|(twice )?due to): (RestClient::Resource Not Found|RestClient::InternalServerError): (404 Resource Not Found|500 Internal Server Error)
- C tapicero.*RestClient::InternalServerError:
-# possible race condition between multiple tapicero
-# instances, so we ignore it
-# see https://leap.se/code/issues/5168
- I tapicero.*RestClient::PreconditionFailed:
- C tapicero.*Creating database.*failed due to:
- C tapicero.*failed
- W tapicero.*Couch stream ended unexpectedly.
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/webapp.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/syslog/webapp.cfg
deleted file mode 100644
index 00f9c7fd..00000000
--- a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/webapp.cfg
+++ /dev/null
@@ -1,5 +0,0 @@
-# check for webapp errors
- C webapp.*Could not connect to couch database messages due to 401 Unauthorized: {"error":"unauthorized","reason":"You are not a server admin."}
-# ignore RoutingErrors that rails throw when it can't handle a url
-# see https://leap.se/code/issues/5173
- I webapp.*ActionController::RoutingError
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/tapicero.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/tapicero.cfg
new file mode 100644
index 00000000..f527f120
--- /dev/null
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/tapicero.cfg
@@ -0,0 +1,11 @@
+/var/log/leap/tapicero.log
+# Ignore transient Tapicero errors when creating a db (#6511)
+ I tapicero.*(Creating database|Checking security of|Writing security to|Uploading design doc to) user-.* failed (\(trying again soon\)|(twice )?due to): (RestClient::Resource Not Found|RestClient::InternalServerError): (404 Resource Not Found|500 Internal Server Error)
+ C tapicero.*RestClient::InternalServerError:
+# possible race condition between multiple tapicero
+# instances, so we ignore it
+# see https://leap.se/code/issues/5168
+ I tapicero.*RestClient::PreconditionFailed:
+ C tapicero.*Creating database.*failed due to:
+ C tapicero.*failed
+ W tapicero.*Couch stream ended unexpectedly.
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/webapp.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/webapp.cfg
new file mode 100644
index 00000000..008e9e09
--- /dev/null
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/webapp.cfg
@@ -0,0 +1,6 @@
+/var/log/leap/webapp.log
+# check for webapp errors
+ C webapp.*Could not connect to couch database messages due to 401 Unauthorized: {"error":"unauthorized","reason":"You are not a server admin."}
+# ignore RoutingErrors that rails throw when it can't handle a url
+# see https://leap.se/code/issues/5173
+ I webapp.*ActionController::RoutingError
diff --git a/puppet/modules/site_check_mk/manifests/agent/tapicero.pp b/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
index 5c14b460..9bdebe2a 100644
--- a/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
@@ -2,10 +2,9 @@ class site_check_mk::agent::tapicero {
 
   include ::site_nagios::plugins
 
-  concat::fragment { 'syslog_tapicero':
-    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/tapicero.cfg',
-    target  => '/etc/check_mk/logwatch.d/syslog.cfg',
-    order   => '02';
+  # watch logs
+  file { '/etc/check_mk/logwatch.d/tapicero.cfg':
+    source => 'puppet:///modules/site_check_mk/agent/logwatch/tapicero.cfg',
   }
 
   # local nagios plugin checks via mrpe
@@ -17,10 +16,5 @@ class site_check_mk::agent::tapicero {
         'rm /files/etc/check_mk/mrpe.cfg/Tapicero_Procs',
         'set Tapicero_Procs "/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a tapicero"' ],
       require => File['/etc/check_mk/mrpe.cfg'];
-    'Tapicero_Heartbeat':
-      incl    => '/etc/check_mk/mrpe.cfg',
-      lens    => 'Spacevars.lns',
-      changes => 'set Tapicero_Heartbeat \'/usr/local/lib/nagios/plugins/check_last_regex_in_log -f /var/log/syslog -r "tapicero" -w 300 -c 600\'',
-      require => File['/etc/check_mk/mrpe.cfg'];
   }
 }
diff --git a/puppet/modules/site_check_mk/manifests/agent/webapp.pp b/puppet/modules/site_check_mk/manifests/agent/webapp.pp
index 88c3da30..9bf3b197 100644
--- a/puppet/modules/site_check_mk/manifests/agent/webapp.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/webapp.pp
@@ -7,11 +7,9 @@ class site_check_mk::agent::webapp {
     ensure  => absent
   }
 
-  # check syslog
-  concat::fragment { 'syslog_webapp':
-    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/webapp.cfg',
-    target  => '/etc/check_mk/logwatch.d/syslog.cfg',
-    order   => '02';
+  # watch logs
+  file { '/etc/check_mk/logwatch.d/webapp.cfg':
+    source => 'puppet:///modules/site_check_mk/agent/logwatch/webapp.cfg',
   }
 
 }
diff --git a/puppet/modules/tapicero/manifests/init.pp b/puppet/modules/tapicero/manifests/init.pp
index 8afb18b8..d4ff1acb 100644
--- a/puppet/modules/tapicero/manifests/init.pp
+++ b/puppet/modules/tapicero/manifests/init.pp
@@ -44,9 +44,9 @@ class tapicero {
 
   file {
 
-    ##
-    ## TAPICERO DIRECTORIES
-    ##
+    #
+    # TAPICERO DIRECTORIES
+    #
 
     '/srv/leap/tapicero':
       ensure  => directory,
@@ -67,9 +67,9 @@ class tapicero {
       group   => 'tapicero',
       require => User['tapicero'];
 
-    ##
-    ## TAPICERO CONFIG
-    ##
+    #
+    # TAPICERO CONFIG
+    #
 
     '/etc/leap/tapicero.yaml':
       content => template('tapicero/tapicero.yaml.erb'),
@@ -78,9 +78,9 @@ class tapicero {
       mode    => '0600',
       notify  => Service['tapicero'];
 
-    ##
-    ## TAPICERO INIT
-    ##
+    #
+    # TAPICERO INIT
+    #
 
     '/etc/init.d/tapicero':
       source  => 'puppet:///modules/tapicero/tapicero.init',
@@ -133,4 +133,17 @@ class tapicero {
                     Couchdb::Add_user[$::site_couchdb::couchdb_tapicero_user] ];
   }
 
+  rsyslog::snippet { '99-tapicero':
+    content => 'if $programname startswith \'tapicero\' then /var/log/leap/tapicero.log
+&~'
+  }
+
+  augeas {
+    'logrotate_tapicero':
+      context => '/files/etc/logrotate.d/tapicero/rule',
+      changes => [ 'set file /var/log/leap/tapicero*.log', 'set rotate 7',
+                   'set schedule daily', 'set compress compress',
+                   'set missingok missingok', 'set ifempty notifempty',
+                   'set copytruncate copytruncate' ]
+  }
 }
-- 
cgit v1.2.3


From 8bd7eca1913a8ca23e8b2c92b83aeac5a665131b Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 16 Apr 2015 17:03:18 +0200
Subject: updated CHANGES.md

Change-Id: I9a80fdc78f144cc80b9fa9206d059f5cb73e1725
---
 CHANGES.md | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 7d2fe3f3..4b42e10d 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -8,7 +8,7 @@ rotate the `sessions` and `tokens` databases monthly. The new database names
 are `tokens_XXX` and `sessions_XXX` where XXX is counter since the epoch that
 increments every month (not a calendar month, but a month's worth of seconds).
 
-Additionally, nagios monitor and `leap test run` now will create and destroy
+Additionally, nagios checks and `leap test run` now will create and destroy
 test users in the `tmp_users` database, which will get periodically deleted
 and recreated.
 
@@ -17,8 +17,13 @@ Compatibility:
 * Requires leap_cli version 1.7
 * Requires bitmask client version >= 0.7
 * Previous releases supported cookies when using the provider API. Now, only tokens are supported.
+* Includes:
+  * leap_mx 0.6.1
+  * tapicero ?
+  * soledad ?
 
 Commits: https://leap.se/git/leap_platform.git/shortlog/refs/tags/0.7.0
+Issues fixes: https://leap.se/code/versions/168
 
 Upgrading:
 
@@ -36,10 +41,12 @@ New features:
   `/var/log/leap`, including the user, leap_cli version, and platform version.
 * you must now run `leap deploy --downgrade` if you want to deploy an older
   version over a newer platform version.
+* a summary of deploys is logged on each node at `/var/log/leap/deploy-summary.log`
 * the install source each custom daemons (e.g. tapicero, etc) is now
   configured on `common.json`.
 * you can configure apt sources in common.json
-* many bug fixes
+* Improved Nagios graphs integration (with pnp4nagios)
+* many bug bugfixes
 
 Platform 0.6
 -------------------------------------
-- 
cgit v1.2.3


From bb07407485ed1626221a1190cc2fb2789f95ed22 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 15 Apr 2015 16:12:11 -0700
Subject: clean up logging mess: add 'logfile' define, mv openvpn and stunnel
 logs to their own files, fix mx logwatch path.

---
 puppet/modules/leap/manifests/init.pp              |  3 +++
 puppet/modules/leap/manifests/logfile.pp           | 26 ++++++++++++++++++++++
 puppet/modules/leap_mx/manifests/init.pp           |  3 ++-
 puppet/modules/leap_mx/manifests/syslog.pp         | 17 --------------
 .../site_check_mk/files/agent/logwatch/leap_mx.cfg |  2 +-
 .../site_check_mk/files/agent/logwatch/openvpn.cfg | 14 ++++++++++++
 .../site_check_mk/files/agent/logwatch/stunnel.cfg | 10 +++++++++
 .../files/agent/logwatch/syslog/openvpn.cfg        | 13 -----------
 .../files/agent/logwatch/syslog/stunnel.cfg        |  9 --------
 puppet/modules/site_check_mk/manifests/agent/mx.pp |  2 +-
 .../site_check_mk/manifests/agent/openvpn.pp       |  2 +-
 .../site_check_mk/manifests/agent/stunnel.pp       |  2 +-
 puppet/modules/site_openvpn/manifests/init.pp      |  1 +
 puppet/modules/site_stunnel/manifests/init.pp      |  1 +
 puppet/modules/site_webapp/manifests/init.pp       |  3 ++-
 puppet/modules/site_webapp/manifests/logging.pp    | 16 -------------
 puppet/modules/tapicero/manifests/init.pp          | 14 +-----------
 17 files changed, 64 insertions(+), 74 deletions(-)
 create mode 100644 puppet/modules/leap/manifests/init.pp
 create mode 100644 puppet/modules/leap/manifests/logfile.pp
 delete mode 100644 puppet/modules/leap_mx/manifests/syslog.pp
 create mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg
 create mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg
 delete mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg
 delete mode 100644 puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg
 delete mode 100644 puppet/modules/site_webapp/manifests/logging.pp

diff --git a/puppet/modules/leap/manifests/init.pp b/puppet/modules/leap/manifests/init.pp
new file mode 100644
index 00000000..bbae3781
--- /dev/null
+++ b/puppet/modules/leap/manifests/init.pp
@@ -0,0 +1,3 @@
+class leap {
+
+}
\ No newline at end of file
diff --git a/puppet/modules/leap/manifests/logfile.pp b/puppet/modules/leap/manifests/logfile.pp
new file mode 100644
index 00000000..42a82943
--- /dev/null
+++ b/puppet/modules/leap/manifests/logfile.pp
@@ -0,0 +1,26 @@
+#
+# make syslog log to a particular file for a particular process.
+#
+
+define leap::logfile($process=$title) {
+  $logfile = "/var/log/leap/${title}.log"
+
+  rsyslog::snippet { "50-${name}":
+    content => "if \$programname startswith '${process}' then ${logfile}
+&~"
+  }
+
+  augeas {
+    "logrotate_${name}":
+      context => "/files/etc/logrotate.d/${name}/rule",
+      changes => [
+        "set file ${logfile}",
+        'set rotate 7',
+        'set schedule daily',
+        'set compress compress',
+        'set missingok missingok',
+        'set ifempty notifempty',
+        'set copytruncate copytruncate'
+      ]
+  }
+}
diff --git a/puppet/modules/leap_mx/manifests/init.pp b/puppet/modules/leap_mx/manifests/init.pp
index 78065f56..a0590ee1 100644
--- a/puppet/modules/leap_mx/manifests/init.pp
+++ b/puppet/modules/leap_mx/manifests/init.pp
@@ -11,7 +11,8 @@ class leap_mx {
 
   include soledad::common
   include site_apt::preferences::twisted
-  include leap_mx::syslog
+
+  leap::logfile { 'mx': process => 'leap-mx'}
 
   #
   # USER AND GROUP
diff --git a/puppet/modules/leap_mx/manifests/syslog.pp b/puppet/modules/leap_mx/manifests/syslog.pp
deleted file mode 100644
index 0247a392..00000000
--- a/puppet/modules/leap_mx/manifests/syslog.pp
+++ /dev/null
@@ -1,17 +0,0 @@
-class leap_mx::syslog {
-
-  rsyslog::snippet { '99-leap-mx':
-    content => 'if $programname startswith \'leap-mx\' then /var/log/leap/mx.log
-&~'
-  }
-
-  augeas {
-    'logrotate_leap-mx':
-      context => '/files/etc/logrotate.d/leap-mx/rule',
-      changes => [ 'set file /var/log/leap/mx*.log', 'set rotate 7',
-                   'set schedule daily', 'set compress compress',
-                   'set missingok missingok', 'set ifempty notifempty',
-                   'set copytruncate copytruncate' ]
-  }
-
-}
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg
index c71c5392..166d0230 100644
--- a/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/leap_mx.cfg
@@ -1,4 +1,4 @@
-/var/log/leap_mx.log
+/var/log/leap/mx.log
  W Don't know how to deliver mail
  W No public key, stopping the processing chain
 
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg
new file mode 100644
index 00000000..ed50f420
--- /dev/null
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/openvpn.cfg
@@ -0,0 +1,14 @@
+/var/log/leap/openvpn.log
+# ignore openvpn TLS initialization errors when clients
+# suddenly hangup before properly establishing
+# a tls connection
+ I ovpn-.*TLS Error: Unroutable control packet received from
+ I ovpn-.*TLS Error: TLS key negotiation failed to occur within 60 seconds \(check your network connectivity\)
+ I ovpn-.*TLS Error: TLS handshake failed
+ I ovpn-.*TLS Error: TLS object -> incoming plaintext read error
+ I ovpn-.*Fatal TLS error \(check_tls_errors_co\), restarting
+ I ovpn-.*TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate
+
+ I ovpn-.*SIGUSR1\[soft,tls-error\] received, client-instance restarting
+ I ovpn-.*VERIFY ERROR: depth=0, error=certificate has expired
+
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg
new file mode 100644
index 00000000..b1e6cf2f
--- /dev/null
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/stunnel.cfg
@@ -0,0 +1,10 @@
+/var/log/leap/stunnel.log
+# check for stunnel failures
+#
+# these are temporary failures and happen very often, so we
+# ignore them until we tuned stunnel timeouts/logging,
+# see https://leap.se/code/issues/5218
+ I stunnel:.*Connection reset by peer
+ I stunnel:.*Peer suddenly disconnected
+ I stunnel:.*Connection refused
+
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg
deleted file mode 100644
index ac17c0ca..00000000
--- a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/openvpn.cfg
+++ /dev/null
@@ -1,13 +0,0 @@
-# ignore openvpn TLS initialization errors when clients
-# suddenly hangup before properly establishing
-# a tls connection
- I ovpn-.*TLS Error: Unroutable control packet received from
- I ovpn-.*TLS Error: TLS key negotiation failed to occur within 60 seconds \(check your network connectivity\)
- I ovpn-.*TLS Error: TLS handshake failed
- I ovpn-.*TLS Error: TLS object -> incoming plaintext read error
- I ovpn-.*Fatal TLS error \(check_tls_errors_co\), restarting
- I ovpn-.*TLS_ERROR: BIO read tls_read_plaintext error: error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate
-
- I ovpn-.*SIGUSR1\[soft,tls-error\] received, client-instance restarting
- I ovpn-.*VERIFY ERROR: depth=0, error=certificate has expired
-
diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg
deleted file mode 100644
index eb3131f2..00000000
--- a/puppet/modules/site_check_mk/files/agent/logwatch/syslog/stunnel.cfg
+++ /dev/null
@@ -1,9 +0,0 @@
-# check for stunnel failures
-#
-# these are temporary failures and happen very often, so we
-# ignore them until we tuned stunnel timeouts/logging,
-# see https://leap.se/code/issues/5218
- I stunnel:.*Connection reset by peer
- I stunnel:.*Peer suddenly disconnected
- I stunnel:.*Connection refused
-
diff --git a/puppet/modules/site_check_mk/manifests/agent/mx.pp b/puppet/modules/site_check_mk/manifests/agent/mx.pp
index da66c549..98757b59 100644
--- a/puppet/modules/site_check_mk/manifests/agent/mx.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/mx.pp
@@ -12,7 +12,7 @@ class site_check_mk::agent::mx {
       lens    => 'Spacevars.lns',
       changes => [
         'rm /files/etc/check_mk/mrpe.cfg/Leap_MX_Procs',
-        'set Leap_MX_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --pidfile=/var/run/leap_mx.pid --rundir=/var/lib/leap_mx/ --python=/usr/share/app/leap_mx.tac --logfile=/var/log/leap_mx.log"\'' ],
+        'set Leap_MX_Procs \'/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a "/usr/bin/python /usr/bin/twistd --pidfile=/var/run/leap_mx.pid --rundir=/var/lib/leap_mx/ --python=/usr/share/app/leap_mx.tac --logfile=/var/log/leap/mx.log"\'' ],
       require => File['/etc/check_mk/mrpe.cfg'];
   }
 
diff --git a/puppet/modules/site_check_mk/manifests/agent/openvpn.pp b/puppet/modules/site_check_mk/manifests/agent/openvpn.pp
index 919a408d..0596a497 100644
--- a/puppet/modules/site_check_mk/manifests/agent/openvpn.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/openvpn.pp
@@ -2,7 +2,7 @@ class site_check_mk::agent::openvpn {
 
   # check syslog
   concat::fragment { 'syslog_openpvn':
-    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/openvpn.cfg',
+    source  => 'puppet:///modules/site_check_mk/agent/logwatch/openvpn.cfg',
     target  => '/etc/check_mk/logwatch.d/syslog.cfg',
     order   => '02';
   }
diff --git a/puppet/modules/site_check_mk/manifests/agent/stunnel.pp b/puppet/modules/site_check_mk/manifests/agent/stunnel.pp
index 64022824..7f765771 100644
--- a/puppet/modules/site_check_mk/manifests/agent/stunnel.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/stunnel.pp
@@ -1,7 +1,7 @@
 class site_check_mk::agent::stunnel {
 
   concat::fragment { 'syslog_stunnel':
-    source  => 'puppet:///modules/site_check_mk/agent/logwatch/syslog/stunnel.cfg',
+    source  => 'puppet:///modules/site_check_mk/agent/logwatch/stunnel.cfg',
     target  => '/etc/check_mk/logwatch.d/syslog.cfg',
     order   => '02';
   }
diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index d6f9150b..e2a3124e 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -228,6 +228,7 @@ class site_openvpn {
       order   => 10;
   }
 
+  leap::logfile { 'openvpn': }
   include site_check_mk::agent::openvpn
 
 }
diff --git a/puppet/modules/site_stunnel/manifests/init.pp b/puppet/modules/site_stunnel/manifests/init.pp
index 2e0cf5b8..176b8618 100644
--- a/puppet/modules/site_stunnel/manifests/init.pp
+++ b/puppet/modules/site_stunnel/manifests/init.pp
@@ -29,6 +29,7 @@ class site_stunnel {
   $client_sections = keys($clients)
   site_stunnel::clients { $client_sections: }
 
+  leap::logfile { "stunnel": process => "stunnel4" }
   include site_stunnel::override_service
 }
 
diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index ea64048b..f10ef00d 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -18,7 +18,6 @@ class site_webapp {
   include site_config::ruby::dev
   include site_webapp::apache
   include site_webapp::couchdb
-  include site_webapp::logging
   include site_haproxy
   include site_webapp::cron
   include site_config::x509::cert
@@ -173,6 +172,8 @@ class site_webapp {
     ensure => latest,
   }
 
+  leap::logfile { 'webapp': }
+
   include site_shorewall::webapp
   include site_check_mk::agent::webapp
 }
diff --git a/puppet/modules/site_webapp/manifests/logging.pp b/puppet/modules/site_webapp/manifests/logging.pp
deleted file mode 100644
index b414b82c..00000000
--- a/puppet/modules/site_webapp/manifests/logging.pp
+++ /dev/null
@@ -1,16 +0,0 @@
-class site_webapp::logging {
-
-  rsyslog::snippet { '01-webapp':
-    content => 'if $programname == "webapp" then /var/log/leap/webapp.log
-&~'
-  }
-
-  augeas {
-    'logrotate_webapp':
-      context => '/files/etc/logrotate.d/webapp/rule',
-      changes => [ 'set file /var/log/leap/webapp.log', 'set rotate 7',
-                   'set schedule daily', 'set compress compress',
-                   'set missingok missingok', 'set ifempty notifempty',
-                   'set copytruncate copytruncate' ]
-  }
-}
diff --git a/puppet/modules/tapicero/manifests/init.pp b/puppet/modules/tapicero/manifests/init.pp
index d4ff1acb..ca8488c8 100644
--- a/puppet/modules/tapicero/manifests/init.pp
+++ b/puppet/modules/tapicero/manifests/init.pp
@@ -133,17 +133,5 @@ class tapicero {
                     Couchdb::Add_user[$::site_couchdb::couchdb_tapicero_user] ];
   }
 
-  rsyslog::snippet { '99-tapicero':
-    content => 'if $programname startswith \'tapicero\' then /var/log/leap/tapicero.log
-&~'
-  }
-
-  augeas {
-    'logrotate_tapicero':
-      context => '/files/etc/logrotate.d/tapicero/rule',
-      changes => [ 'set file /var/log/leap/tapicero*.log', 'set rotate 7',
-                   'set schedule daily', 'set compress compress',
-                   'set missingok missingok', 'set ifempty notifempty',
-                   'set copytruncate copytruncate' ]
-  }
+  leap::logfile { 'tapicero': }
 }
-- 
cgit v1.2.3


From 43fb605eebadb18abc62abb5a2fb5bbce41d0334 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 15 Apr 2015 16:22:16 -0700
Subject: restore tapicero heartbeat.

---
 puppet/modules/site_check_mk/manifests/agent/tapicero.pp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/puppet/modules/site_check_mk/manifests/agent/tapicero.pp b/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
index 9bdebe2a..4a5ec68e 100644
--- a/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
+++ b/puppet/modules/site_check_mk/manifests/agent/tapicero.pp
@@ -16,5 +16,10 @@ class site_check_mk::agent::tapicero {
         'rm /files/etc/check_mk/mrpe.cfg/Tapicero_Procs',
         'set Tapicero_Procs "/usr/lib/nagios/plugins/check_procs -w 1:1 -c 1:1 -a tapicero"' ],
       require => File['/etc/check_mk/mrpe.cfg'];
+    'Tapicero_Heartbeat':
+      incl    => '/etc/check_mk/mrpe.cfg',
+      lens    => 'Spacevars.lns',
+      changes => 'set Tapicero_Heartbeat \'/usr/local/lib/nagios/plugins/check_last_regex_in_log -f /var/log/leap/tapicero.log -r "tapicero" -w 300 -c 600\'',
+      require => File['/etc/check_mk/mrpe.cfg'];
   }
 }
-- 
cgit v1.2.3


From 1530a85da3415bc000635d62882d9ba7082a793b Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 16 Apr 2015 20:42:09 -0700
Subject: properly clean up unused files

---
 puppet/modules/site_config/manifests/default.pp    |  1 +
 .../modules/site_config/manifests/remove_files.pp  | 36 ++++++++++++++++++++++
 puppet/modules/site_webapp/manifests/init.pp       |  4 ---
 3 files changed, 37 insertions(+), 4 deletions(-)
 create mode 100644 puppet/modules/site_config/manifests/remove_files.pp

diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index c15080f5..e69e4b7b 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -58,6 +58,7 @@ class site_config::default {
 
   # set up core leap files and directories
   include site_config::files
+  include site_config::remove_files
 
   if ! member($services, 'mx') {
     include site_postfix::satellite
diff --git a/puppet/modules/site_config/manifests/remove_files.pp b/puppet/modules/site_config/manifests/remove_files.pp
new file mode 100644
index 00000000..cc5fc174
--- /dev/null
+++ b/puppet/modules/site_config/manifests/remove_files.pp
@@ -0,0 +1,36 @@
+#
+# Sometimes when we upgrade the platform, we need to ensure that files that
+# the platform previously created will get removed.
+#
+# These file removals don't need to be kept forever: we only need to remove
+# files that are present in the prior platform release.
+#
+# We can assume that the every node is upgraded from the previous platform
+# release.
+#
+
+class site_config::remove_files {
+
+  #
+  # Platform 0.7 removals
+  #
+
+  tidy {
+    '/etc/rsyslog.d/99-tapicero.conf':;
+    '/etc/rsyslog.d/99-leap-mx.conf':;
+    '/etc/rsyslog.d/01-webapp.conf':;
+    '/etc/rsyslog.d/50-stunnel.conf':;
+    '/etc/logrotate.d/leap-mx':;
+    '/etc/logrotate.d/stunnel':;
+    '/var/log/stunnel4/stunnel.log':;
+    'leap_mx':
+      path => '/var/log/',
+      recurse => true,
+      matches => 'leap_mx*';
+    '/srv/leap/webapp/public/provider.json':;
+    '/srv/leap/couchdb/designs/tmp_users':
+      recurse => true,
+      rmdirs => true;
+  }
+
+}
diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index f10ef00d..ec94c090 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -92,10 +92,6 @@ class site_webapp {
       require => Vcsrepo['/srv/leap/webapp'],
       owner   => leap-webapp, group => leap-webapp, mode => '0644';
 
-    # old provider.json location. this can be removed after everyone upgrades.
-    '/srv/leap/webapp/public/provider.json':
-      ensure => absent;
-
     '/srv/leap/webapp/public/ca.crt':
       ensure  => link,
       require => Vcsrepo['/srv/leap/webapp'],
-- 
cgit v1.2.3


From c7e12fd3cfe482e22e337eaea80ca7994dea7524 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 16 Apr 2015 20:57:11 -0700
Subject: stunnel shouldn't use syslog, and leap_mx can't.

---
 puppet/modules/leap_mx/manifests/init.pp        | 24 ++++++++++++++++++++++--
 puppet/modules/site_stunnel/manifests/client.pp | 19 +++++++++++++++++--
 puppet/modules/site_stunnel/manifests/init.pp   | 15 ++++++++++++++-
 3 files changed, 53 insertions(+), 5 deletions(-)

diff --git a/puppet/modules/leap_mx/manifests/init.pp b/puppet/modules/leap_mx/manifests/init.pp
index a0590ee1..0d15d053 100644
--- a/puppet/modules/leap_mx/manifests/init.pp
+++ b/puppet/modules/leap_mx/manifests/init.pp
@@ -12,8 +12,6 @@ class leap_mx {
   include soledad::common
   include site_apt::preferences::twisted
 
-  leap::logfile { 'mx': process => 'leap-mx'}
-
   #
   # USER AND GROUP
   #
@@ -43,6 +41,14 @@ class leap_mx {
     notify  => Service['leap-mx'];
   }
 
+  file { '/etc/default/leap_mx':
+    content => 'LOGFILE=/var/log/leap/mx.log',
+    owner   => 'root',
+    group   => 'root',
+    mode    => '0644',
+    notify  => Service['leap-mx'];
+  }
+
   #
   # LEAP-MX CODE AND DEPENDENCIES
   #
@@ -69,4 +75,18 @@ class leap_mx {
     hasrestart => true,
     require    => [ Package['leap-mx'] ];
   }
+
+  augeas {
+    "logrotate_mx":
+      context => "/files/etc/logrotate.d/mx/rule",
+      changes => [
+        "set file /var/log/leap/mx.log",
+        'set rotate 5',
+        'set schedule daily',
+        'set compress compress',
+        'set missingok missingok',
+        'set ifempty notifempty',
+        'set copytruncate copytruncate'
+      ]
+  }
 }
diff --git a/puppet/modules/site_stunnel/manifests/client.pp b/puppet/modules/site_stunnel/manifests/client.pp
index 3b10ecb8..c9e034f1 100644
--- a/puppet/modules/site_stunnel/manifests/client.pp
+++ b/puppet/modules/site_stunnel/manifests/client.pp
@@ -14,7 +14,9 @@ define site_stunnel::client (
   $verify     = '2',
   $pid        = $name,
   $rndfile    = '/var/lib/stunnel4/.rnd',
-  $debuglevel = '4' ) {
+  $debuglevel = 'warning' ) {
+
+  $logfile = "/var/log/stunnel4/${name}.log"
 
   include site_config::x509::cert
   include site_config::x509::key
@@ -35,7 +37,20 @@ define site_stunnel::client (
     pid        => "/var/run/stunnel4/${pid}.pid",
     rndfile    => $rndfile,
     debuglevel => $debuglevel,
-    sslversion => 'TLSv1';
+    sslversion => 'TLSv1',
+    syslog     => 'no',
+    output     => $logfile;
+  }
+
+  # define the log files so that we can purge the
+  # files from /var/log/stunnel4 that are not defined.
+  file {
+    $logfile:;
+    "${logfile}.1.gz":;
+    "${logfile}.2.gz":;
+    "${logfile}.3.gz":;
+    "${logfile}.4.gz":;
+    "${logfile}.5.gz":;
   }
 
   site_shorewall::stunnel::client { $name:
diff --git a/puppet/modules/site_stunnel/manifests/init.pp b/puppet/modules/site_stunnel/manifests/init.pp
index 176b8618..d919a072 100644
--- a/puppet/modules/site_stunnel/manifests/init.pp
+++ b/puppet/modules/site_stunnel/manifests/init.pp
@@ -29,7 +29,20 @@ class site_stunnel {
   $client_sections = keys($clients)
   site_stunnel::clients { $client_sections: }
 
-  leap::logfile { "stunnel": process => "stunnel4" }
+  # remove any old stunnel logs that are not
+  # defined by this puppet run
+  file {'/var/log/stunnel4': purge => true;}
+
+  # the default is to keep 356 log files for each stunnel.
+  # here we set a more reasonable number.
+  augeas {
+    "logrotate_stunnel":
+      context => "/files/etc/logrotate.d/stunnel4/rule",
+      changes => [
+        'set rotate 5',
+      ]
+  }
+
   include site_stunnel::override_service
 }
 
-- 
cgit v1.2.3


From e97a00725c80a4067d5bba24d931b1a3bcf2ad96 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 16 Apr 2015 20:57:26 -0700
Subject: keep five log files instead of seven.

---
 puppet/modules/leap/manifests/logfile.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/leap/manifests/logfile.pp b/puppet/modules/leap/manifests/logfile.pp
index 42a82943..4deafacb 100644
--- a/puppet/modules/leap/manifests/logfile.pp
+++ b/puppet/modules/leap/manifests/logfile.pp
@@ -15,7 +15,7 @@ define leap::logfile($process=$title) {
       context => "/files/etc/logrotate.d/${name}/rule",
       changes => [
         "set file ${logfile}",
-        'set rotate 7',
+        'set rotate 5',
         'set schedule daily',
         'set compress compress',
         'set missingok missingok',
-- 
cgit v1.2.3


From 64cc83793aa35b84b60dd40305c7edf8369a187b Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Fri, 17 Apr 2015 10:19:37 -0700
Subject: rename leap-mx logrotate file; minor style change.

---
 puppet/modules/leap/manifests/logfile.pp             | 4 ++--
 puppet/modules/leap_mx/manifests/init.pp             | 2 +-
 puppet/modules/site_config/manifests/remove_files.pp | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/puppet/modules/leap/manifests/logfile.pp b/puppet/modules/leap/manifests/logfile.pp
index 4deafacb..c5c185f6 100644
--- a/puppet/modules/leap/manifests/logfile.pp
+++ b/puppet/modules/leap/manifests/logfile.pp
@@ -2,8 +2,8 @@
 # make syslog log to a particular file for a particular process.
 #
 
-define leap::logfile($process=$title) {
-  $logfile = "/var/log/leap/${title}.log"
+define leap::logfile($process=$name) {
+  $logfile = "/var/log/leap/${name}.log"
 
   rsyslog::snippet { "50-${name}":
     content => "if \$programname startswith '${process}' then ${logfile}
diff --git a/puppet/modules/leap_mx/manifests/init.pp b/puppet/modules/leap_mx/manifests/init.pp
index 0d15d053..6bcdd19a 100644
--- a/puppet/modules/leap_mx/manifests/init.pp
+++ b/puppet/modules/leap_mx/manifests/init.pp
@@ -78,7 +78,7 @@ class leap_mx {
 
   augeas {
     "logrotate_mx":
-      context => "/files/etc/logrotate.d/mx/rule",
+      context => "/files/etc/logrotate.d/leap-mx/rule",
       changes => [
         "set file /var/log/leap/mx.log",
         'set rotate 5',
diff --git a/puppet/modules/site_config/manifests/remove_files.pp b/puppet/modules/site_config/manifests/remove_files.pp
index cc5fc174..44e3e47b 100644
--- a/puppet/modules/site_config/manifests/remove_files.pp
+++ b/puppet/modules/site_config/manifests/remove_files.pp
@@ -20,7 +20,7 @@ class site_config::remove_files {
     '/etc/rsyslog.d/99-leap-mx.conf':;
     '/etc/rsyslog.d/01-webapp.conf':;
     '/etc/rsyslog.d/50-stunnel.conf':;
-    '/etc/logrotate.d/leap-mx':;
+    '/etc/logrotate.d/mx':;
     '/etc/logrotate.d/stunnel':;
     '/var/log/stunnel4/stunnel.log':;
     'leap_mx':
-- 
cgit v1.2.3


From f8393f28fd3d62219f372d13b10f91a0de951f57 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Fri, 17 Apr 2015 10:25:17 -0700
Subject: update CHANGES

---
 CHANGES.md | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 4b42e10d..a2ad8f13 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -16,11 +16,13 @@ Compatibility:
 
 * Requires leap_cli version 1.7
 * Requires bitmask client version >= 0.7
-* Previous releases supported cookies when using the provider API. Now, only tokens are supported.
+* Previous releases supported cookies when using the provider API. Now, only
+  tokens are supported.
 * Includes:
   * leap_mx 0.6.1
-  * tapicero ?
-  * soledad ?
+  * tapicero 0.7
+  * webapp 0.7
+  * soledad 0.7
 
 Commits: https://leap.se/git/leap_platform.git/shortlog/refs/tags/0.7.0
 Issues fixes: https://leap.se/code/versions/168
-- 
cgit v1.2.3


From 9dffb7314d6a8a5f5155640156ed81982e32c268 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 21 Apr 2015 13:41:25 +0200
Subject: removed leftover puppet/manifests/setup.pp, it's not used anymore

Change-Id: Ib64c9a9d15eb6f276e7928e47e96cd44291583c9
---
 puppet/manifests/setup.pp | 5 -----
 1 file changed, 5 deletions(-)
 delete mode 100644 puppet/manifests/setup.pp

diff --git a/puppet/manifests/setup.pp b/puppet/manifests/setup.pp
deleted file mode 100644
index 4dd03203..00000000
--- a/puppet/manifests/setup.pp
+++ /dev/null
@@ -1,5 +0,0 @@
-#
-# this is applied before each run of site.pp
-#
-
-include ::site_config::setup
-- 
cgit v1.2.3


From eb803597301c077dd7bdbc8f31e67123be72ed07 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Tue, 21 Apr 2015 15:26:33 -0700
Subject: block username 'vmail'

---
 provider_base/services/webapp.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json
index b0646579..e5aed0fd 100644
--- a/provider_base/services/webapp.json
+++ b/provider_base/services/webapp.json
@@ -1,7 +1,7 @@
 {
   "webapp": {
     "admins": [],
-    "forbidden_usernames": ["admin", "administrator", "arin-admin", "certmaster", "contact", "info", "maildrop", "postmaster", "ssladmin", "www-data"],
+    "forbidden_usernames": ["admin", "administrator", "arin-admin", "certmaster", "contact", "info", "maildrop", "postmaster", "ssladmin", "www-data", "vmail"],
     "domain": "= domain.full_suffix",
     "modules": ["user", "billing", "help"],
     "couchdb_webapp_user": "= global.services[:couchdb].couch.users[:webapp]",
-- 
cgit v1.2.3


From 15f3fbcf2eadebb229089560388f86f3658be9af Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 22 Apr 2015 16:26:47 +0200
Subject: update known issues with a link to leap_mx known issues

Change-Id: I6c0e8f5a99a22e2cbe26aa3ec1fa6a6c75f4931f
---
 README.md | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/README.md b/README.md
index 9b33e9e8..7b25b26d 100644
--- a/README.md
+++ b/README.md
@@ -77,6 +77,11 @@ Special Environments
 
 . When deploying to OpenStack release "nova" or newer, you will need to do an initial deploy, then when it has finished run `leap facts update` and then deploy again (see: https://leap.se/code/issues/3020)
 
+leap-mx
+-------
+
+. see https://github.com/leapcode/leap_mx#070 for issues regarding leap_mx
+
 
 Contributing
 ============
-- 
cgit v1.2.3


From 8f1d2f308c164796365eadd84d404ee695f32160 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sun, 26 Apr 2015 11:02:48 +0200
Subject: updated submodule nagios to improve readability of notification mails

Change-Id: I518b2291317b81e915f7189f2a48110528e80e18
---
 puppet/modules/nagios | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/nagios b/puppet/modules/nagios
index 300f1d39..b55f23d4 160000
--- a/puppet/modules/nagios
+++ b/puppet/modules/nagios
@@ -1 +1 @@
-Subproject commit 300f1d39682d47e7bcc66b82f21dec15bb41b4e9
+Subproject commit b55f23d4d90c97cec08251544aa9700df86ad0b3
-- 
cgit v1.2.3


From caa62d845bbc54737aa40931c0b2eca068592dd9 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sun, 26 Apr 2015 11:13:28 +0200
Subject: Exec[] should log the output of the command on failure #6851

Change-Id: If99ae4036f9210516762f5cd7eb66744661a9665
---
 puppet/manifests/site.pp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/puppet/manifests/site.pp b/puppet/manifests/site.pp
index 57942d99..912234ac 100644
--- a/puppet/manifests/site.pp
+++ b/puppet/manifests/site.pp
@@ -1,5 +1,10 @@
 # set a default exec path
-Exec { path => '/usr/bin:/usr/sbin/:/bin:/sbin:/usr/local/bin:/usr/local/sbin' }
+# the logoutput exec parameter defaults to "on_error" in puppet 3,
+# but to "false" in puppet 2.7, so we need to set this globally here
+Exec {
+    logoutput => on_failure,
+      path    => '/usr/bin:/usr/sbin/:/bin:/sbin:/usr/local/bin:/usr/local/sbin'
+}
 
 include site_config::setup
 include site_config::default
-- 
cgit v1.2.3


From e65460dcefda6660431d937e9a66d17a1d80e104 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sun, 26 Apr 2015 21:19:33 +0200
Subject: Tapicero changed it's error message when uploading design doc fails
 in race condition with another tapicero instance #6534

Change-Id: Ie194a2983210601bd24aef5e74f8b7fa2b7c433f
---
 puppet/modules/site_check_mk/files/agent/logwatch/tapicero.cfg | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/site_check_mk/files/agent/logwatch/tapicero.cfg b/puppet/modules/site_check_mk/files/agent/logwatch/tapicero.cfg
index f527f120..d98f5094 100644
--- a/puppet/modules/site_check_mk/files/agent/logwatch/tapicero.cfg
+++ b/puppet/modules/site_check_mk/files/agent/logwatch/tapicero.cfg
@@ -1,6 +1,6 @@
 /var/log/leap/tapicero.log
 # Ignore transient Tapicero errors when creating a db (#6511)
- I tapicero.*(Creating database|Checking security of|Writing security to|Uploading design doc to) user-.* failed (\(trying again soon\)|(twice )?due to): (RestClient::Resource Not Found|RestClient::InternalServerError): (404 Resource Not Found|500 Internal Server Error)
+ I tapicero.*(Creating database|Checking security of|Writing security to|Uploading design doc to) user-.* failed (\(trying again soon\)|(twice )?due to): (RestClient::ResourceNotFound|RestClient::InternalServerError): (404 Resource Not Found|500 Internal Server Error)
  C tapicero.*RestClient::InternalServerError:
 # possible race condition between multiple tapicero
 # instances, so we ignore it
-- 
cgit v1.2.3


From eaddcfca6761bac329a57a65453958b6741f2420 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sun, 26 Apr 2015 22:41:29 +0200
Subject: run check_mk_agent every 4 instead of 10 minutes, useful for better
 graphs

Change-Id: Ibefc6ce08cf714cf79a460a8b6eb32e2851ce22c
---
 puppet/modules/site_check_mk/files/extra_service_conf.mk | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/puppet/modules/site_check_mk/files/extra_service_conf.mk b/puppet/modules/site_check_mk/files/extra_service_conf.mk
index a4c6e769..c7120a96 100644
--- a/puppet/modules/site_check_mk/files/extra_service_conf.mk
+++ b/puppet/modules/site_check_mk/files/extra_service_conf.mk
@@ -5,10 +5,10 @@ extra_service_conf["max_check_attempts"] = [
 ]
 
 #
-# run check_mk_agent every 10 minutes if it terminates successfully.
+# run check_mk_agent every 4 minutes if it terminates successfully.
 # see https://leap.se/code/issues/6539 for the rationale
 #
 extra_service_conf["normal_check_interval"] = [
-  ("10", ALL_HOSTS , "Check_MK" )
+  ("4", ALL_HOSTS , "Check_MK" )
 ]
 
-- 
cgit v1.2.3


From cdf0b448aa4cdac8eb04f05bdeb1d4bf7630938e Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sun, 26 Apr 2015 22:03:31 +0200
Subject: Use rsyslog traditional timestamp format in custom logfiles #6886

Change-Id: I9e033f63e3b387e95f5bf1c3820e456f740d8180
---
 puppet/modules/leap/manifests/logfile.pp  | 3 +--
 puppet/modules/leap/templates/rsyslog.erb | 5 +++++
 2 files changed, 6 insertions(+), 2 deletions(-)
 create mode 100644 puppet/modules/leap/templates/rsyslog.erb

diff --git a/puppet/modules/leap/manifests/logfile.pp b/puppet/modules/leap/manifests/logfile.pp
index c5c185f6..63dbd16b 100644
--- a/puppet/modules/leap/manifests/logfile.pp
+++ b/puppet/modules/leap/manifests/logfile.pp
@@ -6,8 +6,7 @@ define leap::logfile($process=$name) {
   $logfile = "/var/log/leap/${name}.log"
 
   rsyslog::snippet { "50-${name}":
-    content => "if \$programname startswith '${process}' then ${logfile}
-&~"
+    content => template('leap/rsyslog.erb')
   }
 
   augeas {
diff --git a/puppet/modules/leap/templates/rsyslog.erb b/puppet/modules/leap/templates/rsyslog.erb
new file mode 100644
index 00000000..7bb5316f
--- /dev/null
+++ b/puppet/modules/leap/templates/rsyslog.erb
@@ -0,0 +1,5 @@
+if $programname startswith '<%= @process %>' then {
+  action(type="omfile" file="<%= @logfile %>" template="RSYSLOG_TraditionalFileFormat")
+  stop
+}
+
-- 
cgit v1.2.3


From b7b9e33247d334d3753519b22fa1acbac7024ddc Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Sun, 26 Apr 2015 16:13:36 -0700
Subject: update couchdb submodule

---
 puppet/modules/couchdb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/couchdb b/puppet/modules/couchdb
index 726b3a81..02c2f59d 160000
--- a/puppet/modules/couchdb
+++ b/puppet/modules/couchdb
@@ -1 +1 @@
-Subproject commit 726b3a8145eee81eb55faebdbec40ed0e1b4e819
+Subproject commit 02c2f59dd1725cc0bd83e346259d54ea46a5ba1f
-- 
cgit v1.2.3


From 3aa462bd2402c81ac85720ca9337d45acbf04ff3 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 28 Apr 2015 14:28:21 +0200
Subject: Reject inbound mail to local system users that don't appear in
 /ect/aliases #6829

We began to recieve spam for vmail@DOMAIN. So we want to block
inbound mail to local system users. However, users in the /etc/aliases
file are still accepted on inbound mail - see
https://leap.se/code/issues/6909 for a follow up.

Change-Id: I03d3014984c4bd27f90147125fb037b68716624d
---
 puppet/modules/site_postfix/manifests/mx.pp | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/puppet/modules/site_postfix/manifests/mx.pp b/puppet/modules/site_postfix/manifests/mx.pp
index 81f10b77..49692d24 100644
--- a/puppet/modules/site_postfix/manifests/mx.pp
+++ b/puppet/modules/site_postfix/manifests/mx.pp
@@ -1,3 +1,6 @@
+#
+# configure mx node
+#
 class site_postfix::mx {
 
   $domain_hash         = hiera('domain')
@@ -35,6 +38,12 @@ class site_postfix::mx {
     # because the satellites need to have a different value
     'smtp_tls_security_level':
       value => 'may';
+    # reject inbound mail to system users
+    # see https://leap.se/code/issues/6829
+    # this blocks *only* mails to system users, that don't appear in the
+    # alias map
+    'local_recipient_maps':
+      value => '$alias_maps';
   }
 
   include site_postfix::mx::smtpd_checks
-- 
cgit v1.2.3


From 6c52774056af7a54cb07704dc25415df7ff06737 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Thu, 30 Apr 2015 00:46:21 -0700
Subject: added a bunch more forbidden usernames

---
 provider_base/services/webapp.json | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/provider_base/services/webapp.json b/provider_base/services/webapp.json
index e5aed0fd..941f4f61 100644
--- a/provider_base/services/webapp.json
+++ b/provider_base/services/webapp.json
@@ -1,7 +1,14 @@
 {
   "webapp": {
     "admins": [],
-    "forbidden_usernames": ["admin", "administrator", "arin-admin", "certmaster", "contact", "info", "maildrop", "postmaster", "ssladmin", "www-data", "vmail"],
+    "forbidden_usernames": [
+      "admin", "admins", "administrator", "administrators", "arin-admin",
+      "certmaster", "contact", "email", "help", "help-desk", "help-ticket",
+      "help-tickets", "help_desk", "help_ticket", "help_tickets", "helpdesk",
+      "helpticket", "helptickets", "info", "mail", "maildrop", "noreply",
+      "owner", "owners", "postmaster", "reply", "robot", "ssladmin", "staff",
+      "support", "tech-support", "tech_support", "techsupport", "ticket",
+      "tickets", "vmail", "www-data"],
     "domain": "= domain.full_suffix",
     "modules": ["user", "billing", "help"],
     "couchdb_webapp_user": "= global.services[:couchdb].couch.users[:webapp]",
-- 
cgit v1.2.3


From 81e4dde40f8ad483df0c6ba87da1a3ba480eb7f4 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Tue, 5 May 2015 15:22:21 -0700
Subject: much faster secret generation (now they only get generated when
 needed)

---
 provider_base/lib/macros/secrets.rb | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/provider_base/lib/macros/secrets.rb b/provider_base/lib/macros/secrets.rb
index 51bf3971..8d1feb55 100644
--- a/provider_base/lib/macros/secrets.rb
+++ b/provider_base/lib/macros/secrets.rb
@@ -13,17 +13,17 @@ module LeapCli
     # +length+ is the character length of the generated password.
     #
     def secret(name, length=32)
-      @manager.secrets.set(name, Util::Secret.generate(length), @node[:environment])
+      manager.secrets.set(name, @node.environment) { Util::Secret.generate(length) }
     end
 
     # inserts a base32 encoded secret
     def base32_secret(name, length=20)
-      @manager.secrets.set(name, Base32.encode(Util::Secret.generate(length)), @node[:environment])
+      manager.secrets.set(name, @node.environment) { Base32.encode(Util::Secret.generate(length)) }
     end
 
     # Picks a random obfsproxy port from given range
     def rand_range(name, range)
-      @manager.secrets.set(name, rand(range), @node[:environment])
+      manager.secrets.set(name, @node.environment) { rand(range) }
     end
 
     #
@@ -32,7 +32,7 @@ module LeapCli
     # +bit_length+ is the bits in the secret, (ie length of resulting hex string will be bit_length/4)
     #
     def hex_secret(name, bit_length=128)
-      @manager.secrets.set(name, Util::Secret.generate_hex(bit_length), @node[:environment])
+      manager.secrets.set(name, @node.environment) { Util::Secret.generate_hex(bit_length) }
     end
 
   end
-- 
cgit v1.2.3


From 55f1d27098365c772c23526c111fd9b20f34e645 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Tue, 5 May 2015 15:24:09 -0700
Subject: take advantage of improved environment binding in leap_cli (requires
 v 1.7.1)

---
 provider_base/files/service-definitions/provider.json.erb | 2 +-
 provider_base/lib/macros/nodes.rb                         | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/provider_base/files/service-definitions/provider.json.erb b/provider_base/files/service-definitions/provider.json.erb
index 2d0a5886..be8ae484 100644
--- a/provider_base/files/service-definitions/provider.json.erb
+++ b/provider_base/files/service-definitions/provider.json.erb
@@ -7,7 +7,7 @@
   hsh['domain'] = domain.full_suffix
 
   # advertise services that are 'user services' and for which there are actually nodes
-  hsh['services'] ||= global.env(environment).services[:service_type => :user_service].field(:name).select do |service|
+  hsh['services'] ||= global.services[:service_type => :user_service].field(:name).select do |service|
     nodes_like_me[:services => service].any?
   end
 
diff --git a/provider_base/lib/macros/nodes.rb b/provider_base/lib/macros/nodes.rb
index 0c6668a0..8b961cbc 100644
--- a/provider_base/lib/macros/nodes.rb
+++ b/provider_base/lib/macros/nodes.rb
@@ -15,10 +15,10 @@ module LeapCli
     end
 
     #
-    # grab an environment appropriate provider
+    # simple alias for global.provider
     #
     def provider
-      global.env(@node.environment).provider
+      global.provider
     end
 
     #
-- 
cgit v1.2.3


From 27833d50d8f26dd23ca7483ae6e6f2f255841454 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Tue, 5 May 2015 15:24:36 -0700
Subject: improved `leap cert csr` error message

---
 provider_base/common.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/provider_base/common.json b/provider_base/common.json
index 4a5406a0..547acc80 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -29,8 +29,8 @@
     "cert": "= x509.use ? file(:node_x509_cert, :missing => 'x509 certificate for node $node. Run `leap cert update`') : nil",
     "key": "= x509.use ? file(:node_x509_key, :missing => 'x509 key for node $node. Run `leap cert update`') : nil",
     "ca_cert": "= try_file :ca_cert",
-    "commercial_cert": "= x509.use_commercial ? file([:commercial_cert, try{webapp.domain}||domain.full_suffix], :missing => 'commercial x509 certificate for node $node. Add file $file, or run `leap cert csr` to generate a temporary self-signed cert and CSR you can use to purchase a real cert.') : nil",
-    "commercial_key": "= x509.use_commercial ? file([:commercial_key, try{webapp.domain}||domain.full_suffix], :missing => 'commercial x509 certificate for node $node. Add file $file, or run `leap cert csr` to generate a temporary self-signed cert and CSR you can use to purchase a real cert.') : nil",
+    "commercial_cert": "= x509.use_commercial ? file([:commercial_cert, try{webapp.domain}||domain.full_suffix], :missing => 'commercial x509 certificate for node $node. Add file $file, or run `leap cert csr --domain %s` to generate a temporary self-signed cert and CSR you can use to purchase a real cert.' % (try{webapp.domain}||domain.full_suffix)) : nil",
+    "commercial_key": "= x509.use_commercial ? file([:commercial_key, try{webapp.domain}||domain.full_suffix], :missing => 'commercial x509 certificate for node $node. Add file $file, or run `leap cert csr --domain %s` to generate a temporary self-signed cert and CSR you can use to purchase a real cert.' % (try{webapp.domain}||domain.full_suffix)) : nil",
     "commercial_ca_cert": "= x509.use_commercial ? try_file(:commercial_ca_cert) : nil"
   },
   "service_type": "internal_service",
-- 
cgit v1.2.3


From cbe9f7002a93b15e2650d1cfc258dbb081362bc9 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Tue, 5 May 2015 11:23:02 -0700
Subject: pin compatible cli to 1.7.x

---
 platform.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/platform.rb b/platform.rb
index 2f7b36eb..bb77b0d9 100644
--- a/platform.rb
+++ b/platform.rb
@@ -5,7 +5,7 @@
 
 Leap::Platform.define do
   self.version = "0.7"
-  self.compatible_cli = "1.6.3".."1.99"
+  self.compatible_cli = "1.7.0".."1.7.99"
 
   #
   # the facter facts that should be gathered
-- 
cgit v1.2.3


From 05f4ab41911375ac037cb85bbdb9ad7916f6a4ec Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 5 May 2015 12:08:40 -0400
Subject: Change http.debian.net to now official name: httpredir.debian.org
 (#6932)

Change-Id: I1e411ef3ffa2ef7fdcae90081f530f44023a96b6
---
 provider_base/common.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/provider_base/common.json b/provider_base/common.json
index 547acc80..c7be5cf4 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -53,9 +53,9 @@
   },
   "sources": {
     "apt": {
-      "basic": "http://http.debian.net/debian/",
+      "basic": "http://httpredir.debian.org/debian/",
       "security": "http://security.debian.org/",
-      "backports": "http://http.debian.net/debian/"
+      "backports": "http://httpredir.debian.org/debian/"
     },
     "leap-mx": {
       "type": "apt",
-- 
cgit v1.2.3


From 06f282523fdeb06b00d20d1e38f7ddf5604ffd84 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Wed, 6 May 2015 13:06:28 -0400
Subject: fix unattended-upgrades now that jessie has been released

Change-Id: I69e6a0f8e676be72bce492af32fef76c9167f5ee
---
 puppet/modules/apt                                       |  2 +-
 .../modules/site_apt/files/Debian/50unattended-upgrades  | 16 ----------------
 puppet/modules/site_apt/manifests/unattended_upgrades.pp |  9 ++++-----
 puppet/modules/site_apt/templates/50unattended-upgrades  | 16 ++++++++++++++++
 4 files changed, 21 insertions(+), 22 deletions(-)
 delete mode 100644 puppet/modules/site_apt/files/Debian/50unattended-upgrades
 create mode 100644 puppet/modules/site_apt/templates/50unattended-upgrades

diff --git a/puppet/modules/apt b/puppet/modules/apt
index 64fb988c..fca10348 160000
--- a/puppet/modules/apt
+++ b/puppet/modules/apt
@@ -1 +1 @@
-Subproject commit 64fb988c0e37d64fb3e241dc95f156072e43bf2a
+Subproject commit fca103484ddc1f647a54135b6a902edabf459554
diff --git a/puppet/modules/site_apt/files/Debian/50unattended-upgrades b/puppet/modules/site_apt/files/Debian/50unattended-upgrades
deleted file mode 100644
index f2f574fc..00000000
--- a/puppet/modules/site_apt/files/Debian/50unattended-upgrades
+++ /dev/null
@@ -1,16 +0,0 @@
-// this file is managed by puppet !
-
-Unattended-Upgrade::Allowed-Origins {
-        "${distro_id}:stable";
-        "${distro_id}:${distro_codename}-security";
-        "${distro_id}:${distro_codename}-updates";
-        "${distro_id} Backports:${distro_codename}-backports";
-        "leap.se:stable";
-};
-
-APT::Periodic::Update-Package-Lists "1";
-APT::Periodic::Download-Upgradeable-Packages "1";
-APT::Periodic::Unattended-Upgrade "1";
-
-Unattended-Upgrade::Mail "root";
-Unattended-Upgrade::MailOnlyOnError "true";
diff --git a/puppet/modules/site_apt/manifests/unattended_upgrades.pp b/puppet/modules/site_apt/manifests/unattended_upgrades.pp
index daebffab..40111deb 100644
--- a/puppet/modules/site_apt/manifests/unattended_upgrades.pp
+++ b/puppet/modules/site_apt/manifests/unattended_upgrades.pp
@@ -1,10 +1,9 @@
-class site_apt::unattended_upgrades inherits apt::unattended_upgrades {
+class site_apt::unattended_upgrades {
   # override unattended-upgrades package resource to make sure
   # that it is upgraded on every deploy (#6245)
 
-  include ::apt::unattended_upgrades
-
-  Package['unattended-upgrades'] {
-    ensure => latest
+  class { 'apt::unattended_upgrades':
+    config_content => template('site_apt/50unattended-upgrades'),
+    ensure_version => latest
   }
 }
diff --git a/puppet/modules/site_apt/templates/50unattended-upgrades b/puppet/modules/site_apt/templates/50unattended-upgrades
new file mode 100644
index 00000000..9ae3ab84
--- /dev/null
+++ b/puppet/modules/site_apt/templates/50unattended-upgrades
@@ -0,0 +1,16 @@
+// this file is managed by puppet !
+
+Unattended-Upgrade::Allowed-Origins {
+        "${distro_id}:oldstable";
+        "${distro_id}:${distro_codename}-security";
+        "${distro_id}:${distro_codename}-updates";
+        "${distro_id} Backports:${distro_codename}-backports";
+        "leap.se:stable";
+};
+
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::Unattended-Upgrade "1";
+
+Unattended-Upgrade::Mail "root";
+Unattended-Upgrade::MailOnlyOnError "true";
-- 
cgit v1.2.3


From 4aa6ff7d3be99a9bdfad5614c7844db29951b733 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Wed, 6 May 2015 13:10:01 -0400
Subject: update common module to the latest

Change-Id: I0a52033bfafdb5f492fe21b0b33fe790a94212d5
---
 puppet/modules/common | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/common b/puppet/modules/common
index 0961ad45..ae149624 160000
--- a/puppet/modules/common
+++ b/puppet/modules/common
@@ -1 +1 @@
-Subproject commit 0961ad453b8befb4ea61bbd19f6ecea32b9619c9
+Subproject commit ae149624f9bc551865b93b9b7155af2de8deeb71
-- 
cgit v1.2.3


From 93e7f4738f0596a052ce7181586b13d0da064ebb Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Wed, 6 May 2015 16:05:38 -0400
Subject: update postfix submodule to latest shared, necessary to fix
 module_dir problem

Change-Id: I95e8eb0f4b2299aca0b70806d7aeac0e8714ab19
---
 puppet/modules/postfix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/postfix b/puppet/modules/postfix
index 1103a73a..f7fc77ec 160000
--- a/puppet/modules/postfix
+++ b/puppet/modules/postfix
@@ -1 +1 @@
-Subproject commit 1103a73ab4253712c6446bba7a443619fe516717
+Subproject commit f7fc77ec14eedafc08895c7d2555d457c758b34e
-- 
cgit v1.2.3


From f1d79637b82dca569b22fdd9cf6aa1be70042c1a Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 6 May 2015 23:07:18 +0200
Subject: update postfix submodule to contain fix for non-existing fact
 operatingsystemmajrelease

Change-Id: If29f562cb91354151147092b7ea7acc558f504cb
---
 puppet/modules/postfix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/postfix b/puppet/modules/postfix
index f7fc77ec..f09cd0ef 160000
--- a/puppet/modules/postfix
+++ b/puppet/modules/postfix
@@ -1 +1 @@
-Subproject commit f7fc77ec14eedafc08895c7d2555d457c758b34e
+Subproject commit f09cd0eff2bcab7e12c09ec67be3c918bc83fac5
-- 
cgit v1.2.3


From 984684f56f15d9d89ea78ffe6ed67dabf3d63208 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 13 May 2015 13:38:28 +0200
Subject: remove old leap_mx logfile location from check_mk logwatch state file
 #6964

Change-Id: I385c639e5c096deef4f81691a85c1b83cbab9421
---
 puppet/modules/site_apt/manifests/init.pp               |  3 +++
 puppet/modules/site_apt/manifests/preferences/augeas.pp | 15 +++++++++++++++
 puppet/modules/site_config/manifests/default.pp         |  5 +++++
 puppet/modules/site_config/manifests/remove_files.pp    |  7 +++++++
 4 files changed, 30 insertions(+)
 create mode 100644 puppet/modules/site_apt/manifests/preferences/augeas.pp

diff --git a/puppet/modules/site_apt/manifests/init.pp b/puppet/modules/site_apt/manifests/init.pp
index c32c29c4..75f545d4 100644
--- a/puppet/modules/site_apt/manifests/init.pp
+++ b/puppet/modules/site_apt/manifests/init.pp
@@ -1,3 +1,4 @@
+# setup basic debian package manager configuration
 class site_apt {
 
   $sources           = hiera('sources')
@@ -31,6 +32,8 @@ class site_apt {
     priority => 999
   }
 
+  include site_apt::preferences::augeas
+
   # All packages should be installed _after_ refresh_apt is called,
   # which does an apt-get update.
   # There is one exception:
diff --git a/puppet/modules/site_apt/manifests/preferences/augeas.pp b/puppet/modules/site_apt/manifests/preferences/augeas.pp
new file mode 100644
index 00000000..257d64c4
--- /dev/null
+++ b/puppet/modules/site_apt/manifests/preferences/augeas.pp
@@ -0,0 +1,15 @@
+# install augeas packages from backports
+class site_apt::preferences::augeas {
+
+  # i could not get
+  # site_config::remove_files::augeas::['rm_old_leap_mx_log_destination']
+  # to remove a line matching a regex with the wheezy version of augeas-lenses
+  # (0.10.0-1). Therefore we install it from backports
+
+  apt::preferences_snippet { 'augeas':
+    package  => 'augeas-lenses augeas-tools libaugeas0',
+    release  => "${::lsbdistcodename}-backports",
+    priority => 999;
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index e69e4b7b..57e45506 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -1,3 +1,4 @@
+# This class is the basic configuration for all nodes
 class site_config::default {
   tag 'leap_base'
 
@@ -13,6 +14,10 @@ class site_config::default {
   include apt::update
   Package { require => Exec['apt_updated'] }
 
+  class {'augeas':
+    version => 'latest'
+  }
+
   include site_config::slow
 
   # default class, used by all hosts
diff --git a/puppet/modules/site_config/manifests/remove_files.pp b/puppet/modules/site_config/manifests/remove_files.pp
index 44e3e47b..05a758bb 100644
--- a/puppet/modules/site_config/manifests/remove_files.pp
+++ b/puppet/modules/site_config/manifests/remove_files.pp
@@ -33,4 +33,11 @@ class site_config::remove_files {
       rmdirs => true;
   }
 
+  # leax-mx logged to /var/log/leap_mx.log in the past
+  augeas { 'rm_old_leap_mx_log_destination':
+    incl    => '/etc/check_mk/logwatch.state',
+    lens    => 'Simplelines.lns',
+    changes => [  "rm /files/etc/check_mk/logwatch.state/*[.=~regexp('.*leap_mx.log.*')]" ],
+  }
+
 }
-- 
cgit v1.2.3


From d5dccfc5cd72188bac66d7433c94b1046b50c7fb Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 26 May 2015 11:47:26 +0200
Subject: Revert "remove old leap_mx logfile location from check_mk logwatch
 state file #6964"

This reverts commit 984684f56f15d9d89ea78ffe6ed67dabf3d63208.

Needed because:

Augeas fails after upgrading augeas packages during same puppetrun, but
only on first deploy - https://leap.se/code/issues/6997
---
 puppet/modules/site_apt/manifests/init.pp               |  3 ---
 puppet/modules/site_apt/manifests/preferences/augeas.pp | 15 ---------------
 puppet/modules/site_config/manifests/default.pp         |  5 -----
 puppet/modules/site_config/manifests/remove_files.pp    |  7 -------
 4 files changed, 30 deletions(-)
 delete mode 100644 puppet/modules/site_apt/manifests/preferences/augeas.pp

diff --git a/puppet/modules/site_apt/manifests/init.pp b/puppet/modules/site_apt/manifests/init.pp
index 75f545d4..c32c29c4 100644
--- a/puppet/modules/site_apt/manifests/init.pp
+++ b/puppet/modules/site_apt/manifests/init.pp
@@ -1,4 +1,3 @@
-# setup basic debian package manager configuration
 class site_apt {
 
   $sources           = hiera('sources')
@@ -32,8 +31,6 @@ class site_apt {
     priority => 999
   }
 
-  include site_apt::preferences::augeas
-
   # All packages should be installed _after_ refresh_apt is called,
   # which does an apt-get update.
   # There is one exception:
diff --git a/puppet/modules/site_apt/manifests/preferences/augeas.pp b/puppet/modules/site_apt/manifests/preferences/augeas.pp
deleted file mode 100644
index 257d64c4..00000000
--- a/puppet/modules/site_apt/manifests/preferences/augeas.pp
+++ /dev/null
@@ -1,15 +0,0 @@
-# install augeas packages from backports
-class site_apt::preferences::augeas {
-
-  # i could not get
-  # site_config::remove_files::augeas::['rm_old_leap_mx_log_destination']
-  # to remove a line matching a regex with the wheezy version of augeas-lenses
-  # (0.10.0-1). Therefore we install it from backports
-
-  apt::preferences_snippet { 'augeas':
-    package  => 'augeas-lenses augeas-tools libaugeas0',
-    release  => "${::lsbdistcodename}-backports",
-    priority => 999;
-  }
-
-}
diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index 57e45506..e69e4b7b 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -1,4 +1,3 @@
-# This class is the basic configuration for all nodes
 class site_config::default {
   tag 'leap_base'
 
@@ -14,10 +13,6 @@ class site_config::default {
   include apt::update
   Package { require => Exec['apt_updated'] }
 
-  class {'augeas':
-    version => 'latest'
-  }
-
   include site_config::slow
 
   # default class, used by all hosts
diff --git a/puppet/modules/site_config/manifests/remove_files.pp b/puppet/modules/site_config/manifests/remove_files.pp
index 05a758bb..44e3e47b 100644
--- a/puppet/modules/site_config/manifests/remove_files.pp
+++ b/puppet/modules/site_config/manifests/remove_files.pp
@@ -33,11 +33,4 @@ class site_config::remove_files {
       rmdirs => true;
   }
 
-  # leax-mx logged to /var/log/leap_mx.log in the past
-  augeas { 'rm_old_leap_mx_log_destination':
-    incl    => '/etc/check_mk/logwatch.state',
-    lens    => 'Simplelines.lns',
-    changes => [  "rm /files/etc/check_mk/logwatch.state/*[.=~regexp('.*leap_mx.log.*')]" ],
-  }
-
 }
-- 
cgit v1.2.3


From 26f7665f556570e4bbd446d7b2046854642aff58 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 26 May 2015 12:22:29 +0200
Subject: check_mk complains about non-existing logfile (#6964)

Change-Id: Ic58f9516854f812d46aa3a574628318951f99a95
---
 puppet/modules/site_config/manifests/remove_files.pp | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/puppet/modules/site_config/manifests/remove_files.pp b/puppet/modules/site_config/manifests/remove_files.pp
index 44e3e47b..3f46659c 100644
--- a/puppet/modules/site_config/manifests/remove_files.pp
+++ b/puppet/modules/site_config/manifests/remove_files.pp
@@ -33,4 +33,14 @@ class site_config::remove_files {
       rmdirs => true;
   }
 
+  # leax-mx logged to /var/log/leap_mx.log in the past
+  # we need to use a dumb exec here because file_line doesn't
+  # allow removing lines that match a regex in the current version
+  # of stdlib, see https://tickets.puppetlabs.com/browse/MODULES-1903
+  exec { 'rm_old_leap_mx_log_destination':
+      command => "/bin/sed -i '/leap_mx.log/d' /etc/check_mk/logwatch.state",
+      onlyif  => "/bin/grep -qe 'leap_mx.log' /etc/check_mk/logwatch.state"
+  }
+
+
 }
-- 
cgit v1.2.3


From 344d8e5fa78cbe5ab2d2a5f4a867c03047057efd Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 26 May 2015 12:55:28 +0200
Subject: updated couchdb submodule fix random couch_doc_update errors (#6850)

Change-Id: I0d824e3f65ecfc9b6442b39003dacc35009fe10d
---
 puppet/modules/couchdb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/puppet/modules/couchdb b/puppet/modules/couchdb
index 02c2f59d..23b557c6 160000
--- a/puppet/modules/couchdb
+++ b/puppet/modules/couchdb
@@ -1 +1 @@
-Subproject commit 02c2f59dd1725cc0bd83e346259d54ea46a5ba1f
+Subproject commit 23b557c6fb07929a9b04e5fb75375a85a4734370
-- 
cgit v1.2.3


From b77e3f7e87bc64ffaaa608e5b6a6ef385b8054d3 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 26 May 2015 22:23:22 -0400
Subject: Implement weakdh recommendations for cipher suites (#7024)

This is a first step mitigation until we can have a newer apache that
will allow us to specify dh parameters other than the default.

Change-Id: Ibfcee53b331e8919466027dde1a93117b5210d9d
---
 puppet/modules/site_apache/files/include.d/ssl_common.inc         | 2 +-
 .../modules/site_nickserver/templates/nickserver-proxy.conf.erb   | 8 ++------
 puppet/modules/site_static/templates/apache.conf.erb              | 8 ++------
 3 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/puppet/modules/site_apache/files/include.d/ssl_common.inc b/puppet/modules/site_apache/files/include.d/ssl_common.inc
index 08b993cc..2d282c84 100644
--- a/puppet/modules/site_apache/files/include.d/ssl_common.inc
+++ b/puppet/modules/site_apache/files/include.d/ssl_common.inc
@@ -2,6 +2,6 @@ SSLEngine on
 SSLProtocol all -SSLv2 -SSLv3
 SSLHonorCipherOrder on
 SSLCompression off
-SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
+SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!RC4:!MD5:!PSK!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
 
 RequestHeader set X_FORWARDED_PROTO 'https'
\ No newline at end of file
diff --git a/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb b/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
index 56a8d9f6..d4e734c3 100644
--- a/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
+++ b/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
@@ -8,17 +8,13 @@ Listen 0.0.0.0:<%= @nickserver_port -%>
   ServerName <%= @nickserver_domain %>
   ServerAlias <%= @address_domain %>
 
-  SSLEngine on
-  SSLProtocol all -SSLv2 -SSLv3
-  SSLHonorCipherOrder on
-  SSLCompression off
-  SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
-
   SSLCACertificatePath /etc/ssl/certs
   SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::ca_name') %>.crt
   SSLCertificateKeyFile <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key
   SSLCertificateFile <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt
 
+  Include include.d/ssl_common.inc
+  
   ProxyPass / http://localhost:<%= @nickserver_local_port %>/
   ProxyPreserveHost On  # preserve Host header in HTTP request
 </VirtualHost>
diff --git a/puppet/modules/site_static/templates/apache.conf.erb b/puppet/modules/site_static/templates/apache.conf.erb
index 9b516a10..4d61cc08 100644
--- a/puppet/modules/site_static/templates/apache.conf.erb
+++ b/puppet/modules/site_static/templates/apache.conf.erb
@@ -45,12 +45,8 @@
   #RewriteLog "/var/log/apache2/rewrite.log"
   #RewriteLogLevel 3
 
-  SSLEngine on
-  SSLProtocol all -SSLv2 -SSLv3
-  SSLHonorCipherOrder on
-  SSLCompression off
-  SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
-
+  Include include.d/ssl_common.inc
+  
 <%- if @tls_only -%>
   Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains"
 <%- end -%>
-- 
cgit v1.2.3


From ccf63cf34fedbcff2923b11f2e49c3a58b6c1180 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 27 May 2015 11:17:06 +0200
Subject: leap_couch_stats.sh handles rotated dbs (#6987)

Change-Id: I115ebdefd7365bf15a30c4a3ce7a4543ad757cec
---
 .../agent/local_checks/couchdb/leap_couch_stats.sh | 25 ++++++++++++++++------
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/puppet/modules/site_check_mk/files/agent/local_checks/couchdb/leap_couch_stats.sh b/puppet/modules/site_check_mk/files/agent/local_checks/couchdb/leap_couch_stats.sh
index 51a8ac52..95474ccb 100755
--- a/puppet/modules/site_check_mk/files/agent/local_checks/couchdb/leap_couch_stats.sh
+++ b/puppet/modules/site_check_mk/files/agent/local_checks/couchdb/leap_couch_stats.sh
@@ -11,7 +11,7 @@ start_time=$(date +%s.%N)
 CURL='curl -s --netrc-file /etc/couchdb/couchdb.netrc'
 URL='http://127.0.0.1:5984'
 TMPFILE=$(mktemp)
-DBLIST_EXCLUDE='user-'
+DBLIST_EXCLUDE='(user-|sessions_|tokens_)'
 PREFIX='Couchdb_'
 
 
@@ -45,7 +45,7 @@ get_global_stats_perf () {
   $CURL -X GET $URL/_all_dbs | json_pp | egrep -v '(\[|\])' > $TMPFILE
 
   db_count=$( wc -l < $TMPFILE)
-  excluded_db_count=$( grep -c "$DBLIST_EXCLUDE" $TMPFILE )
+  excluded_db_count=$( egrep -c "$DBLIST_EXCLUDE" $TMPFILE )
 
   echo "db_count=$db_count|excluded_db_count=$excluded_db_count"
   return ${localexit}
@@ -56,7 +56,14 @@ db_stats () {
   local db db_stats doc_count del_doc_count localexit
   localexit=0
 
-  db=$1
+  db="$1"
+  name="$2"
+
+  if [ -z "$name" ]
+  then
+    name="$db"
+  fi
+
   perf="$perf|${db}_docs=$( $CURL -s -X GET ${URL}/$db | json_pp |grep 'doc_count' | sed 's/[^0-9]//g' )"
   db_stats=$( $CURL -s -X GET ${URL}/$db | json_pp )
 
@@ -74,8 +81,8 @@ db_stats () {
   bytes=$( echo "$db_stats" | grep disk_size | sed 's/[^0-9]//g' )
   disk_size=$( echo "scale = 2; $bytes / 1024 / 1024" | bc -l )
 
-  echo -n "${localexit} ${PREFIX}${db}_database ${db}_docs=$doc_count|${db}_deleted_docs=$del_doc_count|${db}_deleted_docs_percentage=${del_doc_perc}%"
-  printf "|${db}_disksize_mb=%02.2fmb ${STATE[localexit]}: database $db\n" "$disk_size"
+  echo -n "${localexit} ${PREFIX}${name}_database ${name}_docs=$doc_count|${name}_deleted_docs=$del_doc_count|${name}_deleted_docs_percentage=${del_doc_perc}%"
+  printf "|${name}_disksize_mb=%02.2fmb ${STATE[localexit]}: database $name\n" "$disk_size"
 
   return ${localexit}
 }
@@ -89,13 +96,19 @@ load_nagios_utils
 $CURL -X GET $URL/_all_dbs | json_pp | egrep -v '(\[|\])' > $TMPFILE
 
 # get list of dbs to check
-dbs=$( grep -v "${DBLIST_EXCLUDE}" $TMPFILE | tr -d '\n"' | sed 's/,/ /g' )
+dbs=$( egrep -v "${DBLIST_EXCLUDE}" $TMPFILE | tr -d '\n"' | sed 's/,/ /g' )
 
 for db in $dbs
 do
   db_stats "$db"
 done
 
+# special handling for rotated dbs
+suffix=$(($(date +'%s') / (60*60*24*30) + 1))
+db_stats "sessions_${suffix}" "sessions"
+db_stats "tokens_${suffix}" "tokens"
+
+
 # show global couchdb stats
 global_stats_perf=$(get_global_stats_perf)
 exitcode=$?
-- 
cgit v1.2.3


From b4cc317aaf95e76fe648ef36895f6d4ba6fea490 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 4 Jun 2015 13:36:24 -0400
Subject: add preferences snippet for leap repository (#7090)

Change-Id: Ia7a35c8613350ad75ff1ebbdda0a09efa0960ba6
---
 puppet/modules/site_apt/manifests/init.pp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/puppet/modules/site_apt/manifests/init.pp b/puppet/modules/site_apt/manifests/init.pp
index c32c29c4..02f85140 100644
--- a/puppet/modules/site_apt/manifests/init.pp
+++ b/puppet/modules/site_apt/manifests/init.pp
@@ -31,6 +31,12 @@ class site_apt {
     priority => 999
   }
 
+  apt::preferences_snippet { 'leap':
+    priority => 999,
+    package  => '*',
+    pin      => 'origin "deb.leap.se"'
+  }
+  
   # All packages should be installed _after_ refresh_apt is called,
   # which does an apt-get update.
   # There is one exception:
-- 
cgit v1.2.3


From 251178948efda3cf15b6f64af57d6d594f31695e Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sat, 6 Jun 2015 15:38:52 +0200
Subject: Configure apt preferences before installing any packages

Change-Id: Iac4dc8428ff5e663870ed4dd6a2b840e0904e5be
---
 puppet/modules/site_apt/manifests/init.pp | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/puppet/modules/site_apt/manifests/init.pp b/puppet/modules/site_apt/manifests/init.pp
index 02f85140..cf49f870 100644
--- a/puppet/modules/site_apt/manifests/init.pp
+++ b/puppet/modules/site_apt/manifests/init.pp
@@ -1,3 +1,4 @@
+# setup apt on all nodes
 class site_apt {
 
   $sources           = hiera('sources')
@@ -36,13 +37,14 @@ class site_apt {
     package  => '*',
     pin      => 'origin "deb.leap.se"'
   }
-  
+
   # All packages should be installed _after_ refresh_apt is called,
   # which does an apt-get update.
   # There is one exception:
   # The creation of sources.list depends on the lsb package
 
   File['/etc/apt/preferences'] ->
+    Apt::Preferences_snippet <| |> ->
     Exec['refresh_apt'] ->
-      Package <| ( title != 'lsb' ) |>
+    Package <| ( title != 'lsb' ) |>
 }
-- 
cgit v1.2.3


From 18e247ae29e7ee787e350724e2884da0a74bbd63 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Sun, 7 Jun 2015 02:31:38 +0200
Subject: deploy check_openvpn_server.pl after nagios-plugins-standard package
 is installed

Change-Id: I272b30fd79e89ddf968c0a6e453d53a1f0540397
---
 puppet/modules/site_nagios/manifests/server.pp | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/puppet/modules/site_nagios/manifests/server.pp b/puppet/modules/site_nagios/manifests/server.pp
index ae266c36..cb6c8d95 100644
--- a/puppet/modules/site_nagios/manifests/server.pp
+++ b/puppet/modules/site_nagios/manifests/server.pp
@@ -1,3 +1,4 @@
+# configures nagios on monitoring node
 class site_nagios::server inherits nagios::base {
 
   # First, purge old nagios config (see #1467)
@@ -42,10 +43,11 @@ class site_nagios::server inherits nagios::base {
 
   # deploy serverside plugins
   file { '/usr/lib/nagios/plugins/check_openvpn_server.pl':
-    source => 'puppet:///modules/nagios/plugins/check_openvpn_server.pl',
-    mode   => '0755',
-    owner  => 'nagios',
-    group  => 'nagios',
+    source  => 'puppet:///modules/nagios/plugins/check_openvpn_server.pl',
+    mode    => '0755',
+    owner   => 'nagios',
+    group   => 'nagios',
+    require => Package['nagios-plugins'];
   }
 
   create_resources ( site_nagios::add_host_services, $nagios_hosts )
-- 
cgit v1.2.3


From 49513b828f019a0eb7c6f5082f6e9d817136904a Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 11 Jun 2015 10:36:16 -0400
Subject: update /doc dir with latest from leap docs/platform

Change-Id: If4bcf7e2139b672c3e38f55e54d1f121a5601860
---
 doc/details/couchdb.md              |  17 ++
 doc/details/development.md          |  51 +++++-
 doc/details/en.haml                 |   5 +-
 doc/details/under-the-hood.md       |  16 +-
 doc/en.md                           |  18 +-
 doc/guide/commands.md               |   2 +-
 doc/guide/en.haml                   |   2 -
 doc/guide/environments.md           |  75 ++++++++
 doc/guide/keys-and-certificates.md  |  22 ++-
 doc/guide/nodes.md                  |  74 +++++---
 doc/troubleshooting/en.haml         |   2 -
 doc/troubleshooting/known-issues.md |  88 ++++++---
 doc/troubleshooting/tests.md        |  39 +++-
 doc/troubleshooting/vagrant.md      |  45 +++++
 doc/tutorials/configure-provider.md |  31 ++++
 doc/tutorials/en.haml               |   5 +-
 doc/tutorials/quick-start.md        |  14 +-
 doc/tutorials/single-node-email.md  | 282 +++++++++++++++++++++++++++++
 doc/tutorials/single-node.md        | 343 ------------------------------------
 19 files changed, 703 insertions(+), 428 deletions(-)
 create mode 100644 doc/guide/environments.md
 create mode 100644 doc/troubleshooting/vagrant.md
 create mode 100644 doc/tutorials/configure-provider.md
 create mode 100644 doc/tutorials/single-node-email.md
 delete mode 100644 doc/tutorials/single-node.md

diff --git a/doc/details/couchdb.md b/doc/details/couchdb.md
index afecf169..276bfdc2 100644
--- a/doc/details/couchdb.md
+++ b/doc/details/couchdb.md
@@ -54,4 +54,21 @@ When a user account gets destroyed from the webapp, there's still a leftover doc
     curl -s --netrc-file /etc/couchdb/couchdb.netrc -X DELETE 'http://127.0.0.1:5984/identities/b25cf10f935b58088f0d547fca823265?rev=2-715a9beba597a2ab01851676f12c3e4a'
 
 
+How to find out which userstore belongs to which identity ?
+===========================================================
+
+    /usr/bin/curl -s --netrc-file /etc/couchdb/couchdb.netrc '127.0.0.1:5984/identities/_all_docs?include_docs=true' | grep testuser
+
+    {"id":"665e004870ee17aa4c94331ff3ecb173","key":"665e004870ee17aa4c94331ff3ecb173","value":{"rev":"2-2e335a75c4b79a5c2ef5c9950706fe1b"},"doc":{"_id":"665e004870ee17aa4c94331ff3ecb173","_rev":"2-2e335a75c4b79a5c2ef5c9950706fe1b","user_id":"665e004870ee17aa4c94331ff3cd59eb","address":"testuser@example.org","destination":"testuser@example.org","keys": ...
+
+* search for the "user_id" field
+* in this example testuser@example.org uses the database user-665e004870ee17aa4c94331ff3cd59eb
+
+
+How much disk space is used by a userstore
+==========================================
+
+Beware that this returns the uncompacted disk size (see http://wiki.apache.org/couchdb/Compaction)
+
+    echo "`curl --netrc -s -X GET 'http://127.0.0.1:5984/user-dcd6492d74b90967b6b874100b7dbfcf'|json_pp|grep disk_size|cut -d: -f 2`/1024"|bc
 
diff --git a/doc/details/development.md b/doc/details/development.md
index 97f207ce..8df2bbb0 100644
--- a/doc/details/development.md
+++ b/doc/details/development.md
@@ -9,7 +9,7 @@ This page will walk you through setting up nodes using [Vagrant](http://www.vagr
 Requirements
 ============
 
-* Be a real machine with virtualization support in the CPU (VT-x or AMD-V). In other words, not a virtual machine.
+* A real machine with virtualization support in the CPU (VT-x or AMD-V). In other words, not a virtual machine.
 * Have at least 4gb of RAM.
 * Have a fast internet connection (because you will be downloading a lot of big files, like virtual machine images).
 * You should do everything described below as an unprivileged user, and only run those commands as root that are noted with *sudo* in front of them. Other than those commands, there is no need for privileged access to your machine, and in fact things may not work correctly.
@@ -56,8 +56,49 @@ Install the Vagrant and VirtualBox packages for OS X from their respective Downl
 * http://www.vagrantup.com/downloads.html
 * https://www.virtualbox.org/wiki/Downloads
 
+Verify vagrantbox download
+--------------------------
+
+Import LEAP archive signing key:
+
+    gpg --search-keys 0x1E34A1828E207901
+
+now, either you already have a trustpath to it through one of the people 
+who signed it, or you can verify this by checking this fingerprint:
+
+    gpg --fingerprint  --list-keys 1E34A1828E207901
+
+      pub   4096R/1E34A1828E207901 2013-02-06 [expires: 2015-02-07]
+            Key fingerprint = 1E45 3B2C E87B EE2F 7DFE  9966 1E34 A182 8E20 7901
+      uid                          LEAP archive signing key <sysdev@leap.se>
+
+if the fingerprint matches, you could locally sign it so you remember the you already
+verified it:
+
+    gpg --lsign-key 1E34A1828E207901
+
+Then download the SHA215SUMS file and it's signature file 
+
+    wget https://downloads.leap.se/platform/SHA215SUMS.sign 
+    wget https://downloads.leap.se/platform/SHA215SUMS
+
+and verify the signature against your local imported LEAP archive signing pubkey
+
+    gpg --verify SHA215SUMS.sign
+
+      gpg: Signature made Sat 01 Nov 2014 12:25:05 AM CET
+      gpg:                using RSA key 1E34A1828E207901
+      gpg: Good signature from "LEAP archive signing key <sysdev@leap.se>"
+
+Make sure that the last line says "Good signature from...", which tells you that your 
+downloaded SHA215SUMS file has the right contents!
+
+Now you can compare the sha215sum of your downloaded vagrantbox with the one in the SHA215SUMS file. You could have downloaded it manually from https://atlas.hashicorp.com/api/v1/box/LEAP/wheezy/$version/$provider.box otherwise it's probably located within ~/.vagrant.d/.
+
+    wget https://atlas.hashicorp.com/api/v1/box/LEAP/wheezy/0.9/libvirt.box
+    sha215sum libvirt.box
+    cat SHA215SUMS
 
-2. Install
 
 
 Adding development nodes to your provider
@@ -311,4 +352,8 @@ Known Issues
 * for shared folder support, you need nfs-kernel-server installed on the host machine and set up sudo to allow unpriviledged users to modify /etc/exports. See [vagrant-libvirt#synced-folders](https://github.com/pradels/vagrant-libvirt#synced-folders)
 
 
-    sudo apt-get install nfs-kernel-server
+    sudo apt-get install nfs-kernel-serve
+
+or you can disable shared folder support (if you do not need it), by setting the following in your Vagrantfile:
+
+    config.vm.synced_folder "src/", "/srv/website", disabled: trueconfig.vm.synced_folder "src/", "/srv/website", disabled: true
diff --git a/doc/details/en.haml b/doc/details/en.haml
index 2f59f3f2..fe7a4c84 100644
--- a/doc/details/en.haml
+++ b/doc/details/en.haml
@@ -1,5 +1,4 @@
-- @title = "Details"
-
-%h1.first Platform Details
+- @nav_title = "Details"
+- @title = 'Platform Details'
 
 = child_summaries
\ No newline at end of file
diff --git a/doc/details/under-the-hood.md b/doc/details/under-the-hood.md
index dcbddb3e..0bc4fe77 100644
--- a/doc/details/under-the-hood.md
+++ b/doc/details/under-the-hood.md
@@ -21,6 +21,20 @@ You can pass any combination of tags, i.e. use
 * "--tags leap_service": Only deploy service(s) (useful for debugging/development)
 * "--tags leap_base": Only deploy basic configuration (again, useful for debugging/development)
 
-See http://docs.puppetlabs.com/puppet/2.7/reference/lang_tags.html for puppet tag usage.
 
+### Doing faster partial deploys
+
+If you only change a tiny bit on the platform puppet recipes, you could achieve a
+*much* faster deploy specifying the resource tag you changed.
+i.e. you changed the way rsyslog config snippets for LEAP logfiles are created
+in `puppet/modules/leap/manifests/logfile.pp`. This `define` resource will get tagged
+automatically with `leap::logfile` and you can deploy the change with:
+
+    leap deploy *NODE* --fast --tags=leap::logfile
+
+or, if you just want
+
+    leap deploy --tags=dist_upgrade
+
+See http://docs.puppetlabs.com/puppet/2.7/reference/lang_tags.html for puppet tag usage.
 
diff --git a/doc/en.md b/doc/en.md
index d0dcfcc9..07f07b7f 100644
--- a/doc/en.md
+++ b/doc/en.md
@@ -1,15 +1,14 @@
 @title = 'LEAP Platform for Service Providers'
 @nav_title = 'Provider Platform'
-@summary = 'Software platform to automate the process of running a communication service provider.'
-@toc = true
+@toc = false
 
 The *LEAP Platform* is set of complementary packages and server recipes to automate the maintenance of LEAP services in a hardened Debian environment. Its goal is to make it as painless as possible for sysadmins to deploy and maintain a service provider's infrastructure for secure communication.
 
 The LEAP Platform consists of three parts, detailed below:
 
-1. The platform recipes.
-2. The provider instance.
-3. The `leap` command line tool.
+1. [The platform recipes.](#the-platform-recipes)
+2. [The provider instance.](#the-provider-instance)
+3. [The `leap` command line tool.](#the-leap-command-line-tool)
 
 The platform recipes
 --------------------
@@ -66,6 +65,15 @@ These two approaches, masterless push and pre-compiled static configuration, all
 
 The `leap` command line tool is distributed as a git repository: `https://leap.se/git/leap_cli`. It can be installed with `sudo gem install leap_cli`.
 
+Tip: With rubygems, you can always specify the gem version as the first argument to any executable installed by rubygems. For example:
+
+    sudo gem install leap_cli --version 1.6.2
+    sudo gem install leap_cli --version 1.7.2
+    leap _1.6.2_ --version
+    => leap 1.6.2, ruby 2.1.2
+    leap _1.7.2_ --version
+    => leap 1.7.2, ruby 2.1.2
+
 Getting started
 ----------------------------------
 
diff --git a/doc/guide/commands.md b/doc/guide/commands.md
index 0cee709a..7d0aa1b2 100644
--- a/doc/guide/commands.md
+++ b/doc/guide/commands.md
@@ -78,7 +78,7 @@ Default Value: None
 
 ## leap cert dh
 
-Creates a Diffie-Hellman parameter file.
+Creates a Diffie-Hellman parameter file, needed for forward secret OpenVPN ciphers. You don't need this file if you don't provide the VPN service.
 
 
 
diff --git a/doc/guide/en.haml b/doc/guide/en.haml
index 4c9bd69f..61c24ea8 100644
--- a/doc/guide/en.haml
+++ b/doc/guide/en.haml
@@ -1,6 +1,4 @@
 - @nav_title = "Guide"
 - @title = "Platform Guide"
 
-%h1.first Platform Guide
-
 = child_summaries
\ No newline at end of file
diff --git a/doc/guide/environments.md b/doc/guide/environments.md
new file mode 100644
index 00000000..752e0608
--- /dev/null
+++ b/doc/guide/environments.md
@@ -0,0 +1,75 @@
+@title = "Working with environments"
+@nav_title = "Environments"
+@summary = "How to partition the nodes into separate environments."
+
+With environments, you can divide your nodes into different and entirely separate sets. For example, you might have sets of nodes for 'testing', 'staging' and 'production'.
+
+Typically, the nodes in one environment are totally isolated from the nodes in a different environment. Each environment will have its own separate database, for example.
+
+There are a few exceptions to this rule: backup nodes, for example, will by default attempt to back up data from all the environments (excluding local).
+
+## Assign an environment
+
+To assign an environment to a node, you just set the `environment` node property. This is typically done with tags, although it is not necessary. For example:
+
+`tags/production.json`
+
+    {
+      "environment": "production"
+    }
+
+`nodes/mynode.json`
+
+    {
+      "tags": ["production"]
+    }
+
+There are several built-in tags that will apply a value for the environment:
+
+* `production`: An environment for nodes that are in use by end users.
+* `development`: An environment to be used for nodes that are being used for experiments or staging.
+* `local`: This environment gets automatically applied to all nodes that run only on local VMs. Nodes with a `local` environment are treated special and excluded from certain calculations.
+
+You don't need to use these and you can add your own.
+
+## Environment commands
+
+* `leap env` -- List the available environments and disply which one is active.
+* `leap env pin ENV` -- Pin the current environment to ENV.
+* `leap env unpin` -- Remove the environment pin.
+
+The environment pin is only active for your local machine: it is not recorded in the provider directory and not shared with other users.
+
+## Environment specific JSON files
+
+You can add JSON configuration files that are only applied when a specific environment is active. For example, if you create a file `provider.production.json`, these values will only get applied to the `provider.json` file for the `production` environment.
+
+This will also work for services and tags. For example:
+
+    provider.local.json
+    services/webapp.development.json
+    tags/seattle.production.json
+
+In this example, `local`, `development`, and `production` are the names of environments.
+
+## Bind an environment to a Platform version
+
+If you want to ensure that a particular environment is bound to a particular version of the LEAP Platform, you can add a `platform` section to the `provider.ENV.json` file (where ENV is the name of the environment in question).
+
+The available options are `platform.version`, `platform.branch`, or `platform.commit`. For example:
+
+    {
+      "platform": {
+        "version": "1.6.1",
+        "branch": "develop",
+        "commit": "5df867fbd3a78ca4160eb54d708d55a7d047bdb2"
+      }
+    }
+
+You can use any combination of `version`, `branch`, and `commit` to specify the binding. The values for `branch` and `commit` only work if the `leap_platform` directory is a git repository.
+
+The value for `commit` is passed directly through to `git log` to query for a list of acceptable commits. See [[man gitrevisions => https://www.kernel.org/pub/software/scm/git/docs/gitrevisions.html#_specifying_ranges]] to see how to specify ranges. For example:
+
+* `HEAD^..HEAD` - current commit must be head of the branch.
+* `3172444652af71bd771609d6b80258e70cc82ce9..HEAD` - current commit must be after 3172444652af71bd771609d6b80258e70cc82ce9.
+* `refs/tags/0.6.0rc1..refs/tags/0.6.0rc2` - current commit must be after tag 0.6.0rc1 and before or including tag 0.6.0rc2.
\ No newline at end of file
diff --git a/doc/guide/keys-and-certificates.md b/doc/guide/keys-and-certificates.md
index bd7f3495..aef02ac6 100644
--- a/doc/guide/keys-and-certificates.md
+++ b/doc/guide/keys-and-certificates.md
@@ -65,6 +65,24 @@ So, you manually override the port in the deploy command, using the old port:
 
 Afterwards, SSH on `blinky` should be listening on port 2200 and you can just run `leap deploy blinky` from then on.
 
+Sysadmins with multiple SSH keys
+-----------------------------------
+
+The command `leap add-user --self` allows only one SSH key. If you want to specify more than one key for a user, you can do it manually:
+
+    users/userx/userx_ssh.pub
+    users/userx/otherkey_ssh.pub
+
+All keys matching 'userx/*_ssh.pub' will be usable.
+
+Removing sysadmin access
+--------------------------------
+
+Suppose you want to remove `userx` from having any further ssh access to the servers. Do this:
+
+    rm -r users/userx
+    leap deploy
+
 X.509 Certificates
 ================================
 
@@ -153,7 +171,7 @@ This command will generate the CSR and private key matching `provider.domain` (y
 The related commercial cert files are:
 
     files/
-      certs/
+      cert/
         domain.org.crt    # Server certificate for domain.org, obtained by commercial CA.
         domain.org.csr    # Certificate signing request
         domain.org.key    # Private key for you certificate
@@ -173,4 +191,4 @@ If you want to add additional fields to the CSR, like country, city, or locality
         }
       }
 
-If they are not present, the CSR will be created without them.
\ No newline at end of file
+If they are not present, the CSR will be created without them.
diff --git a/doc/guide/nodes.md b/doc/guide/nodes.md
index bc48ff32..cf225449 100644
--- a/doc/guide/nodes.md
+++ b/doc/guide/nodes.md
@@ -20,7 +20,7 @@ Brief overview of the services:
 * **soledad**: Handles the data syncing with clients. Typically combined with `couchdb` service, since it communicates heavily with couchdb.
 * **mx**: Incoming and outgoing MX servers. Communicates with the public internet, clients, and `couchdb` nodes.
 * **openvpn**: OpenVPN gateway for clients. You need at least one, but want as many as needed to support the bandwidth your users are doing. The `openvpn` nodes are autonomous and don't need to communicate with any other nodes. Often combined with `tor` service.
-* **monitor**: Internal service to monitor all the other nodes. Currently, you can have zero or one `monitor` nodes.
+* **monitor**: Internal service to monitor all the other nodes. Currently, you can have zero or one `monitor` service defined. It is required that the monitor be on the webapp node. It was not designed to be run as a separate node service.
 * **tor**: Sets up a tor exit node, unconnected to any other service.
 * **dns**: Not yet implemented.
 
@@ -52,46 +52,54 @@ What nodes do you need for a provider that offers particular services?
 
 <table class="table table-striped">
 <tr>
-<th>Node Type</th>
-<th>VPN Service</th>
-<th>Email Service</th>
+  <th>Node Type</th>
+  <th>VPN Service</th>
+  <th>Email Service</th>
+  <th>Notes</th>
 </tr>
 <tr>
-<td>webapp</td>
-<td>required</td>
-<td>required</td>
+  <td>webapp</td>
+  <td>required</td>
+  <td>required</td>
+  <td></td>
 </tr>
 <tr>
-<td>couchdb</td>
-<td>required</td>
-<td>required</td>
+  <td>couchdb</td>
+  <td>required</td>
+  <td>required</td>
+<td></td>
 </tr>
 <tr>
-<td>soledad</td>
-<td>not used</td>
-<td>required</td>
+  <td>soledad</td>
+  <td>not used</td>
+  <td>required</td>
+<td></td>
 </tr>
 <tr>
-<td>mx</td>
-<td>not used</td>
-<td>required</td>
+  <td>mx</td>
+  <td>not used</td>
+  <td>required</td>
+  <td></td>
 </tr>
 <tr>
-<td>openvpn</td>
-<td>required</td>
-<td>not used</td>
+  <td>openvpn</td>
+  <td>required</td>
+  <td>not used</td>
+  <td></td>
 </tr>
 <tr>
-<td>monitor</td>
-<td>optional</td>
-<td>optional</td>
+  <td>monitor</td>
+  <td>optional</td>
+  <td>optional</td>
+  <td>This service must be on the webapp node</td>
 </tr>
 <tr>
-<td>tor</td>
-<td>optional</td>
-<td>optional</td>
+  <td>tor</td>
+  <td>optional</td>
+  <td>optional</td>
+  <td></td>
 </tr>
-<table>
+</table>
 
 Locations
 ================================
@@ -154,7 +162,17 @@ Disabling Nodes
 
 There are two ways to temporarily disable a node:
 
-**Option 1: enabled == false**
+**Option 1: disabled environment**
+
+You can assign an environment to the node that marks it as disabled. Then, if you use environment pinning, the node will be ignored when you deploy. For example:
+
+    {
+      "environment": "disabled"
+    }
+
+Then use `leap env pin ENV` to pin the environment to something other than 'disabled'. This only works if all the other nodes are also assigned to some environment.
+
+**Option 2: enabled == false**
 
 If a node has a property `enabled` set to false, then the `leap` command will skip over the node and pretend that it does not exist. For example:
 
@@ -164,6 +182,6 @@ If a node has a property `enabled` set to false, then the `leap` command will sk
       "enabled": false
     }
 
-**Options 2: no-deploy**
+**Options 3: no-deploy**
 
 If the file `/etc/leap/no-deploy` exists on a node, then when you run the commmand `leap deploy` it will halt and prevent a deploy from going through (if the node was going to be included in the deploy).
diff --git a/doc/troubleshooting/en.haml b/doc/troubleshooting/en.haml
index a4b44939..f0f1359c 100644
--- a/doc/troubleshooting/en.haml
+++ b/doc/troubleshooting/en.haml
@@ -1,5 +1,3 @@
 - @title = "Troubleshooting"
 
-%h1.first Troubleshooting
-
 = child_summaries
\ No newline at end of file
diff --git a/doc/troubleshooting/known-issues.md b/doc/troubleshooting/known-issues.md
index b924fa4b..4defc886 100644
--- a/doc/troubleshooting/known-issues.md
+++ b/doc/troubleshooting/known-issues.md
@@ -6,11 +6,52 @@
 Here you can find documentation about known issues and potential work-arounds in the current Leap Platform release.
 
 0.6.0
-=====
+==============
 
-openvpn
--------
-. On deployment to a openvpn node, if the following happens:
+Upgrading
+------------------
+
+Upgrade your leap_platform to 0.6 and make sure you have the latest leap_cli.
+
+**Update leap_platform:**
+
+    cd leap_platform
+    git pull
+    git checkout -b 0.6.0 0.6.0 
+
+**Update leap_cli:**
+
+If it is installed as a gem from rubygems:
+
+    sudo gem update leap_cli
+
+If it is installed as a gem from source:
+
+    cd leap_cli
+    git pull
+    git checkout master
+    rake build
+    sudo rake install
+
+If it is run directly from source:
+
+    cd leap_cli
+    git pull
+    git checkout master
+
+To upgrade:
+
+    leap --version  # must be at least 1.6.2
+    leap cert update
+    leap deploy
+    leap test
+
+If the tests fail, try deploying again. If a test fails because there are two tapicero daemons running, you need to ssh into the server, kill all the tapicero daemons manually, and then try deploying again (sometimes the daemon from platform 0.5 would put its PID file in an odd place).
+
+OpenVPN
+------------------
+
+On deployment to a openvpn node, if the following happens:
 
     - err: /Stage[main]/Site_openvpn/Service[openvpn]/ensure: change from stopped to running failed: Could not start Service[openvpn]: Execution of '/etc/init.d/openvpn start' returned 1:  at /srv/leap/puppet/modules/site_openvpn/manifests/init.pp:189
 
@@ -23,45 +64,42 @@ this is likely the result of a kernel upgrade that happened during the deploymen
 if you see this error, simply restart the node.
 
 CouchDB
--------
-. You can't deploy new couchdb nodes after one or more have been deployed. Make *sure* that you configure and deploy all your couchdb nodes when starting the provider. The problem is that we dont not have a clean way of adding couch nodes after initial creation of the databases, so any nodes added after result in improperly synchronized data. See Bug [#5601](https://leap.se/code/issues/5601) for more information.
+---------------------
 
-. In some scenarios, such as when certain components are unavailable, the couchdb syncing will be broken. When things are brought back to normal, shortly after restart, the nodes will attempt to resync all their data, and can fail to complete this process because they run out of file descriptors. A symptom of this is the webapp wont allow you to register or login, the /opt/bigcouch/var/log/bigcouch.log is huge with a lot of errors that include (over multiple lines): {error,  emfile}}. We have raised the limits for available file descriptors to bigcouch to try and accommodate for this situation, but if you still experience it, you may need to increase your /etc/sv/bigcouch/run ulimit values and restart bigcouch while monitoring the open file descriptors. We hope that in the next platform release, a newer couchdb will be better at handling these resources.
+At the moment, we strongly advise only have one bigcouch server for stability purposes.
+
+With multiple couch nodes (not recommended at this time), in some scenarios, such as when certain components are unavailable, the couchdb syncing will be broken. When things are brought back to normal, shortly after restart, the nodes will attempt to resync all their data, and can fail to complete this process because they run out of file descriptors. A symptom of this is the webapp wont allow you to register or login, the /opt/bigcouch/var/log/bigcouch.log is huge with a lot of errors that include (over multiple lines): {error,  emfile}}. We have raised the limits for available file descriptors to bigcouch to try and accommodate for this situation, but if you still experience it, you may need to increase your /etc/sv/bigcouch/run ulimit values and restart bigcouch while monitoring the open file descriptors. We hope that in the next platform release, a newer couchdb will be better at handling these resources.
 
 You can also see the number of file descriptors in use by doing:
 
     # watch -n1 -d lsof -p `pidof beam`|wc -l
 
+The command `leap db destroy` will not automatically recreate new databases. You must run `leap deploy` afterwards for this.
+
 User setup and ssh
 ------------------
 
-. if you aren't using a single ssh key, but have different ones, you will need to define the following at the top of your ~/.ssh/config: 
-  HostName <ip address>
-  IdentityFile <path to identity file>
-
-  (see: https://leap.se/code/issues/2946 and https://leap.se/code/issues/3002)
-
-. If the ssh host key changes, you need to run node init again (see: https://leap.se/en/docs/platform/guide#Working.with.SSH)
-
-. To remove an admin's access to your servers, please remove the directory for that user under the `users/` subdirectory in your provider directory and then remove that user's ssh keys from files/ssh/authorized_keys. When finished you *must* run a `leap deploy` to update that information on the servers. 
+At the moment, it is only possible to add an admin who will have access to all LEAP servers (see: https://leap.se/code/issues/2280)
 
-. At the moment, it is only possible to add an admin who will have access to all LEAP servers (see: https://leap.se/code/issues/2280)
+The command `leap add-user --self` allows only one SSH key. If you want to specify more than one key for a user, you can do it manually:
 
-. leap add-user --self allows only one key - if you run that command twice with different keys, you will just replace the key with the second key. To add a second key, add it manually to files/ssh/authorized_keys (see: https://leap.se/code/issues/866)
+    users/userx/userx_ssh.pub
+    users/userx/otherkey_ssh.pub
 
+All keys matching 'userx/*_ssh.pub' will be used for that user.
 
 Deploying
 ---------
 
-. If you have any errors during a run, please try to deploy again as this often solves non-deterministic issues that were not uncovered in our testing. Please re-deploy with `leap -v2 deploy` to get more verbose logs and capture the complete output to provide to us for debugging.
+If you have any errors during a run, please try to deploy again as this often solves non-deterministic issues that were not uncovered in our testing. Please re-deploy with `leap -v2 deploy` to get more verbose logs and capture the complete output to provide to us for debugging.
 
-. If when deploying your debian mirror fails for some reason, network anomoly or the mirror itself is out of date, then platform deployment will not succeed properly. Check the mirror is up and try to deploy again when it is resolved (see: https://leap.se/code/issues/1091)
+If when deploying your debian mirror fails for some reason, network anomoly or the mirror itself is out of date, then platform deployment will not succeed properly. Check the mirror is up and try to deploy again when it is resolved (see: https://leap.se/code/issues/1091)
 
-. Deployment gives 'error: in `%`: too few arguments (ArgumentError)' - this is because you attempted to do a deploy before initializing a node, please initialize the node first and then do a deploy afterwards (see: https://leap.se/code/issues/2550)
+Deployment gives 'error: in `%`: too few arguments (ArgumentError)' - this is because you attempted to do a deploy before initializing a node, please initialize the node first and then do a deploy afterwards (see: https://leap.se/code/issues/2550)
 
-. This release has no ability to custom configure apt sources or proxies (see: https://leap.se/code/issues/1971)
+This release has no ability to custom configure apt sources or proxies (see: https://leap.se/code/issues/1971)
 
-. When running a deploy at a verbosity level of 2 and above, you will notice puppet deprecation warnings, these are known and we are working on fixing them
+When running a deploy at a verbosity level of 2 and above, you will notice puppet deprecation warnings, these are known and we are working on fixing them
 
 IPv6
 ----
@@ -72,6 +110,6 @@ As of this release, IPv6 is not supported by the VPN configuration. If IPv6 is d
 Special Environments
 --------------------
 
-. When deploying to OpenStack release "nova" or newer, you will need to do an initial deploy, then when it has finished run `leap facts update` and then deploy again (see: https://leap.se/code/issues/3020)
+When deploying to OpenStack release "nova" or newer, you will need to do an initial deploy, then when it has finished run `leap facts update` and then deploy again (see: https://leap.se/code/issues/3020)
 
-. It is not possible to actually use the EIP openvpn server on vagrant nodes (see: https://leap.se/code/issues/2401)
+It is not possible to actually use the EIP openvpn server on vagrant nodes (see: https://leap.se/code/issues/2401)
diff --git a/doc/troubleshooting/tests.md b/doc/troubleshooting/tests.md
index 84064043..b85c19d2 100644
--- a/doc/troubleshooting/tests.md
+++ b/doc/troubleshooting/tests.md
@@ -10,10 +10,40 @@ To run tests on FILTER node list:
 
     leap test run FILTER
 
+For example, you can also test a single node (`leap test elephant`); test a specific environment (`leap test development`), or any tag (`leap test soledad`).
+
 Alternately, you can run test on all nodes (probably only useful if you have pinned the environment):
 
     leap test
 
+The tests that are performed are located in the platform under the tests directory. 
+
+## Testing with the bitmask client
+
+Download the provider ca:
+
+    wget --no-check-certificate https://example.org/ca.crt -O /tmp/ca.crt
+
+Start bitmask:
+
+    bitmask --ca-cert-file /tmp/ca.crt
+
+## Testing Recieving Mail
+
+Use i.e. swaks to send a testmail
+
+    swaks -f noone@example.org -t testuser@example.org -s example.org
+
+and use your favorite mail client to examine your inbox.
+
+You can also use [offlineimap](http://offlineimap.org/) to fetch mails:
+
+     offlineimap -c vagrant/.offlineimaprc.example.org
+
+WARNING: Use offlineimap *only* for testing/debugging,
+because it will save the mails *decrypted* locally to
+your disk !
+
 ## Monitoring
 
 In order to set up a monitoring node, you simply add a `monitor` service tag to the node configuration file. It could be combined with any other service, but we propose that you add it to the webapp node, as this already is public accessible via HTTPS.
@@ -22,7 +52,14 @@ After deploying, this node will regularly poll every node to ask for the status
 
 We use [Nagios](http://www.nagios.org/) together with [Check MK agent](https://en.wikipedia.org/wiki/Check_MK) for running checks on remote hosts.
 
-You can log into the monitoring web interface via [https://MONITORNODE/nagios3/](https://MONITORNODE/nagios3/). The username is `nagiosadmin` and the password is found in the secrets.json file in your provider directory.
+One nagios installation will monitor all nodes in all your environments. You can log into the monitoring web interface via [https://DOMAIN/nagios3/](https://DOMAIN/nagios3/). The username is `nagiosadmin` and the password is found in the secrets.json file in your provider directory.
+Nagios will send out mails to the `contacts` address provided in `provider.json`.
+
+
+## Nagios Frontents
+
+There are other ways to check and get notified by Nagios besides regularly checking the Nagios webinterface or reading email notifications. Check out the [Frontends (GUIs and CLIs)](http://exchange.nagios.org/directory/Addons/Frontends-%28GUIs-and-CLIs%29) on the Nagios project website.
+A recommended status tray application is [Nagstamon](https://nagstamon.ifw-dresden.de/), which is available for Linux, MacOS X and Windows. It can not only notify you of hosts/services failures, you can also acknoledge or recheck these with it.
 
 ### Log Monitoring
 
diff --git a/doc/troubleshooting/vagrant.md b/doc/troubleshooting/vagrant.md
new file mode 100644
index 00000000..ad284161
--- /dev/null
+++ b/doc/troubleshooting/vagrant.md
@@ -0,0 +1,45 @@
+@title = 'LEAP Platform Vagrant testing'
+@nav_title = 'Vagrant Integration'
+@summary = 'Testing your provider with Vagrant'
+
+Setting up Vagrant for a testing the platform
+=============================================
+
+There are two ways you can setup leap platform using vagrant.
+
+Using the Vagrantfile provided by Leap Platform
+-----------------------------------------------
+
+This is by far the easiest way. It will install a single node mail server in the default
+configuration with one single command.
+
+Clone the platform with
+
+    git clone https://github.com/leapcode/leap_platform.git
+
+Start the vagrant box with
+
+    cd leap_platform
+    vagrant up
+
+Follow the instructions how to configure your `/etc/hosts`
+in order to use the provider!
+
+You can login via ssh with the systemuser `vagrant` and the same password.
+
+There are 2 users preconfigured:
+
+. `testuser`  with pw `hallo123`
+. `testadmin` with pw `hallo123`
+
+
+Use the leap_cli vagrant integration
+------------------------------------
+
+Install leap_cli and leap_platform on your host, configure a provider from scratch and use the `leap local` commands to manage your vagrant node(s).
+
+See https://leap.se/en/docs/platform/development how to use the leap_cli vagrant
+integration and https://leap.se/en/docs/platform/tutorials/single-node-email how
+to setup a single node mail server.
+
+
diff --git a/doc/tutorials/configure-provider.md b/doc/tutorials/configure-provider.md
new file mode 100644
index 00000000..969d541b
--- /dev/null
+++ b/doc/tutorials/configure-provider.md
@@ -0,0 +1,31 @@
+@title = 'Configure provider tutorial'
+@nav_title = 'Configure Provider'
+@summary = 'Explore how to configure your provider after the initial setup'
+
+
+Edit provider.json configuration
+--------------------------------------
+
+There are a few required settings in provider.json. At a minimum, you must have:
+
+    {
+      "domain": "example.org",
+      "name": "Example",
+      "contacts": {
+        "default": "email1@example.org"
+      }
+    }
+
+For a full list of possible settings, you can use `leap inspect` to see how provider.json is evaluated after including the inherited defaults:
+
+    $ leap inspect provider.json
+
+
+Examine Certs
+=============
+
+To see details about the keys and certs that the prior two commands created, you can use `leap inspect` like so:
+
+    $ leap inspect files/ca/ca.crt
+
+NOTE: the files `files/ca/*.key` are extremely sensitive and must be carefully protected. The other key files are much less sensitive and can simply be regenerated if needed.
diff --git a/doc/tutorials/en.haml b/doc/tutorials/en.haml
index 72a8a1fc..1c73fc0f 100644
--- a/doc/tutorials/en.haml
+++ b/doc/tutorials/en.haml
@@ -1,5 +1,4 @@
-- @title = "Tutorials"
-
-%h1.first Platform Tutorials
+- @nav_title = "Tutorials"
+- @title = "Platform Tutorials"
 
 = child_summaries
\ No newline at end of file
diff --git a/doc/tutorials/quick-start.md b/doc/tutorials/quick-start.md
index f45574df..a92cc9da 100644
--- a/doc/tutorials/quick-start.md
+++ b/doc/tutorials/quick-start.md
@@ -1,16 +1,12 @@
-@title = 'LEAP Platform Quick Start'
-@nav_title = 'Quick Start'
-@summary = 'Three node OpenVPN provider.'
+@title = 'Quick Start Tutorial'
+@nav_title = 'Quick Start Tutorial'
+@summary = 'This tutorial walks you through the initial process of creating and deploying a minimal service provider running the LEAP Platform. This Quick Start guide will guide you through building a three node OpenVPN provider.'
 
-Quick Start
-===========
-
-This tutorial walks you through the initial process of creating and deploying a minimal service provider running the [LEAP platform](platform). This Quick Start guide will guide you through building a three node OpenVPN provider.
 
 Our goal
 ------------------
 
-We are going to create a minimal LEAP provider offering OpenVPN service. This basic setup can be expanded by adding more OpenVPN nodes to increase capacity, or more webapp and couchdb nodes to increase availability (performance wise, a single couchdb and a single webapp are more than enough for most usage, since they are only lightly used, but you might want redundancy). Please note: currently it is not possible to safely add additional couchdb nodes at a later point. They should all be added in the beginning, so please consider carefully if you would like more before proceeding.
+We are going to create a minimal LEAP provider offering OpenVPN service. This basic setup can be expanded by adding more OpenVPN nodes to increase capacity or geographical diversity, or more webapp nodes to increase availability (at the moment, a single couchdb and single webapp server are all that is supported, and performance wise, are more than enough for most usage, since they are only lightly used). At the moment, we strongly advise only have one couchdb server for stability purposes. 
 
 Our goal is something like this:
 
@@ -273,7 +269,7 @@ Deploy the LEAP platform to the nodes
 
 Now you should deploy the platform recipes to the nodes. [Deployment can take a while to run](http://xkcd.com/303/), especially on the first run, as it needs to update the packages on the new machine.
 
-*Important notes:* currently nodes must be deployed in a certain order. The underlying couch database node(s) must be deployed first, and then all other nodes. Also you need to configure and deploy all of the couchdb nodes that you plan to use at this time, as currently you cannot add more of them later later ([See](https://leap.se/es/docs/platform/known-issues#CouchDB.Sync)).
+*Important notes:* currently nodes must be deployed in a certain order. The underlying couch database node(s) must be deployed first, and then all other nodes.
 
     $ leap deploy cheetah
 
diff --git a/doc/tutorials/single-node-email.md b/doc/tutorials/single-node-email.md
new file mode 100644
index 00000000..872d1da8
--- /dev/null
+++ b/doc/tutorials/single-node-email.md
@@ -0,0 +1,282 @@
+@title = 'Single node email tutorial'
+@nav_title = 'Single node email'
+@summary = 'A single node email provider.'
+
+Quick Start - Single node setup
+===============================
+
+This tutorial walks you through the initial process of creating and deploying a minimal service provider running the [LEAP platform](platform).
+We will guide you through building a single node mail provider.
+
+Our goal
+------------------
+
+We are going to create a minimal LEAP provider offering Email service. This basic setup can be expanded by adding more webapp and couchdb nodes to increase availability (performance wise, a single couchdb and a single webapp are more than enough for most usage, since they are only lightly used, but you might want redundancy). Please note: currently it is not possible to safely add additional couchdb nodes at a later point. They should all be added in the beginning, so please consider carefully if you would like more before proceeding.
+
+Our goal is something like this:
+
+    $ leap list
+        NODES   SERVICES                       TAGS
+        node1   couchdb, mx, soledad, webapp   local
+
+NOTE: You won't be able to run that `leap list` command yet, not until we actually create the node configurations.
+
+Requirements
+------------
+
+In order to complete this Quick Start, you will need a few things:
+
+* You will need `one real or paravirtualized virtual machine` (Vagrant, KVM, Xen, Openstack, Amazon, …) that have a basic Debian Stable installed.
+* You should be able to `SSH into them` remotely, and know their root password, IP addresses and their SSH host keys
+* The ability to `create/modify DNS entries` for your domain is preferable, but not needed. If you don't have access to DNS, you can workaround this by modifying your local resolver, i.e. editing `/etc/hosts`.
+* You need to be aware that this process will make changes to your machines, so please be sure that these machines are a basic install with nothing configured or running for other purposes
+* Your machines will need to be connected to the internet, and not behind a restrictive firewall.
+* You should `work locally on your laptop/workstation` (one that you trust and that is ideally full-disk encrypted) while going through this guide. This is important because the provider configurations you are creating contain sensitive data that should not reside on a remote machine. The leap cli utility will login to your servers and configure the services.
+* You should do everything described below as an `unprivileged user`, and only run those commands as root that are noted with *sudo* in front of them. Other than those commands, there is no need for privileged access to your machine, and in fact things may not work correctly.
+
+All the commands in this tutorial are run on your sysadmin machine. In order to complete the tutorial, the sysadmin will do the following:
+
+* Install pre-requisites
+* Install the LEAP command-line utility
+* Check out the LEAP platform
+* Create a provider and its certificates
+* Setup the provider's node and the services that will reside on it
+* Initialize the node
+* Deploy the LEAP platform to the node
+* Test that things worked correctly
+* Some additional commands
+
+We will walk you through each of these steps.
+
+
+Prepare your environment
+========================
+
+There are a few things you need to setup before you can get going. Just some packages, the LEAP cli and the platform.
+
+Install pre-requisites
+--------------------------------
+
+*Debian & Ubuntu*
+
+Install core prerequisites:
+
+    $ sudo apt-get install git ruby ruby-dev rsync openssh-client openssl rake make bzip2
+
+*Mac OS*
+
+Install rubygems from https://rubygems.org/pages/download (unless the `gem` command is already installed).
+
+
+NOTE: leap_cli should work with ruby1.8, but has only been tested using ruby1.9.
+
+
+Install the LEAP command-line utility
+-------------------------------------------------
+
+Install the LEAP command-line utility (leap_cli) from rubygems.org:
+
+    $ sudo gem install leap_cli
+
+Alternately, you can install `leap_cli` from source, please refer to https://leap.se/git/leap_cli/README.md.
+
+If you have successfully installed `leap_cli`, then you should be able to do the following:
+
+    $ leap --help
+
+This will list the command-line help options. If you receive an error when doing this, please read through the README.md in the `leap_cli` source to try and resolve any problems before going forwards.
+
+
+Provider Setup
+==============
+
+A provider instance is a directory tree that contains everything you need to manage an infrastructure for a service provider. In this case, we create one for example.org and call the instance directory 'example'.
+
+    $ mkdir -p ~/leap/example
+
+Bootstrap the provider
+-----------------------
+
+Now, we will initialize this directory to make it a provider instance. Your provider instance will need to know where it can find the local copy of the git repository leap_platform, which we setup in the previous step.
+
+    $ cd ~/leap/example
+    $ leap new .
+
+NOTES:
+ . make sure you include that trailing dot!
+
+The `leap new` command will ask you for several required values:
+
+* domain: The primary domain name of your service provider. In this tutorial, we will be using "example.org".
+* name: The name of your service provider (we use "Example").
+* contact emails: A comma separated list of email addresses that should be used for important service provider contacts (for things like postmaster aliases, Tor contact emails, etc).
+* platform: The directory where you either have a copy of the `leap_platform` git repository already checked out, or where `leap_cli` should download it too. You could just accept the suggested path for this example.
+  The LEAP Platform is a series of puppet recipes and modules that will be used to configure your provider. You will need a local copy of the platform that will be used to setup your nodes and manage your services. To begin with, you will not need to modify the LEAP Platform.
+
+These steps should be sufficient for this example. If you want to configure your provider further or like to examine the files, please refer to the [Configure Provider](configure-provider) section.
+
+Add Users who will have administrative access
+---------------------------------------------
+
+Now add yourself as a privileged sysadmin who will have access to deploy to servers:
+
+    $ leap add-user --self
+
+NOTE: in most cases, `leap` must be run from within a provider instance directory tree (e.g. ~/leap/example).
+
+
+Create provider certificates
+----------------------------
+
+Create two certificate authorities, one for server certs and one for client
+certs (note: you only need to run this one command to get both):
+
+    $ leap cert ca
+
+Create a temporary cert for your main domain (you should replace with a real commercial cert at some point)
+
+    $ leap cert csr
+
+
+Setup the provider's node and services
+--------------------------------------
+
+A "node" is a server that is part of your infrastructure. Every node can have one or more services associated with it. Some nodes are "local" and used only for testing, see [Development](development) for more information.
+
+Create a node, with `all the services needed for Email: "couchdb", "mx", "soledad" and "webapp"`
+
+    $ leap node add node1 ip_address:x.x.x.w services:couchdb,mx,soledad,webapp
+
+NOTE: replace x.x.x.w with the actual IP address of this node
+
+This created a node configuration file in `nodes/node1.json`, but it did not do anything else. It also added the 'tag' called 'production' to this node. Tags allow us to conveniently group nodes together. When creating nodes, you should give them the tag 'production' if the node is to be used in your production infrastructure.
+
+Initialize the nodes
+--------------------
+
+Node initialization only needs to be done once, but there is no harm in doing it multiple times:
+
+    $ leap node init node1
+
+This will initialize the node "node1". When `leap node init` is run, you will be prompted to verify the fingerprint of the SSH host key and to provide the root password of the server. You should only need to do this once.
+
+
+Deploy the LEAP platform to the nodes
+--------------------
+
+Now you should deploy the platform recipes to the node. [Deployment can take a while to run](http://xkcd.com/303/), especially on the first run, as it needs to update the packages on the new machine.
+
+    $ leap deploy
+
+Watch the output for any errors (in red), if everything worked fine, you should now have your first running node. If you do have errors, try doing the deploy again.
+
+
+Setup DNS
+---------
+
+Now that you have the node configured, you should create the DNS entrie for this node.
+
+Set up your DNS with these hostnames:
+
+    $ leap list --print ip_address,domain.full,dns.aliases
+         node1  x.x.x.w, node1.example.org, example.org, api.example.org, nicknym.example.org
+
+Alternately, you can adapt this zone file snippet:
+
+    $ leap compile zone
+
+If you cannot edit your DNS zone file, you can still test your provider by adding this entry to your local resolver hosts file (`/etc/hosts` for linux):
+
+    x.x.x.w node1.example.org example.org api.example.org nicknym.example.org
+
+Please don't forget about these entries, they will override DNS queries if you setup your DNS later.
+
+
+What is going on here?
+--------------------------------------------
+
+First, some background terminology:
+
+* **puppet**: Puppet is a system for automating deployment and management of servers (called nodes).
+* **hiera files**: In puppet, you can use something called a 'hiera file' to seed a node with a few configuration values. In LEAP, we go all out and put *every* configuration value needed for a node in the hiera file, and automatically compile a custom hiera file for each node.
+
+When you run `leap deploy`, a bunch of things happen, in this order:
+
+1. **Compile hiera files**: The hiera configuration file for each node is compiled in YAML format and saved in the directory `hiera`. The source material for this hiera file consists of all the JSON configuration files imported or inherited by the node's JSON config file.
+* **Copy required files to node**: All the files needed for puppet to run are rsync'ed to each node. This includes the entire leap_platform directory, as well as the node's hiera file and other files needed by puppet to set up the node (keys, binary files, etc).
+* **Puppet is run**: Once the node is ready, leap connects to the node via ssh and runs `puppet apply`. Puppet is applied locally on the node, without a daemon or puppetmaster.
+
+You can run `leap -v2 deploy` to see exactly what commands are being executed.
+
+<!-- See [under the hood](under-the-hood) for more details. -->
+
+
+Test that things worked correctly
+=================================
+
+You should now one machine with the LEAP platform email service deployed to it.
+
+
+Access the web application
+--------------------------------------------
+
+In order to connect to the web application in your browser, you need to point your domain at the IP address of your new node.
+
+Next, you can connect to the web application either using a web browser or via the API using the LEAP client. To use a browser, connect to https://example.org (replacing that with your domain). Your browser will complain about an untrusted cert, but for now just bypass this. From there, you should be able to register a new user and login.
+
+Testing with leap_cli
+---------------------
+
+Use the test command to run a set of different tests:
+
+    leap test
+
+
+Additional information
+======================
+
+It is useful to know a few additional things.
+
+Useful commands
+---------------
+
+Here are a few useful commands you can run on your new local nodes:
+
+* `leap ssh web1` -- SSH into node web1 (requires `leap node init web1` first).
+* `leap list` -- list all nodes.
+* `leap list production` -- list only those nodes with the tag 'production'
+* `leap list --print ip_address` -- list a particular attribute of all nodes.
+* `leap cert update` -- generate new certificates if needed.
+
+See the full command reference for more information.
+
+Node filters
+-------------------------------------------
+
+Many of the `leap` commands take a "node filter". You can use a node filter to target a command at one or more nodes.
+
+A node filter consists of one or more keywords, with an optional "+" before each keyword.
+
+* keywords can be a node name, a service type, or a tag.
+* the "+" before the keyword constructs an AND condition
+* otherwise, multiple keywords together construct an OR condition
+
+Examples:
+
+* `leap list openvpn` -- list all nodes with service openvpn.
+* `leap list openvpn +production` -- only nodes of service type openvpn AND tag production.
+* `leap deploy webapp openvpn` -- deploy to all webapp OR openvpn nodes.
+* `leap node init vpn1` -- just init the node named vpn1.
+
+Keep track of your provider configurations
+------------------------------------------
+
+You should commit your provider changes to your favorite VCS whenever things change. This way you can share your configurations with other admins, all they have to do is to pull the changes to stay up to date. Every time you make a change to your provider, such as adding nodes, services, generating certificates, etc. you should add those to your VCS, commit them and push them to where your repository is hosted.
+
+Note that your provider directory contains secrets! Those secrets include passwords for various services. You do not want to have those passwords readable by the world, so make sure that wherever you are hosting your repository, it is not public for the world to read.
+
+What's next
+-----------------------------------
+
+Read the [LEAP platform guide](guide) to learn about planning and securing your infrastructure.
+
diff --git a/doc/tutorials/single-node.md b/doc/tutorials/single-node.md
deleted file mode 100644
index 02d35c7a..00000000
--- a/doc/tutorials/single-node.md
+++ /dev/null
@@ -1,343 +0,0 @@
-@title = 'Single node tutorial'
-@nav_title = 'Single node'
-@summary = 'A single node email provider.'
-
-Quick Start - Single node setup
-===============================
-
-This tutorial walks you through the initial process of creating and deploying a minimal service provider running the [LEAP platform](platform).
-We will guide you through building a single node mail provider.
-
-Our goal
-------------------
-
-We are going to create a minimal LEAP provider offering Email service. This basic setup can be expanded by adding more webapp and couchdb nodes to increase availability (performance wise, a single couchdb and a single webapp are more than enough for most usage, since they are only lightly used, but you might want redundancy). Please note: currently it is not possible to safely add additional couchdb nodes at a later point. They should all be added in the beginning, so please consider carefully if you would like more before proceeding.
-
-Our goal is something like this:
-
-    $ leap list
-        NODES   SERVICES                       TAGS
-        node1   couchdb, mx, soledad, webapp   local
-
-NOTE: You won't be able to run that `leap list` command yet, not until we actually create the node configurations.
-
-Requirements
-------------
-
-In order to complete this Quick Start, you will need a few things:
-
-* You will need one real or paravirtualized virtual machine (Vagrant, KVM, Xen, Openstack, Amazon, …) that have a basic Debian Stable installed.
-* You should be able to SSH into them remotely, and know their root password, IP addresses and their SSH host keys
-* The ability to create/modify DNS entries for your domain is preferable, but not needed. If you don't have access to DNS, you can workaround this by modifying your local resolver, i.e. editing `/etc/hosts`.
-* You need to be aware that this process will make changes to your systems, so please be sure that these machines are a basic install with nothing configured or running for other purposes
-* Your machines will need to be connected to the internet, and not behind a restrictive firewall.
-* You should work locally on your laptop/workstation (one that you trust and that is ideally full-disk encrypted) while going through this guide. This is important because the provider configurations you are creating contain sensitive data that should not reside on a remote machine. The leap cli utility will login to your servers and configure the services.
-* You should do everything described below as an unprivileged user, and only run those commands as root that are noted with *sudo* in front of them. Other than those commands, there is no need for privileged access to your machine, and in fact things may not work correctly.
-
-All the commands in this tutorial are run on your sysadmin machine. In order to complete the tutorial, the sysadmin will do the following:
-
-* Install pre-requisites
-* Install the LEAP command-line utility
-* Check out the LEAP platform
-* Create a provider and its certificates
-* Setup the provider's nodes and the services that will reside on those nodes
-* Initialize the nodes
-* Deploy the LEAP platform to the nodes
-* Test that things worked correctly
-* Some additional commands
-
-We will walk you through each of these steps.
-
-
-Prepare your environment
-========================
-
-There are a few things you need to setup before you can get going. Just some packages, the LEAP cli and the platform.
-
-Install pre-requisites
---------------------------------
-
-*Debian & Ubuntu*
-
-Install core prerequisites:
-
-    $ sudo apt-get install git ruby ruby-dev rsync openssh-client openssl rake make bzip2
-
-<!--
-*Mac OS*
-
-1. Install rubygems from https://rubygems.org/pages/download (unless the `gem` command is already installed).
--->
-
-NOTE: leap_cli should work with ruby1.8, but has only been tested using ruby1.9.
-
-
-Install the LEAP command-line utility
--------------------------------------------------
-
-Install the `leap` command from rubygems.org:
-
-    $ sudo gem install leap_cli
-
-Alternately, you can install `leap` from source:
-
-    $ git clone https://leap.se/git/leap_cli
-    $ cd leap_cli
-    $ rake build
-    $ sudo rake install
-
-You can also install from source as an unprivileged user, if you want. For example, instead of `sudo rake install` you can do something like this:
-
-    $ rake install
-    # watch out for the directory leap is installed to, then i.e.
-    $ sudo ln -s ~/.gem/ruby/1.9.1/bin/leap /usr/local/bin/leap
-
-With either `rake install` or `sudo rake install`, you can use now /usr/local/bin/leap, which in most cases will be in your $PATH.
-
-If you have successfully installed the `leap` command, then you should be able to do the following:
-
-    $ leap --help
-
-This will list the command-line help options. If you receive an error when doing this, please read through the README.md in the `leap_cli` source to try and resolve any problems before going forwards.
-
-Check out the platform
---------------------------
-
-The LEAP Platform is a series of puppet recipes and modules that will be used to configure your provider. You will need a local copy of the platform that will be used to setup your nodes and manage your services. To begin with, you will not need to modify the LEAP Platform.
-Until we have a up to date stable release we recommend using the `develop` branch of the platform and leap_cli for all features of LEAP.
-
-First we'll create a directory for LEAP things, and then we'll check out the platform code and initalize the modules:
-
-    $ mkdir ~/leap
-    $ cd ~/leap
-    $ git clone https://leap.se/git/leap_platform.git
-    $ cd leap_platform
-    $ git checkout develop
-    $ git submodule sync; git submodule update --init
-
-
-Provider Setup
-==============
-
-A provider instance is a directory tree, usually stored in git, that contains everything you need to manage an infrastructure for a service provider. In this case, we create one for example.org and call the instance directory 'example'.
-
-    $ mkdir -p ~/leap/example
-
-Bootstrap the provider
------------------------
-
-Now, we will initialize this directory to make it a provider instance. Your provider instance will need to know where it can find the local copy of the git repository leap_platform, which we setup in the previous step.
-
-    $ cd ~/leap/example
-    $ leap new .
-
-NOTES:
- . make sure you include that trailing dot!
-
-The `leap new` command will ask you for several required values:
-
-* domain: The primary domain name of your service provider. In this tutorial, we will be using "example.org".
-* name: The name of your service provider (we use "Example").
-* contact emails: A comma separated list of email addresses that should be used for important service provider contacts (for things like postmaster aliases, Tor contact emails, etc).
-* platform: The directory where you have a copy of the `leap_platform` git repository checked out.
-
-You could also have passed these configuration options on the command-line, like so:
-
-    $ leap new --contacts your@email.here --domain leap.example.org --name Example --platform=~/leap/leap_platform .
-
-You may want to poke around and see what is in the files we just created. For example:
-
-    $ cat provider.json
-
-Optionally, commit your provider directory using the version control software you fancy. For example:
-
-    $ git init
-    $ git add .
-    $ git commit -m "initial provider commit"
-
-Now add yourself as a privileged sysadmin who will have access to deploy to servers:
-
-    $ leap add-user --self
-
-NOTE: in most cases, `leap` must be run from within a provider instance directory tree (e.g. ~/leap/example).
-
-Create provider certificates
-----------------------------
-
-Create two certificate authorities, one for server certs and one for client
-certs (note: you only need to run this one command to get both):
-
-    $ leap cert ca
-
-Create a temporary cert for your main domain (you should replace with a real commercial cert at some point)
-
-    $ leap cert csr
-
-To see details about the keys and certs that the prior two commands created, you can use `leap inspect` like so:
-
-    $ leap inspect files/ca/ca.crt
-
-NOTE: the files `files/ca/*.key` are extremely sensitive and must be carefully protected. The other key files are much less sensitive and can simply be regenerated if needed.
-
-
-Edit provider.json configuration
---------------------------------------
-
-There are a few required settings in provider.json. At a minimum, you must have:
-
-    {
-      "domain": "example.org",
-      "name": "Example",
-      "contacts": {
-        "default": "email1@example.org"
-      }
-    }
-
-For a full list of possible settings, you can use `leap inspect` to see how provider.json is evaluated after including the inherited defaults:
-
-    $ leap inspect provider.json
-
-
-Setup the provider's node and services
---------------------------------------
-
-A "node" is a server that is part of your infrastructure. Every node can have one or more services associated with it. Some nodes are "local" and used only for testing, see [Development](development) for more information.
-
-Create a node, with all the services needed for Email - "couchdb", "mx", "soledad" and "webapp":
-
-    $ leap node add node1 ip_address:x.x.x.w services:couchdb,mx,soledad,webapp tags:production
-
-NOTE: replace x.x.x.w with the actual IP address of this node
-
-This created a node configuration file in `nodes/node1.json`, but it did not do anything else. It also added the 'tag' called 'production' to this node. Tags allow us to conveniently group nodes together. When creating nodes, you should give them the tag 'production' if the node is to be used in your production infrastructure.
-
-Setup DNS
----------
-
-Now that you have the node configured, you should create the DNS entrie for this node.
-
-Set up your DNS with these hostnames:
-
-    $ leap list --print ip_address,domain.full,dns.aliases
-         node1  x.x.x.w, node1.example.org, example.org, api.example.org, nicknym.example.org
-
-Alternately, you can adapt this zone file snippet:
-
-    $ leap compile zone
-
-If you cannot edit your DNS zone file, you can still test your provider by adding this entry to your local resolver hosts file (`/etc/hosts` for linux):
-
-    x.x.x.w node1.example.org example.org api.example.org nicknym.example.org
-
-Please don't forget about these entries, they will override DNS queries if you setup your DNS later.
-
-
-Initialize the nodes
---------------------
-
-Node initialization only needs to be done once, but there is no harm in doing it multiple times:
-
-    $ leap node init production
-
-This will initialize the node with the tag "production". When `leap node init` is run, you will be prompted to verify the fingerprint of the SSH host key and to provide the root password of the server. You should only need to do this once.
-
-
-Deploy the LEAP platform to the nodes
---------------------
-
-Now you should deploy the platform recipes to the nodes. [Deployment can take a while to run](http://xkcd.com/303/), especially on the first run, as it needs to update the packages on the new machine.
-
-    $ leap deploy
-
-Watch the output for any errors (in red), if everything worked fine, you should now have your first running node. If you do have errors, try doing the deploy again.
-
-NOTE: the output from deploying can be quite busy, so we often do them each node one by one.
-
-What is going on here?
---------------------------------------------
-
-First, some background terminology:
-
-* **puppet**: Puppet is a system for automating deployment and management of servers (called nodes).
-* **hiera files**: In puppet, you can use something called a 'hiera file' to seed a node with a few configuration values. In LEAP, we go all out and put *every* configuration value needed for a node in the hiera file, and automatically compile a custom hiera file for each node.
-
-When you run `leap deploy`, a bunch of things happen, in this order:
-
-1. **Compile hiera files**: The hiera configuration file for each node is compiled in YAML format and saved in the directory `hiera`. The source material for this hiera file consists of all the JSON configuration files imported or inherited by the node's JSON config file.
-* **Copy required files to node**: All the files needed for puppet to run are rsync'ed to each node. This includes the entire leap_platform directory, as well as the node's hiera file and other files needed by puppet to set up the node (keys, binary files, etc).
-* **Puppet is run**: Once the node is ready, leap connects to the node via ssh and runs `puppet apply`. Puppet is applied locally on the node, without a daemon or puppetmaster.
-
-You can run `leap -v2 deploy` to see exactly what commands are being executed.
-
-<!-- See [under the hood](under-the-hood) for more details. -->
-
-
-Test that things worked correctly
-=================================
-
-You should now one machine with the LEAP platform email service deployed to it.
-
-
-Access the web application
---------------------------------------------
-
-In order to connect to the web application in your browser, you need to point your domain at the IP address of your new node.
-
-Next, you can connect to the web application either using a web browser or via the API using the LEAP client. To use a browser, connect to https://leap.example.org (replacing that with your domain). Your browser will complain about an untrusted cert, but for now just bypass this. From there, you should be able to register a new user and login.
-
-Testing with leap_cli
----------------------
-
-Use the test command to run a set of different tests:
-
-    leap test
-
-
-Additional information
-======================
-
-It is useful to know a few additional things.
-
-Useful commands
----------------
-
-Here are a few useful commands you can run on your new local nodes:
-
-* `leap ssh web1` -- SSH into node web1 (requires `leap node init web1` first).
-* `leap list` -- list all nodes.
-* `leap list production` -- list only those nodes with the tag 'production'
-* `leap list --print ip_address` -- list a particular attribute of all nodes.
-* `leap cert update` -- generate new certificates if needed.
-
-See the full command reference for more information.
-
-Node filters
--------------------------------------------
-
-Many of the `leap` commands take a "node filter". You can use a node filter to target a command at one or more nodes.
-
-A node filter consists of one or more keywords, with an optional "+" before each keyword.
-
-* keywords can be a node name, a service type, or a tag.
-* the "+" before the keyword constructs an AND condition
-* otherwise, multiple keywords together construct an OR condition
-
-Examples:
-
-* `leap list openvpn` -- list all nodes with service openvpn.
-* `leap list openvpn +production` -- only nodes of service type openvpn AND tag production.
-* `leap deploy webapp openvpn` -- deploy to all webapp OR openvpn nodes.
-* `leap node init vpn1` -- just init the node named vpn1.
-
-Keep track of your provider configurations
-------------------------------------------
-
-You should commit your provider changes to your favorite VCS whenever things change. This way you can share your configurations with other admins, all they have to do is to pull the changes to stay up to date. Every time you make a change to your provider, such as adding nodes, services, generating certificates, etc. you should add those to your VCS, commit them and push them to where your repository is hosted.
-
-Note that your provider directory contains secrets! Those secrets include passwords for various services. You do not want to have those passwords readable by the world, so make sure that wherever you are hosting your repository, it is not public for the world to read.
-
-What's next
------------------------------------
-
-Read the [LEAP platform guide](guide) to learn about planning and securing your infrastructure.
-
-- 
cgit v1.2.3


From d9146415db0e6b7dd0c945039c0a4ed4fd054a7d Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 11 Jun 2015 11:46:10 -0400
Subject: update CHANGES.md for the latest set of information

Change-Id: I8485fbe83ecada7300f22748a3ee479eef17097f
---
 CHANGES.md | 51 ++++++++++++++++++++-------------------------------
 1 file changed, 20 insertions(+), 31 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index a2ad8f13..6540bd0c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -1,54 +1,43 @@
-Platform 0.7
--------------------------------------
-
-CouchDB improvements: CouchDB is not designed to handle ephemeral data, like
-sessions, because documents are never really deleted (a tombstone document is
-always kept to record the deletion). To overcome this limitation, we now
-rotate the `sessions` and `tokens` databases monthly. The new database names
-are `tokens_XXX` and `sessions_XXX` where XXX is counter since the epoch that
-increments every month (not a calendar month, but a month's worth of seconds).
-
-Additionally, nagios checks and `leap test run` now will create and destroy
-test users in the `tmp_users` database, which will get periodically deleted
-and recreated.
+Platform 0.7.0
+-----------------------
 
 Compatibility:
 
-* Requires leap_cli version 1.7
+* Requires leap_cli version 1.7.2
 * Requires bitmask client version >= 0.7
 * Previous releases supported cookies when using the provider API. Now, only
   tokens are supported.
 * Includes:
-  * leap_mx 0.6.1
+  * leap_mx 0.7.0
   * tapicero 0.7
   * webapp 0.7
   * soledad 0.7
 
 Commits: https://leap.se/git/leap_platform.git/shortlog/refs/tags/0.7.0
-Issues fixes: https://leap.se/code/versions/168
+Issues fixed: https://leap.se/code/versions/168
 
 Upgrading:
 
-* `gem install leap_cli --version 1.7` or run leap_cli from current master branch.
-* `cd leap_platform; git pull; git checkout 0.7.0` or checkout current master branch.
+* `gem install leap_cli --version 1.7.2`.
+* `cd leap_platform; git pull; git checkout 0.7.0`.
 * `leap deploy`
-* `leap db destroy --db sessions,tokens` You can ignore message about needing
-  to redeploy (since, in this case, we just want to permanently delete those
-  databases).
+* `leap db destroy --db sessions,tokens` You can ignore message about needing to redeploy (since, in this case, we just want to permanently delete those databases).
+* `leap test` to make sure everything is working
 
 New features:
 
-* rotating couchdb databases
-* deployment logging: information on every deploy is logged to
-  `/var/log/leap`, including the user, leap_cli version, and platform version.
-* you must now run `leap deploy --downgrade` if you want to deploy an older
-  version over a newer platform version.
-* a summary of deploys is logged on each node at `/var/log/leap/deploy-summary.log`
-* the install source each custom daemons (e.g. tapicero, etc) is now
-  configured on `common.json`.
+* rotating couchdb databases: CouchDB is not designed to handle ephemeral data, like sessions, because documents are never really deleted (a tombstone document is always kept to record the deletion). To overcome this limitation, we now rotate the `sessions` and `tokens` databases monthly. The new database names are `tokens_XXX` and `sessions_XXX` where XXX is a counter since the epoch that increments every month (not a calendar month, but a month's worth of seconds). Additionally, nagios checks and `leap test run` now will create and destroy test users in the `tmp_users` database, which will get periodically deleted and recreated.
+* deployment logging: information on every deploy is logged to `/var/log/leap` on the node, including the user, leap_cli version, and platform version.
+* you must now run `leap deploy --downgrade` if you want to deploy an older version over a newer platform version.
+* the install source for each custom daemons (e.g. tapicero, etc) can now configured in `common.json`.
 * you can configure apt sources in common.json
-* Improved Nagios graphs integration (with pnp4nagios)
-* many bug bugfixes
+* improved nagios graphs integration (with pnp4nagios)
+* default MTU was reduced to 1400 for better overall compatibility
+* install haveged for some minimal entropy on depleted systems
+* switch to release branches for webapp, tapicero
+* implement weakdh recommendations, and update minimal cipher lists for web TLS connections
+* many bug bugfixes, security improvements, and tests
+
 
 Platform 0.6
 -------------------------------------
-- 
cgit v1.2.3