summaryrefslogtreecommitdiff
path: root/puppet/modules/site_static/manifests/init.pp
blob: 8df530751f2b145033d62f1c6ce03bbd6968d982 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
class site_static {
  tag 'leap_service'

  include site_config::x509::cert
  include site_config::x509::key
  include site_config::x509::ca_bundle

  $static        = hiera('static')
  $domains       = $static['domains']
  $formats       = $static['formats']
  $bootstrap     = $static['bootstrap_files']
  $tor           = hiera('tor', false)

  if $bootstrap['enabled'] {
    $bootstrap_domain  = $bootstrap['domain']
    $bootstrap_client  = $bootstrap['client_version']
    file { '/srv/leap/provider.json':
      content => $bootstrap['provider_json'],
      owner   => 'www-data',
      group   => 'www-data',
      mode    => '0444';
    }
    # It is important to always touch provider.json: the client needs to check x-min-client-version header,
    # but this is only sent when the file has been modified (otherwise 304 is sent by apache). The problem
    # is that changing min client version won't alter the content of provider.json, so we must touch it.
    exec { '/bin/touch /srv/leap/provider.json':
      require => File['/srv/leap/provider.json'];
    }
  }

  include site_apache::module::headers
  include site_apache::module::alias
  include site_apache::module::expires
  include site_apache::module::removeip
  include site_apache::common
  include site_config::ruby::dev

  if (member($formats, 'rack')) {
    include site_apt::preferences::passenger
    class { 'passenger':
      use_munin => false,
      require   => Class['site_apt::preferences::passenger']
    }
  }

  if (member($formats, 'amber')) {
    rubygems::gem{'amber-0.3.8':
       require =>  Package['zlib1g-dev']
     }

    package { 'zlib1g-dev':
        ensure => installed
    }
  }

  create_resources(site_static::domain, $domains)

  if $tor {
    $hidden_service = $tor['hidden_service']
    if $hidden_service['active'] {
      include site_webapp::hidden_service
    }
  }

  include site_shorewall::defaults
  include site_shorewall::service::http
  include site_shorewall::service::https
}