From e6e25edc7e1d5732aaa3c956359681318d5f0946 Mon Sep 17 00:00:00 2001 From: Fredrik Thulin Date: Mon, 23 Feb 2015 15:58:29 +0100 Subject: Safer default repos, and show tag-name. --- global/overlay/etc/puppet/cosmos-modules.conf | 47 ++++++++++++++++++++------- 1 file changed, 35 insertions(+), 12 deletions(-) diff --git a/global/overlay/etc/puppet/cosmos-modules.conf b/global/overlay/etc/puppet/cosmos-modules.conf index af786c4..e1ef0e5 100644 --- a/global/overlay/etc/puppet/cosmos-modules.conf +++ b/global/overlay/etc/puppet/cosmos-modules.conf @@ -1,13 +1,36 @@ # -# name source (puppetlabs fq name or git url) upgrade (yes/no) -# -concat puppetlabs/concat no -stdlib puppetlabs/stdlib no -cosmos git://github.com/leifj/puppet-cosmos.git yes -ufw attachmentgenie/ufw no -apt puppetlabs/apt no -vcsrepo puppetlabs/vcsrepo no -xinetd puppetlabs/xinetd no -#golang elithrar/golang yes -#python git://github.com/stankevich/puppet-python.git yes -hiera-gpg git://github.com/SUNET/hiera-gpg.git no +# name source (puppetlabs fq name or git url) upgrade (yes/no) tag-pattern +# +# NOTE that Git packages MUST be tagged with signatures by someone +# in the Cosmos trust list. That is why all the URLs point to forked +# versions in the SUNET github organization. +# +concat git://github.com/SUNET/puppetlabs-concat.git yes sunet-* +stdlib git://github.com/SUNET/puppetlabs-stdlib.git yes sunet-* +cosmos git://github.com/SUNET/puppet-cosmos.git yes sunet-* +ufw git://github.com/SUNET/puppet-module-ufw.git yes sunet_dev-* +apt git://github.com/SUNET/puppetlabs-apt.git yes sunet_dev-* +vcsrepo git://github.com/SUNET/puppetlabs-vcsrepo.git yes sunet-* +xinetd git://github.com/SUNET/puppetlabs-xinetd.git yes sunet-* +hiera-gpg git://github.com/SUNET/hiera-gpg.git yes sunet-* +# +# Alternate sources you might or might not want to use: +#concat puppetlabs/concat no +#stdlib puppetlabs/stdlib no +#ufw attachmentgenie/ufw no +#apt puppetlabs/apt no +#vcsrepo puppetlabs/vcsrepo no +#xinetd puppetlabs/xinetd no +#cosmos git://github.com/leifj/puppet-cosmos.git yes +#python git://github.com/SUNET/puppet-python.git yes sunet-* +#erlang git://github.com/SUNET/garethr-erlang.git yes sunet-* +#rabbitmq git://github.com/SUNET/puppetlabs-rabbitmq.git yes sunet_dev-* +#pound git://github.com/SUNET/puppet-pound.git yes sunet_dev-* +#augeas git://github.com/SUNET/puppet-augeas.git yes sunet-* +#bastion git://github.com/SUNET/puppet-bastion.git yes sunet-* +#postgresql git://github.com/SUNET/puppetlabs-postgresql.git yes sunet_dev-* +#munin git://github.com/SUNET/ssm-munin.git yes sunet-* +#nagios git://github.com/SUNET/puppet-nagios.git yes sunet-* +#staging git://github.com/SUNET/puppet-staging.git yes sunet-* +#apparmor git://github.com/SUNET/puppet-apparmor.git yes sunet-* +#docker git://github.com/SUNET/garethr-docker.git yes sunet_dev-* -- cgit v1.1 From 3d51588fcff271b76353bab59b93077eb7d06159 Mon Sep 17 00:00:00 2001 From: Fredrik Thulin Date: Mon, 23 Feb 2015 16:01:24 +0100 Subject: update yaml syntax to work on Ubuntu 14.04 --- global/overlay/etc/puppet/hiera.yaml | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/global/overlay/etc/puppet/hiera.yaml b/global/overlay/etc/puppet/hiera.yaml index cd619bb..782fa7f 100644 --- a/global/overlay/etc/puppet/hiera.yaml +++ b/global/overlay/etc/puppet/hiera.yaml @@ -1,13 +1,15 @@ --- -:backends: - yaml - - gpg +:backends: + - yaml + - gpg :logger: console -:hierarchy: - %{env}/%{location}/%{calling_module} - - %{env}/%{calling_module} - - secrets.yaml - - common +:hierarchy: + - "%{env}/%{location}/%{calling_module}" + - "%{env}/%{calling_module}" + - secrets.yaml + - common :yaml: -- cgit v1.1 From d164fde704f65432943a4fa3f6d5a3f3298c262d Mon Sep 17 00:00:00 2001 From: Fredrik Thulin Date: Mon, 23 Feb 2015 16:01:40 +0100 Subject: add 'local' source --- global/overlay/etc/puppet/hiera.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/global/overlay/etc/puppet/hiera.yaml b/global/overlay/etc/puppet/hiera.yaml index 782fa7f..3663305 100644 --- a/global/overlay/etc/puppet/hiera.yaml +++ b/global/overlay/etc/puppet/hiera.yaml @@ -8,6 +8,7 @@ :hierarchy: - "%{env}/%{location}/%{calling_module}" - "%{env}/%{calling_module}" + - local - secrets.yaml - common -- cgit v1.1 From e69b0f84f86ceb32e62dbef5492fc1aac20de919 Mon Sep 17 00:00:00 2001 From: Fredrik Thulin Date: Mon, 23 Feb 2015 16:02:43 +0100 Subject: init --- global/overlay/usr/local/bin/run-cosmos | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100755 global/overlay/usr/local/bin/run-cosmos diff --git a/global/overlay/usr/local/bin/run-cosmos b/global/overlay/usr/local/bin/run-cosmos new file mode 100755 index 0000000..a37d49f --- /dev/null +++ b/global/overlay/usr/local/bin/run-cosmos @@ -0,0 +1,22 @@ +#!/bin/sh +# +# Simplify running cosmos, with serialization if flock is available. +# + +set -e + +FLOCK=`which flock` + +if [ -x "$FLOCK" ]; then + ($FLOCK --exclusive --wait 60 9 || exit 1 + cosmos $* update + cosmos $* apply + )9>/var/lock/run-cosmos +else + cosmos $* update + cosmos $* apply +fi + +touch /var/run/last-cosmos-ok.stamp + +find /var/lib/puppet/reports/ -type f -mtime +10 | xargs rm -f -- cgit v1.1 From cd2b67ff5a8e308dc701319c189d3f8fa9b5370e Mon Sep 17 00:00:00 2001 From: Fredrik Thulin Date: Mon, 23 Feb 2015 16:03:55 +0100 Subject: use run-cosmos, for serialization --- global/overlay/etc/cron.d/cosmos | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/global/overlay/etc/cron.d/cosmos b/global/overlay/etc/cron.d/cosmos index 70af3a4..4eab8de 100644 --- a/global/overlay/etc/cron.d/cosmos +++ b/global/overlay/etc/cron.d/cosmos @@ -1,4 +1,4 @@ SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin -*/15 * * * * root test -f /etc/no-automatic-cosmos || (cosmos update ; cosmos apply) +*/15 * * * * root test -f /etc/no-automatic-cosmos || /usr/local/bin/run-cosmos -- cgit v1.1 From 0db53806e6d8ee9eb7e726077c81d8260850c6fd Mon Sep 17 00:00:00 2001 From: Leif Johansson Date: Tue, 24 Feb 2015 09:44:33 +0100 Subject: use run-cosmos in fabfile --- .gitignore | 1 + fabfile/__init__.py | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 .gitignore diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..0d20b64 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +*.pyc diff --git a/fabfile/__init__.py b/fabfile/__init__.py index d87fbdd..8db5748 100644 --- a/fabfile/__init__.py +++ b/fabfile/__init__.py @@ -17,7 +17,7 @@ def all(): env.hosts = cosmos_db()['members']['all'] def cosmos(): - run("cosmos update ; cosmos -v apply"); + run("/usr/local/bin/run-cosmos"); def upgrade(): run("apt-get -qq update && apt-get -y -q dist-upgrade"); -- cgit v1.1 From bc70832f4c33a458f2e913af702823539b2da7a1 Mon Sep 17 00:00:00 2001 From: Leif Johansson Date: Tue, 24 Feb 2015 11:12:06 +0100 Subject: logrotate for docker containers --- global/overlay/etc/logrotate.d/docker-containers | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 global/overlay/etc/logrotate.d/docker-containers diff --git a/global/overlay/etc/logrotate.d/docker-containers b/global/overlay/etc/logrotate.d/docker-containers new file mode 100644 index 0000000..e9c90b8 --- /dev/null +++ b/global/overlay/etc/logrotate.d/docker-containers @@ -0,0 +1,7 @@ +/var/lib/docker/containers/*/*.log { + rotate 7 + daily + compress + delaycompress + copytruncate +} -- cgit v1.1 From c04894515146e2e762d25abcff275c0d03dfe0c6 Mon Sep 17 00:00:00 2001 From: Leif Johansson Date: Fri, 6 Mar 2015 23:07:58 +0100 Subject: fix & simplify edit-secrets --- edit-secrets | 21 ++++----------------- 1 file changed, 4 insertions(+), 17 deletions(-) diff --git a/edit-secrets b/edit-secrets index 08ec257..742321f 100755 --- a/edit-secrets +++ b/edit-secrets @@ -32,19 +32,13 @@ if [ "x$1" != "x-l" ]; then trap "rm -f $TMPFILE $TMPFILE2" EXIT - ssh -t $host /var/cache/cosmos/repo/edit-secrets -l - scp -q $host:$LAST_OUTPUT_FILENAME $TMPFILE + ssh -t root@$host /var/cache/cosmos/repo/edit-secrets -l + scp -q root@$host:$LAST_OUTPUT_FILENAME $TMPFILE if grep ^"STATUS=UPDATED" $TMPFILE > /dev/null; then # extract the path of the file that should be updated in the Cosmos repo - save_to=$(grep ^"SAVE_TO=" $TMPFILE | cut -d = -f 2-) - if [ ! -f $save_to ]; then - echo "$0: Output file $save_to doesn't exist" - echo " (leaving output in $TMPFILE)" - rm $TMPFILE2 - trap EXIT # clear trap command to preserve $TMPFILE - exit 1 - fi + save_to="${host}/overlay/etc/hiera/data/secrets.yaml.asc" + mkdir -p "`dirname $save_to`" # extract the GPG output perl -e '$a = 0; while (<>) { $a = 1 if ($_ =~ /-+BEGIN PGP MESSAGE-+/); print $_ if $a; $a = 0 if ($_ =~ /-+END PGP MESSAGE-+/); }' < $TMPFILE > $TMPFILE2 @@ -132,17 +126,10 @@ else # figure out this hosts gpg key id recipient=$($GPG --list-secret-key | grep ^sec | head -1 | awk '{print $2}' | cut -d / -f 2) - save_to="`hostname --fqdn`/overlay${SECRETFILE}" echo "" ( echo "STATUS=UPDATED" - echo "SAVE_TO=$save_to" echo "" ) > $LAST_OUTPUT_FILENAME $GPG --output - --armor --recipient $recipient --sign --encrypt $TMPFILE >> $LAST_OUTPUT_FILENAME - echo "" - echo "GPG output saved in $LAST_OUTPUT_FILENAME - save it in Cosmos as" - echo "" - echo " $save_to" - echo "" fi -- cgit v1.1