]> git.openstreetmap.org Git - chef.git/blob - cookbooks/web/resources/rails_port.rb
Disable OAuth 1.0a and basic authentication
[chef.git] / cookbooks / web / resources / rails_port.rb
1 #
2 # Cookbook:: web
3 # Resource:: rails_port
4 #
5 # Copyright:: 2012, OpenStreetMap Foundation
6 #
7 # Licensed under the Apache License, Version 2.0 (the "License");
8 # you may not use this file except in compliance with the License.
9 # You may obtain a copy of the License at
10 #
11 #     https://www.apache.org/licenses/LICENSE-2.0
12 #
13 # Unless required by applicable law or agreed to in writing, software
14 # distributed under the License is distributed on an "AS IS" BASIS,
15 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 # See the License for the specific language governing permissions and
17 # limitations under the License.
18 #
19
20 require "yaml"
21
22 resource_name :rails_port
23 provides :rails_port
24
25 unified_mode true
26
27 default_action :create
28
29 property :site, String, :name_property => true
30 property :directory, String
31 property :user, String
32 property :group, String
33 property :repository, String, :default => "https://git.openstreetmap.org/public/rails.git"
34 property :revision, String, :default => "live"
35 property :run_migrations, [true, false], :default => false
36 property :build_assets, [true, false], :default => true
37 property :email_from, String, :default => "OpenStreetMap <support@openstreetmap.org>"
38 property :status, String, :default => "online"
39 property :database_host, String
40 property :database_port, String
41 property :database_name, String
42 property :database_username, String
43 property :database_password, String
44 property :email_from, String
45 property :messages_domain, String
46 property :gpx_dir, String
47 property :attachments_dir, String
48 property :log_path, String
49 property :logstash_path, String
50 property :memcache_servers, Array
51 property :potlatch2_key, String
52 property :id_key, String
53 property :id_application, String
54 property :oauth_key, String
55 property :oauth_application, String
56 property :nominatim_url, String
57 property :overpass_url, String
58 property :overpass_credentials, [true, false], :default => false
59 property :google_auth_id, String
60 property :google_auth_secret, String
61 property :google_openid_realm, String
62 property :facebook_auth_id, String
63 property :facebook_auth_secret, String
64 property :microsoft_auth_id, String
65 property :microsoft_auth_secret, String
66 property :github_auth_id, String
67 property :github_auth_secret, String
68 property :wikipedia_auth_id, String
69 property :wikipedia_auth_secret, String
70 property :thunderforest_key, String
71 property :tracestrack_key, String
72 property :totp_key, String
73 property :csp_enforce, [true, false], :default => false
74 property :csp_report_url, String
75 property :matomo_configuration, Hash
76 property :storage_service, String, :default => "local"
77 property :storage_url, String
78 property :trace_use_job_queue, [true, false], :default => false
79 property :diary_feed_delay, Integer
80 property :storage_configuration, Hash, :default => {}
81 property :avatar_storage, String
82 property :trace_file_storage, String
83 property :trace_image_storage, String
84 property :trace_icon_storage, String
85 property :avatar_storage_url, String
86 property :trace_image_storage_url, String
87 property :trace_icon_storage_url, String
88 property :tile_cdn_url, String
89 property :imagery_blacklist, Array
90 property :signup_ip_per_day, Integer
91 property :signup_ip_max_burst, Integer
92 property :signup_email_per_day, Integer
93 property :signup_email_max_burst, Integer
94 property :doorkeeper_signing_key, String
95 property :user_account_deletion_delay, Integer
96
97 action :create do
98   package %W[
99     imagemagick
100     libvips42
101     nodejs
102     tzdata
103   ]
104
105   package %w[
106     g++
107     make
108     pkg-config
109     libpq-dev
110     libsasl2-dev
111     libxml2-dev
112     libxslt1-dev
113     libmemcached-dev
114     libffi-dev
115     libgd-dev
116     libarchive-dev
117     libbz2-dev
118     libyaml-dev
119   ]
120
121   package %w[
122     pngcrush
123     advancecomp
124     optipng
125     pngquant
126     jhead
127     jpegoptim
128     gifsicle
129     libjpeg-turbo-progs
130   ]
131
132   declare_resource :directory, rails_directory do
133     owner new_resource.user
134     group new_resource.group
135     mode "2775"
136   end
137
138   git rails_directory do
139     action :sync
140     repository new_resource.repository
141     revision new_resource.revision
142     depth 1
143     user new_resource.user
144     group new_resource.group
145   end
146
147   declare_resource :directory, "#{rails_directory}/tmp" do
148     owner new_resource.user
149     group new_resource.group
150   end
151
152   file "#{rails_directory}/config/environment.rb" do
153     owner new_resource.user
154     group new_resource.group
155   end
156
157   template "#{rails_directory}/config/database.yml" do
158     cookbook "web"
159     source "database.yml.erb"
160     owner new_resource.user
161     group new_resource.group
162     mode "664"
163     variables :host => new_resource.database_host,
164               :port => new_resource.database_port,
165               :name => new_resource.database_name,
166               :username => new_resource.database_username,
167               :password => new_resource.database_password
168   end
169
170   application_yml = edit_file "#{rails_directory}/config/example.application.yml" do |line|
171     line.gsub!(/^( *)server_protocol:.*$/, "\\1server_protocol: \"https\"")
172     line.gsub!(/^( *)server_url:.*$/, "\\1server_url: \"#{new_resource.site}\"")
173
174     line.gsub!(/^( *)support_email:.*$/, "\\1support_email: \"support@openstreetmap.org\"")
175
176     if new_resource.email_from
177       line.gsub!(/^( *)email_from:.*$/, "\\1email_from: \"#{new_resource.email_from}\"")
178     end
179
180     line.gsub!(/^( *)email_return_path:.*$/, "\\1email_return_path: \"bounces@openstreetmap.org\"")
181
182     line.gsub!(/^( *)status:.*$/, "\\1status: :#{new_resource.status}")
183
184     if new_resource.messages_domain
185       line.gsub!(/^( *)#messages_domain:.*$/, "\\1messages_domain: \"#{new_resource.messages_domain}\"")
186     end
187
188     line.gsub!(/^( *)#geonames_username:.*$/, "\\1geonames_username: \"openstreetmap\"")
189
190     line.gsub!(/^( *)#maxmind_database:.*$/, "\\1maxmind_database: \"#{node[:geoipupdate][:directory]}/GeoLite2-Country.mmdb\"")
191
192     if new_resource.gpx_dir
193       line.gsub!(/^( *)gpx_trace_dir:.*$/, "\\1gpx_trace_dir: \"#{new_resource.gpx_dir}/traces\"")
194       line.gsub!(/^( *)gpx_image_dir:.*$/, "\\1gpx_image_dir: \"#{new_resource.gpx_dir}/images\"")
195     end
196
197     if new_resource.attachments_dir
198       line.gsub!(/^( *)attachments_dir:.*$/, "\\1attachments_dir: \"#{new_resource.attachments_dir}\"")
199     end
200
201     if new_resource.log_path
202       line.gsub!(/^( *)#log_path:.*$/, "\\1log_path: \"#{new_resource.log_path}\"")
203     end
204
205     if new_resource.logstash_path
206       line.gsub!(/^( *)#logstash_path:.*$/, "\\1logstash_path: \"#{new_resource.logstash_path}\"")
207     end
208
209     if new_resource.memcache_servers
210       line.gsub!(/^( *)#memcache_servers:.*$/, "\\1memcache_servers: [ \"#{new_resource.memcache_servers.join('", "')}\" ]")
211     end
212
213     if new_resource.potlatch2_key
214       line.gsub!(/^( *)#potlatch2_key:.*$/, "\\1potlatch2_key: \"#{new_resource.potlatch2_key}\"")
215     end
216
217     if new_resource.id_key
218       line.gsub!(/^( *)#id_key:.*$/, "\\1id_key: \"#{new_resource.id_key}\"")
219     end
220
221     if new_resource.id_application
222       line.gsub!(/^( *)#id_application:.*$/, "\\1id_application: \"#{new_resource.id_application}\"")
223     end
224
225     if new_resource.oauth_key
226       line.gsub!(/^( *)#oauth_key:.*$/, "\\1oauth_key: \"#{new_resource.oauth_key}\"")
227     end
228
229     if new_resource.oauth_application
230       line.gsub!(/^( *)#oauth_application:.*$/, "\\1oauth_application: \"#{new_resource.oauth_application}\"")
231     end
232
233     if new_resource.nominatim_url
234       line.gsub!(/^( *)nominatim_url:.*$/, "\\1nominatim_url: \"#{new_resource.nominatim_url}\"")
235     end
236
237     if new_resource.overpass_url
238       line.gsub!(/^( *)overpass_url:.*$/, "\\1overpass_url: \"#{new_resource.overpass_url}\"")
239     end
240
241     if new_resource.google_auth_id
242       line.gsub!(/^( *)#google_auth_id:.*$/, "\\1google_auth_id: \"#{new_resource.google_auth_id}\"")
243       line.gsub!(/^( *)#google_auth_secret:.*$/, "\\1google_auth_secret: \"#{new_resource.google_auth_secret}\"")
244       line.gsub!(/^( *)#google_openid_realm:.*$/, "\\1google_openid_realm: \"#{new_resource.google_openid_realm}\"")
245     end
246
247     if new_resource.facebook_auth_id
248       line.gsub!(/^( *)#facebook_auth_id:.*$/, "\\1facebook_auth_id: \"#{new_resource.facebook_auth_id}\"")
249       line.gsub!(/^( *)#facebook_auth_secret:.*$/, "\\1facebook_auth_secret: \"#{new_resource.facebook_auth_secret}\"")
250     end
251
252     if new_resource.microsoft_auth_id
253       line.gsub!(/^( *)#microsoft_auth_id:.*$/, "\\1microsoft_auth_id: \"#{new_resource.microsoft_auth_id}\"")
254       line.gsub!(/^( *)#microsoft_auth_secret:.*$/, "\\1microsoft_auth_secret: \"#{new_resource.microsoft_auth_secret}\"")
255     end
256
257     if new_resource.github_auth_id
258       line.gsub!(/^( *)#github_auth_id:.*$/, "\\1github_auth_id: \"#{new_resource.github_auth_id}\"")
259       line.gsub!(/^( *)#github_auth_secret:.*$/, "\\1github_auth_secret: \"#{new_resource.github_auth_secret}\"")
260     end
261
262     if new_resource.wikipedia_auth_id
263       line.gsub!(/^( *)#wikipedia_auth_id:.*$/, "\\1wikipedia_auth_id: \"#{new_resource.wikipedia_auth_id}\"")
264       line.gsub!(/^( *)#wikipedia_auth_secret:.*$/, "\\1wikipedia_auth_secret: \"#{new_resource.wikipedia_auth_secret}\"")
265     end
266
267     if new_resource.thunderforest_key
268       line.gsub!(/^( *)#thunderforest_key:.*$/, "\\1thunderforest_key: \"#{new_resource.thunderforest_key}\"")
269     end
270
271     if new_resource.totp_key
272       line.gsub!(/^( *)#totp_key:.*$/, "\\1totp_key: \"#{new_resource.totp_key}\"")
273     end
274
275     if new_resource.csp_enforce
276       line.gsub!(/^( *)csp_enforce:.*$/, "\\1csp_enforce: \"#{new_resource.csp_enforce}\"")
277     end
278
279     if new_resource.csp_report_url
280       line.gsub!(/^( *)#csp_report_url:.*$/, "\\1csp_report_url: \"#{new_resource.csp_report_url}\"")
281     end
282
283     line.gsub!(/^( *)require_terms_seen:.*$/, "\\1require_terms_seen: true")
284     line.gsub!(/^( *)require_terms_agreed:.*$/, "\\1require_terms_agreed: true")
285     line.gsub!(/^( *)trace_use_job_queue:.*$/, "\\1trace_use_job_queue: false")
286
287     line
288   end
289
290   file "create:#{rails_directory}/config/application.yml" do
291     path "#{rails_directory}/config/application.yml"
292     owner new_resource.user
293     group new_resource.group
294     mode "664"
295     content application_yml
296     only_if { ::File.exist?("#{rails_directory}/config/example.application.yml") }
297   end
298
299   file "delete:#{rails_directory}/config/application.yml" do
300     path "#{rails_directory}/config/application.yml"
301     action :delete
302     not_if { ::File.exist?("#{rails_directory}/config/example.application.yml") }
303   end
304
305   settings = new_resource.to_hash.transform_keys(&:to_s).slice(
306     "email_from",
307     "status",
308     "messages_domain",
309     "attachments_dir",
310     "log_path",
311     "logstash_path",
312     "potlatch2_key",
313     "id_key",
314     "id_application",
315     "oauth_key",
316     "oauth_application",
317     "nominatim_url",
318     "overpass_url",
319     "overpass_credentials",
320     "google_auth_id",
321     "google_auth_secret",
322     "google_openid_realm",
323     "facebook_auth_id",
324     "facebook_auth_secret",
325     "microsoft_auth_id",
326     "microsoft_auth_secret",
327     "github_auth_id",
328     "github_auth_secret",
329     "wikipedia_auth_id",
330     "wikipedia_auth_secret",
331     "thunderforest_key",
332     "tracestrack_key",
333     "totp_key",
334     "csp_enforce",
335     "csp_report_url",
336     "trace_use_job_queue",
337     "diary_feed_delay",
338     "storage_service",
339     "storage_url",
340     "avatar_storage",
341     "trace_file_storage",
342     "trace_image_storage",
343     "trace_icon_storage",
344     "avatar_storage_url",
345     "trace_image_storage_url",
346     "trace_icon_storage_url",
347     "tile_cdn_url",
348     "imagery_blacklist",
349     "signup_ip_per_day",
350     "signup_ip_max_burst",
351     "signup_email_per_day",
352     "signup_email_max_burst",
353     "doorkeeper_signing_key",
354     "user_account_deletion_delay"
355   ).compact.merge(
356     "server_protocol" => "https",
357     "server_url" => new_resource.site,
358     "support_email" => "support@openstreetmap.org",
359     "email_return_path" => "bounces@openstreetmap.org",
360     "geonames_username" => "openstreetmap",
361     "maxmind_database" => "#{node[:geoipupdate][:directory]}/GeoLite2-Country.mmdb",
362     "max_request_area" => node[:web][:max_request_area],
363     "max_number_of_nodes" => node[:web][:max_number_of_nodes],
364     "max_number_of_way_nodes" => node[:web][:max_number_of_way_nodes],
365     "max_number_of_relation_members" => node[:web][:max_number_of_relation_members],
366     "oauth_10_support" => false,
367     "oauth_10_registration" => false,
368     "oauth_10a_support" => false,
369     "basic_auth_support" => false
370   )
371
372   if new_resource.memcache_servers
373     settings["memcache_servers"] = new_resource.memcache_servers.to_a
374   end
375
376   if new_resource.gpx_dir
377     settings["gpx_trace_dir"] = "#{new_resource.gpx_dir}/traces"
378     settings["gpx_image_dir"] = "#{new_resource.gpx_dir}/images"
379   end
380
381   if new_resource.matomo_configuration
382     settings["matomo"] = new_resource.matomo_configuration.to_h
383   end
384
385   file "#{rails_directory}/config/settings.local.yml" do
386     owner new_resource.user
387     group new_resource.group
388     mode "664"
389     content YAML.dump(settings)
390     only_if { ::File.exist?("#{rails_directory}/config/settings.yml") }
391   end
392
393   storage_configuration = new_resource.storage_configuration.merge(
394     "local" => {
395       "service" => "Disk",
396       "root" => "#{rails_directory}/storage"
397     }
398   )
399
400   file "#{rails_directory}/config/storage.yml" do
401     owner new_resource.user
402     group new_resource.group
403     mode "664"
404     content YAML.dump(storage_configuration)
405   end
406
407   file "#{rails_directory}/config/piwik.yml" do
408     action :delete
409   end
410
411   bundle_install "#{rails_directory}" do
412     action :nothing
413     user "root"
414     group "root"
415     environment "NOKOGIRI_USE_SYSTEM_LIBRARIES" => "yes"
416     subscribes :run, "git[#{rails_directory}]"
417   end
418
419   bundle_exec "#{rails_directory}/db/migrate" do
420     action :nothing
421     directory rails_directory
422     command "rails db:migrate"
423     user new_resource.user
424     group new_resource.group
425     subscribes :run, "git[#{rails_directory}]"
426     only_if { new_resource.run_migrations }
427   end
428
429   bundle_exec "#{rails_directory}/package.json" do
430     action :nothing
431     directory rails_directory
432     command "rails yarn:install"
433     environment "HOME" => rails_directory,
434                 "RAILS_ENV" => "production",
435                 "SECRET_KEY_BASE_DUMMY" => "1"
436     user new_resource.user
437     group new_resource.group
438     subscribes :run, "git[#{rails_directory}]"
439     only_if { new_resource.build_assets }
440   end
441
442   bundle_exec "#{rails_directory}/app/assets/javascripts/i18n" do
443     action :nothing
444     directory rails_directory
445     command "rails i18n:js:export"
446     environment "HOME" => rails_directory,
447                 "RAILS_ENV" => "production",
448                 "SECRET_KEY_BASE_DUMMY" => "1"
449     user new_resource.user
450     group new_resource.group
451     subscribes :run, "git[#{rails_directory}]"
452     only_if { new_resource.build_assets }
453   end
454
455   bundle_exec "#{rails_directory}/public/assets" do
456     action :nothing
457     directory rails_directory
458     command "rails assets:precompile"
459     environment "HOME" => rails_directory,
460                 "RAILS_ENV" => "production",
461                 "SECRET_KEY_BASE_DUMMY" => "1"
462     user new_resource.user
463     group new_resource.group
464     subscribes :run, "git[#{rails_directory}]"
465     subscribes :run, "file[create:#{rails_directory}/config/application.yml]"
466     subscribes :run, "file[#{rails_directory}/config/settings.local.yml]"
467     subscribes :run, "file[#{rails_directory}/config/storage.yml]"
468     subscribes :run, "bundle_exec[#{rails_directory}/package.json]"
469     subscribes :run, "bundle_exec[#{rails_directory}/app/assets/javascripts/i18n]"
470     only_if { new_resource.build_assets }
471   end
472
473   file "#{rails_directory}/public/export/embed.html" do
474     action :nothing
475     subscribes :delete, "git[#{rails_directory}]"
476     subscribes :delete, "file[#{rails_directory}/config/settings.local.yml]"
477   end
478
479   passenger_application rails_directory do
480     action :nothing
481     subscribes :restart, "git[#{rails_directory}]"
482     subscribes :restart, "file[#{rails_directory}/config/database.yml]"
483     subscribes :restart, "file[create:#{rails_directory}/config/application.yml]"
484     subscribes :restart, "file[#{rails_directory}/config/settings.local.yml]"
485     subscribes :restart, "file[#{rails_directory}/config/storage.yml]"
486     subscribes :restart, "bundle_installl[#{rails_directory}]"
487     subscribes :restart, "bundle_exec[#{rails_directory}/db/migrate]"
488     subscribes :restart, "bundle_exec[#{rails_directory}/package.json]"
489     subscribes :restart, "bundle_exec[#{rails_directory}/app/assets/javascripts/i18n]"
490     subscribes :restart, "bundle_exec[#{rails_directory}/public/assets]"
491     only_if { ::File.exist?("/usr/bin/passenger-config") }
492   end
493
494   template "/etc/cron.daily/rails-#{new_resource.site.tr('.', '-')}" do
495     cookbook "web"
496     source "rails.cron.erb"
497     owner "root"
498     group "root"
499     mode "755"
500     variables :directory => rails_directory
501   end
502 end
503
504 action :restart do
505   passenger_application rails_directory do
506     action :restart
507   end
508 end
509
510 action_class do
511   include OpenStreetMap::Mixin::EditFile
512
513   def rails_directory
514     new_resource.directory || "/srv/#{new_resource.site}"
515   end
516 end