promises.cf

bundle common hosts
{
  vars:
      "synth" string => host2ip("synth");
      "homer" string => host2ip("homer");
}

bundle common classes
{
  classes:
      "mail_server" or => { classify("homer") };
      "database_master" or => { classify("homer") };
      "web_server" or => { classify("homer") };
      "rails_app_server" or => { classify("homer") };
      "redmine_app_server" or => { classify("homer") };
      "redmine_akronet" or => { classify("homer") };
}

bundle common g
{
  vars:
    any::
      "bseq" slist => {
        "security_updates",
        "manage_users",
        "cfengine_repo",
        "corepackages",
        "configfiles"
      }, policy => "free";
    mail_server::
      "bseq" slist => {
        @{bseq},
        "postfix"
      }, policy => "free";
    web_server::
      "bseq" slist => {
        @{bseq},
        "nginx"
      }, policy => "free";
    database_master::
      "bseq" slist => {
        @{bseq},
        "postgres"
      }, policy => "free";
    redmine_app_server::
      "bseq" slist => {
        @{bseq},
        "redmine"
      }, policy => "free";
}

body common control
{ 
  any::
      bundlesequence => { "@(g.bseq)" };

      inputs => {
        # Global common bundles
          "def.cf",
        # Private data (passwords), not to be shared with anyone
          "private.cf",
        # Control body for agents
          "controls/cf_agent.cf",
          "controls/cf_execd.cf",
          "controls/cf_monitord.cf",
          "controls/cf_report.cf",
          "controls/cf_runagent.cf",
          "controls/cf_serverd.cf",
        # CFEngine3 Standard Library
          "libraries/cfengine_stdlib.cf",
          "libraries/library.cf",

          "system_updates.cf",
          "services/postfix.cf",
          "services/postgres.cf",
          "services/redmine.cf",
          "services/nginx.cf",
      };

      version => "0.5.2.1";
}

bundle agent cfengine_repo
{
  files:
      "/etc/apt/sources.list.d/cfengine-community.list"
        comment => "Install and enable CFEngine community repository",
        create => "true",
        edit_defaults => empty,
        edit_line => insert_lines("deb http://cfengine.com/pub/apt precise main"),
        classes => if_repaired("apt_get_update");
      
  classes:
      "cfengine_gpg_key_installed" expression => returnszero("/usr/bin/apt-key list |grep -q CFEngine", "useshell");

  commands:
    !cfengine_gpg_key_installed::
      "/usr/bin/wget" args => "\"http://cfengine.com/pub/gpg.key\" -O /tmp/gpg.key";
      "/usr/bin/apt-key" args => "add /tmp/gpg.key";
    apt_get_update::
      "/usr/bin/apt-get" args => "update";
}

bundle agent corepackages
{
  files:
      "/tmp/.s.PGSQL.5432"
        comment => "CFEngine requires PostgreSQL socket in the old location",
        link_from => ln_s("/run/postgresql/.s.PGSQL.5432");

  vars:
      "pkglist" slist => { "cfengine-community", "vim", "git", "wget", "screen", "mc" },
        comment => "A basic list of packages installed with the bootstrap deployment script",
        policy => "free";
    rails_app_server::
      "pkglist" slist => { @{pkglist}, "gcc", "make", "ruby1.9.1", "ruby1.9.1-dev" }, policy => "free";
    homer::
      "pkglist" slist => { @{pkglist}, "ekg" }, policy => "free";

  packages:
      "$(pkglist)" package_policy => "addupdate";

  files:
    rails_app_server::
      "/var/lib/gems/expanded_gem_list.sh"
        perms => m("0755"),
        comment => "Wrapper for the /usr/bin/gem list command that expands list of packages so CFEngine can parse it",
        copy_from => remote_cp("$(sys.workdir)/masterfiles/templates/expanded_gem_list.sh", "$(sys.policy_hub)");
}

bundle agent configfiles
{
  vars:
    !ubuntu_10_4::
      "dhclient_conf" string => "/etc/dhcp/dhclient.conf";
    ubuntu_10_4::
      "dhclient_conf" string => "/etc/dhcp3/dhclient.conf";
    any::
      "install_only_requested" string =>
"APT::Install-Recommends \"0\";
APT::Install-Suggests \"0\";";

      "files[sshd]" string => "/etc/ssh/sshd_config";

      "sshd[Protocol]" string => "2";
      "sshd[X11Forwarding]" string => "no";
      "sshd[PermitRootLogin]" string => "no";
    !ubuntu_10_4::
      "sshd[UseDNS]" string => "no";

  files:
      "/etc/apt/apt.conf.d/20recommends"
        create => "true",
        perms => m("0644"),
        handle => "apt_config",
        comment => "Disable Recomendation and Suggestion installation in Apt",
        edit_defaults => empty,
        edit_line => insert_lines("$(install_only_requested)");
      "/root/.ssh/id_rsa"
        comment =>  "A deployment SSH key, not available in the public repository",
        copy_from => secure_cp("$(sys.workdir)/masterfiles/templates/deployment.sshkey", "$(sys.policy_hub)");
      "/tmp/hosts.tmpl"
        copy_from => remote_cp("$(sys.workdir)/masterfiles/templates/hosts.tmpl", "$(sys.policy_hub)");
      "/etc/hosts"
        comment => "Define a static list of hosts from the template",
        create => "true",
        edit_defaults => empty,
        edit_line => expand_template("/tmp/hosts.tmpl"),
        perms => mo("0644", "root"),
        action => if_elapsed("immediate");
      "$(dhclient_conf)"
        comment => "Set a correct domain for all hosts",
        edit_line => replace_or_add("#supersede domain-name.*", "supersede domain-name \"$(def.domain)\";");
      "/var/log/lastlog"
        create => "true",
        comment => "Make sure that /var/log/lastlog exists and has proper permissions",
        perms => mog("0664", "root", "utmp");

  methods:
      "sshd" usebundle => edit_sshd;
}

bundle agent edit_sshd
{
  packages:
      "openssh-server";

  files:
      "$(configfiles.files[sshd])"
        handle => "sshd_config",
        comment => "Configure the SSH daemon",
        edit_line => set_config_values("configfiles.sshd"),
        classes => if_repaired("restart_sshd");

  commands:
      restart_sshd.!no_restarts::
        "/usr/sbin/service ssh reload"
        handle => "sshd_restart",
        comment => "Restart the SSH daemon if the configuration changes";
}

bundle agent manage_users
{
  vars:
      "users[kklimonda][fullname]" string => "Krzysztof Klimonda";
      "users[kklimonda][shell]" string => "/bin/bash";
      "users[kklimonda][flags]" string => "-m";
      "users[kklimonda][passwd_hash]" string => "$(private_g.password[shadow_kklimonda])";
    homer::
      "users[thorin][fullname]" string => "Grzegorz Wolaniuk";
      "users[thorin][shell]" string => "/bin/bash";
      "users[thorin][flags]" string => "-m";
      "users[thorin][passwd_hash]" string => "$(private_g.password[shadow_thorin])";
    any::
      "sudo" slist => { "kklimonda" };

  methods:
      "users" usebundle => create_users("manage_users.users");
}

bundle agent create_users(list)
{
  vars:
      "user" slist => getindices("$(list)");

  classes:
      "add_$(user)" not => userexists("$(user)");

  commands:
      "/usr/sbin/useradd $($(list)[$(user)][flags]) -s $($(list)[$(user)][shell]) -c '$($(list)[$(user)][fullname])' $(user)"
        ifvarclass => "add_$(user)";

  files:
      "/etc/shadow"
        edit_line => set_user_field("$(user)", 2, "$($(list)[$(user)][passwd_hash])");
      "/etc/group"
        edit_line => append_user_field("sudo", 4, "$(manage_users.sudo)");
}

body database_server postgres_master(user, password)
{
  any::
    db_server_owner => "$(user)";
    db_server_password => "$(password)";
    db_server_host => "localhost";
    db_server_type => "postgres";
    db_server_connection_db => "postgres";
}