buildsystem/manifests/init.pp

class buildsystem {

    class base {
        $build_login = "iurt"
        $build_home_dir = "/home/$build_login"
        $sched_login = "schedbot"
        $sched_home_dir = "/home/$sched_login"
        $sign_login = "signbot"
        $sign_home_dir = "/var/lib/$sign_login"
        $repository_root = "/distrib/bootstrap"
        $packagers_group = 'mga-packagers'
        $createsrpm_path = '/usr/share/repsys/create-srpm'

        include ssh::auth
        ssh::auth::key { $build_login: } # declare a key for build bot: RSA, 2048 bits
        ssh::auth::key { $sched_login: } # declare a key for sched bot: RSA, 2048 bits
    }

    class mainnode inherits base {
        include iurtuser

        sshuser { $sched_login:
          homedir => $sched_home_dir,
          comment => "System user used to schedule builds",
        }

        sshuser { $sign_login:
          homedir => $sign_home_dir,
          comment => "System user used to sign packages",
          groups => [$sched_login],
        }

        ssh::auth::client { $sched_login: }
        ssh::auth::server { $sched_login: }
        ssh::auth::server { $build_login: }

        # FIXME Add again task-bs-cluster-main when it will require mgarepo instead of repsys
        $package_list = ['iurt']
        package { $package_list:
            ensure => "installed"
        }

        apache::vhost_other_app { "repository.$domain":
            vhost_file => "buildsystem/vhost_repository.conf",
        }

        apache::vhost_other_app { "pkgsubmit.$domain":
            vhost_file => "buildsystem/vhost_pkgsubmit.conf",
        }

        include scheduler
        include gatherer
        include mgarepo
        include youri_submit
        include check_missing_deps 
    }

    class buildnode inherits base {
        include iurt
    }

    class scheduler {
        # ulri        
        include iurtupload
    }

    class gatherer {
        # emi
        include iurtupload
    }

    class iurtupload {
        file { "/etc/iurt/upload.conf":
            ensure => present,
            owner => $build_login,
            group => $build_login,
            mode => 644,
            require => File["/etc/iurt"],
            content => template("buildsystem/upload.conf")
        }
    }
    
    class mgarepo {
        package { 'mgarepo':

        }

        package { 'rpm-build':
        }

        file { "repsys.conf":
          path => "/etc/repsys.conf",
          owner  => root,
          group => root,
          mode => 644,
          content => template("buildsystem/repsys.conf")
        }

        file { "$sched_home_dir/repsys":
            ensure => "directory",
            owner  => $sched_login,
            require => File[$sched_home_dir],
        }

        file { "$sched_home_dir/repsys/tmp":
            ensure => "directory",
            owner  => $sched_login,
            group => "mga-packagers",
            mode => 1775,
            require => File["$sched_home_dir/repsys"],
        }

        file { "$sched_home_dir/repsys/srpms":
            ensure => "directory",
            owner  => $sched_login,
            group => "mga-packagers",
            mode => 1775,
            require => File["$sched_home_dir/repsys"],
        }
    }

    class youri_submit {
        include sudo

        file { "/usr/local/bin/mdv-youri-submit":
          owner  => root,
          group => root,
          mode => 755,
          content => template("buildsystem/mdv-youri-submit")
        }

        file { "/usr/local/bin/mdv-youri-submit.wrapper":
          owner  => root,
          group => root,
          mode => 755,
          content => template("buildsystem/mdv-youri-submit.wrapper")
        }

        sudo::sudoers_config { "mdv-youri-submit":
            content => template("buildsystem/sudoers.youri")
        }

        file { "/etc/youri":
            ensure => "directory",
        }

        file { "/etc/youri/submit-todo.conf":
            ensure => present,
            mode => 644,
            require => File["/etc/youri"],
            content => template("buildsystem/submit-todo.conf")
        }

        file { "/etc/youri/submit-upload.conf":
            ensure => present,
            mode => 644,
            require => File["/etc/youri"],
            content => template("buildsystem/submit-upload.conf")
        }

        file { "/etc/youri/acl.conf":
            ensure => present,
            mode => 644,
            require => File["/etc/youri"],
            content => template("buildsystem/youri_acl.conf")
        }

        file { '/usr/local/bin/submit_package':
            ensure => present,
            mode => 755,
            content => template('buildsystem/submit_package')
        }
    }

    # $groups: array of secondary groups (only local groups, no ldap)
    define sshuser($homedir, $comment, $groups = []) {
        group {"$title": 
            ensure => present,
        }

        user {"$title":
            ensure => present,
            comment => $comment,
            managehome => true,
            gid => $title,
            groups => $groups,
            shell => "/bin/bash",
            notify => Exec["unlock$title"],
            require => Group[$title],
        }

        # set password to * to unlock the account but forbid login through login
        exec { "unlock$title":
            command => "usermod -p '*' $title",
            refreshonly => true,
        }

        file { $homedir:
            ensure => "directory",
            require => User[$title],
        }

        file { "$homedir/.ssh":
            ensure => "directory",
            mode   => 600,
            owner  => $title,
            group  => $title,
            require => File[$homedir],
        }
    }

    class iurtuser {
        sshuser { $build_login:
          homedir => $build_home_dir,
          comment => "System user used to run build bots",
        }

        file { "/etc/iurt":
            ensure => "directory",
        }
    }

    class iurt {
        include sudo
        include iurtuser
        ssh::auth::client { $build_login: }
        ssh::auth::server { $sched_login: user => $build_login }

        # build node common settings
        # we could have the following skip list to use less space:
        # '/(drakx-installer-binaries|drakx-installer-advertising|gfxboot|drakx-installer-stage2|mandriva-theme)/'
        $package_list = ['task-bs-cluster-chroot', 'iurt']
        package { $package_list:
            ensure => installed;
        }

        file { "/etc/iurt/build":
            ensure => "directory",
            require => File["/etc/iurt"],
        }

        file { "/etc/iurt/build/cauldron.conf":
            ensure => present,
            owner => $build_login,
            group => $build_login,
            mode => 644,
            require => File["/etc/iurt/build"],
            content => template("buildsystem/iurt.cauldron.conf")
        }

        file { "/etc/iurt/build/mandriva2010.1.conf":
            ensure => present,
            owner => $build_login,
            group => $build_login,
            mode => 644,
            require => File["/etc/iurt/build"],
            content => template("buildsystem/iurt.mandriva2010.1.conf")
        }

        sudo::sudoers_config { "iurt":
            content => template("buildsystem/sudoers.iurt")
        }
    }

    # temporary script to create home dir with ssh key
    # taking login and url as arguments
    class mgacreatehome {
        file { "/usr/local/sbin/mgacreatehome":
            ensure => present,
            owner => root,
            group => root,
            mode => 700,
            content => template("buildsystem/mgacreatehome")
        }
    }

    class check_missing_deps {
        file { "/usr/local/bin/missing-deps.sh":
            ensure => present,
            owner => root,
            group => root,
            mode => 700,
            content => "puppet:///modules/buildsystem/missing-deps.sh",
        }
    
        # FIXME hardcoded path
        cron { "check missing deps":
            command => "cd /var/www/bs/data && /usr/local/bin/missing-deps.sh",
            minute => "*/15",
        }
    }
}
1	misc	213	class buildsystem {
2	dmorgan	86
3	boklm	356	class base {
4			$build_login = "iurt"
5	blino	387	$build_home_dir = "/home/$build_login"
6	blino	397	$sched_login = "schedbot"
7	blino	393	$sched_home_dir = "/home/$sched_login"
8	boklm	861	$sign_login = "signbot"
9			$sign_home_dir = "/var/lib/$sign_login"
10	blino	545	$repository_root = "/distrib/bootstrap"
11	boklm	817	$packagers_group = 'mga-packagers'
12			$createsrpm_path = '/usr/share/repsys/create-srpm'
13	blino	366
14			include ssh::auth
15			ssh::auth::key { $build_login: } # declare a key for build bot: RSA, 2048 bits
16	blino	395	ssh::auth::key { $sched_login: } # declare a key for sched bot: RSA, 2048 bits
17	boklm	356	}
18	boklm	355
19	boklm	356	class mainnode inherits base {
20	blino	381	include iurtuser
21	blino	353
22	blino	395	sshuser { $sched_login:
23			homedir => $sched_home_dir,
24			comment => "System user used to schedule builds",
25			}
26
27	boklm	861	sshuser { $sign_login:
28			homedir => $sign_home_dir,
29			comment => "System user used to sign packages",
30	boklm	867	groups => [$sched_login],
31	boklm	861	}
32
33	blino	399	ssh::auth::client { $sched_login: }
34	blino	573	ssh::auth::server { $sched_login: }
35	blino	399	ssh::auth::server { $build_login: }
36
37	pterjan	703	# FIXME Add again task-bs-cluster-main when it will require mgarepo instead of repsys
38			$package_list = ['iurt']
39	blino	398	package { $package_list:
40	blino	350	ensure => "installed"
41			}
42	blino	403
43			apache::vhost_other_app { "repository.$domain":
44	blino	404	vhost_file => "buildsystem/vhost_repository.conf",
45	blino	403	}
46
47	blino	466	apache::vhost_other_app { "pkgsubmit.$domain":
48			vhost_file => "buildsystem/vhost_pkgsubmit.conf",
49			}
50
51	blino	430	include scheduler
52	blino	431	include gatherer
53	pterjan	700	include mgarepo
54	blino	517	include youri_submit
55	misc	860	include check_missing_deps
56	blino	350	}
57
58	boklm	356	class buildnode inherits base {
59	misc	213	include iurt
60	dmorgan	86	}
61
62	misc	265	class scheduler {
63			# ulri
64	blino	430	include iurtupload
65	misc	265	}
66
67	blino	431	class gatherer {
68	misc	265	# emi
69	blino	430	include iurtupload
70	misc	265	}
71	blino	430
72			class iurtupload {
73	blino	432	file { "/etc/iurt/upload.conf":
74	blino	430	ensure => present,
75			owner => $build_login,
76			group => $build_login,
77			mode => 644,
78			require => File["/etc/iurt"],
79			content => template("buildsystem/upload.conf")
80			}
81			}
82	misc	265
83	pterjan	700	class mgarepo {
84			package { 'mgarepo':
85	misc	265
86			}
87
88	blino	505	package { 'rpm-build':
89			}
90
91	blino	500	file { "repsys.conf":
92			path => "/etc/repsys.conf",
93			owner => root,
94			group => root,
95			mode => 644,
96			content => template("buildsystem/repsys.conf")
97			}
98	blino	502
99			file { "$sched_home_dir/repsys":
100			ensure => "directory",
101	blino	508	owner => $sched_login,
102	blino	502	require => File[$sched_home_dir],
103			}
104
105			file { "$sched_home_dir/repsys/tmp":
106			ensure => "directory",
107	blino	508	owner => $sched_login,
108	boklm	512	group => "mga-packagers",
109	boklm	510	mode => 1775,
110	blino	502	require => File["$sched_home_dir/repsys"],
111			}
112
113			file { "$sched_home_dir/repsys/srpms":
114			ensure => "directory",
115	blino	508	owner => $sched_login,
116	boklm	512	group => "mga-packagers",
117	boklm	510	mode => 1775,
118	blino	502	require => File["$sched_home_dir/repsys"],
119			}
120	misc	265	}
121
122	blino	516	class youri_submit {
123	boklm	522	include sudo
124
125	blino	516	file { "/usr/local/bin/mdv-youri-submit":
126			owner => root,
127			group => root,
128			mode => 755,
129			content => template("buildsystem/mdv-youri-submit")
130			}
131
132			file { "/usr/local/bin/mdv-youri-submit.wrapper":
133			owner => root,
134			group => root,
135			mode => 755,
136			content => template("buildsystem/mdv-youri-submit.wrapper")
137			}
138
139	boklm	770	sudo::sudoers_config { "mdv-youri-submit":
140	blino	516	content => template("buildsystem/sudoers.youri")
141			}
142	blino	543
143			file { "/etc/youri":
144			ensure => "directory",
145			}
146
147			file { "/etc/youri/submit-todo.conf":
148			ensure => present,
149			mode => 644,
150			require => File["/etc/youri"],
151			content => template("buildsystem/submit-todo.conf")
152			}
153	pterjan	682
154	pterjan	685	file { "/etc/youri/submit-upload.conf":
155	pterjan	682	ensure => present,
156			mode => 644,
157			require => File["/etc/youri"],
158	pterjan	685	content => template("buildsystem/submit-upload.conf")
159	pterjan	682	}
160	boklm	772
161			file { "/etc/youri/acl.conf":
162			ensure => present,
163			mode => 644,
164			require => File["/etc/youri"],
165			content => template("buildsystem/youri_acl.conf")
166			}
167	boklm	817
168			file { '/usr/local/bin/submit_package':
169			ensure => present,
170			mode => 755,
171			content => template('buildsystem/submit_package')
172			}
173	blino	516	}
174
175	boklm	862	# $groups: array of secondary groups (only local groups, no ldap)
176			define sshuser($homedir, $comment, $groups = []) {
177	blino	394	group {"$title":
178	blino	351	ensure => present,
179			}
180
181	blino	394	user {"$title":
182	blino	351	ensure => present,
183	blino	393	comment => $comment,
184	blino	351	managehome => true,
185	blino	394	gid => $title,
186	boklm	862	groups => $groups,
187	blino	351	shell => "/bin/bash",
188	blino	394	notify => Exec["unlock$title"],
189	blino	424	require => Group[$title],
190	blino	351	}
191	blino	372
192	blino	386	# set password to * to unlock the account but forbid login through login
193	blino	394	exec { "unlock$title":
194			command => "usermod -p '*' $title",
195	blino	386	refreshonly => true,
196			}
197
198	blino	393	file { $homedir:
199	blino	383	ensure => "directory",
200	blino	423	require => User[$title],
201	blino	383	}
202
203	blino	393	file { "$homedir/.ssh":
204	blino	372	ensure => "directory",
205			mode => 600,
206	blino	394	owner => $title,
207			group => $title,
208	blino	423	require => File[$homedir],
209	blino	372	}
210	blino	351	}
211
212	blino	393	class iurtuser {
213	blino	394	sshuser { $build_login:
214			homedir => $build_home_dir,
215			comment => "System user used to run build bots",
216			}
217	blino	429
218			file { "/etc/iurt":
219			ensure => "directory",
220			}
221	blino	393	}
222
223	misc	213	class iurt {
224	boklm	216	include sudo
225	blino	381	include iurtuser
226	blino	366	ssh::auth::client { $build_login: }
227	blino	396	ssh::auth::server { $sched_login: user => $build_login }
228	misc	213
229			# build node common settings
230			# we could have the following skip list to use less space:
231			# '/(drakx-installer-binaries\|drakx-installer-advertising\|gfxboot\|drakx-installer-stage2\|mandriva-theme)/'
232			$package_list = ['task-bs-cluster-chroot', 'iurt']
233			package { $package_list:
234			ensure => installed;
235			}
236
237	blino	426	file { "/etc/iurt/build":
238			ensure => "directory",
239	blino	428	require => File["/etc/iurt"],
240	blino	426	}
241
242	blino	425	file { "/etc/iurt/build/cauldron.conf":
243	misc	213	ensure => present,
244			owner => $build_login,
245			group => $build_login,
246			mode => 644,
247	blino	426	require => File["/etc/iurt/build"],
248	boklm	218	content => template("buildsystem/iurt.cauldron.conf")
249	misc	213	}
250
251	boklm	648	file { "/etc/iurt/build/mandriva2010.1.conf":
252			ensure => present,
253			owner => $build_login,
254			group => $build_login,
255			mode => 644,
256			require => File["/etc/iurt/build"],
257			content => template("buildsystem/iurt.mandriva2010.1.conf")
258			}
259
260	boklm	770	sudo::sudoers_config { "iurt":
261	boklm	218	content => template("buildsystem/sudoers.iurt")
262	boklm	216	}
263	dmorgan	86	}
264	boklm	696
265			# temporary script to create home dir with ssh key
266			# taking login and url as arguments
267			class mgacreatehome {
268			file { "/usr/local/sbin/mgacreatehome":
269			ensure => present,
270			owner => root,
271			group => root,
272			mode => 700,
273			content => template("buildsystem/mgacreatehome")
274			}
275			}
276	misc	859
277			class check_missing_deps {
278			file { "/usr/local/bin/missing-deps.sh":
279			ensure => present,
280			owner => root,
281			group => root,
282			mode => 700,
283			content => "puppet:///modules/buildsystem/missing-deps.sh",
284			}
285
286			# FIXME hardcoded path
287			cron { "check missing deps":
288			command => "cd /var/www/bs/data && /usr/local/bin/missing-deps.sh",
289			minute => "*/15",
290			}
291			}
292	dmorgan	86	}