]> git.openstreetmap.org Git - chef.git/blob - cookbooks/web/resources/rails_port.rb
Configure signing key for OpenID Connect
[chef.git] / cookbooks / web / resources / rails_port.rb
1 #
2 # Cookbook:: web
3 # Resource:: rails_port
4 #
5 # Copyright:: 2012, OpenStreetMap Foundation
6 #
7 # Licensed under the Apache License, Version 2.0 (the "License");
8 # you may not use this file except in compliance with the License.
9 # You may obtain a copy of the License at
10 #
11 #     https://www.apache.org/licenses/LICENSE-2.0
12 #
13 # Unless required by applicable law or agreed to in writing, software
14 # distributed under the License is distributed on an "AS IS" BASIS,
15 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 # See the License for the specific language governing permissions and
17 # limitations under the License.
18 #
19
20 require "yaml"
21
22 resource_name :rails_port
23 provides :rails_port
24
25 unified_mode true
26
27 default_action :create
28
29 property :site, String, :name_property => true
30 property :directory, String
31 property :user, String
32 property :group, String
33 property :repository, String, :default => "https://git.openstreetmap.org/public/rails.git"
34 property :revision, String, :default => "live"
35 property :run_migrations, [true, false], :default => false
36 property :build_assets, [true, false], :default => true
37 property :email_from, String, :default => "OpenStreetMap <support@openstreetmap.org>"
38 property :status, String, :default => "online"
39 property :database_host, String
40 property :database_port, String
41 property :database_name, String
42 property :database_username, String
43 property :database_password, String
44 property :email_from, String
45 property :messages_domain, String
46 property :gpx_dir, String
47 property :attachments_dir, String
48 property :log_path, String
49 property :logstash_path, String
50 property :memcache_servers, Array
51 property :potlatch2_key, String
52 property :id_key, String
53 property :id_application, String
54 property :oauth_key, String
55 property :oauth_application, String
56 property :nominatim_url, String
57 property :overpass_url, String
58 property :overpass_credentials, [true, false], :default => false
59 property :google_auth_id, String
60 property :google_auth_secret, String
61 property :google_openid_realm, String
62 property :facebook_auth_id, String
63 property :facebook_auth_secret, String
64 property :microsoft_auth_id, String
65 property :microsoft_auth_secret, String
66 property :github_auth_id, String
67 property :github_auth_secret, String
68 property :wikipedia_auth_id, String
69 property :wikipedia_auth_secret, String
70 property :thunderforest_key, String
71 property :tracestrack_key, String
72 property :totp_key, String
73 property :csp_enforce, [true, false], :default => false
74 property :csp_report_url, String
75 property :matomo_configuration, Hash
76 property :storage_service, String, :default => "local"
77 property :storage_url, String
78 property :trace_use_job_queue, [true, false], :default => false
79 property :diary_feed_delay, Integer
80 property :storage_configuration, Hash, :default => {}
81 property :avatar_storage, String
82 property :trace_file_storage, String
83 property :trace_image_storage, String
84 property :trace_icon_storage, String
85 property :avatar_storage_url, String
86 property :trace_image_storage_url, String
87 property :trace_icon_storage_url, String
88 property :tile_cdn_url, String
89 property :imagery_blacklist, Array
90 property :signup_ip_per_day, Integer
91 property :signup_ip_max_burst, Integer
92 property :signup_email_per_day, Integer
93 property :signup_email_max_burst, Integer
94 property :doorkeeper_signing_key, String
95
96 action :create do
97   package %W[
98     imagemagick
99     libvips42
100     nodejs
101     tzdata
102   ]
103
104   package %w[
105     g++
106     make
107     pkg-config
108     libpq-dev
109     libsasl2-dev
110     libxml2-dev
111     libxslt1-dev
112     libmemcached-dev
113     libffi-dev
114     libgd-dev
115     libarchive-dev
116     libbz2-dev
117   ]
118
119   package %w[
120     pngcrush
121     advancecomp
122     optipng
123     pngquant
124     jhead
125     jpegoptim
126     gifsicle
127     libjpeg-turbo-progs
128   ]
129
130   declare_resource :directory, rails_directory do
131     owner new_resource.user
132     group new_resource.group
133     mode "2775"
134   end
135
136   git rails_directory do
137     action :sync
138     repository new_resource.repository
139     revision new_resource.revision
140     depth 1
141     user new_resource.user
142     group new_resource.group
143   end
144
145   declare_resource :directory, "#{rails_directory}/tmp" do
146     owner new_resource.user
147     group new_resource.group
148   end
149
150   file "#{rails_directory}/config/environment.rb" do
151     owner new_resource.user
152     group new_resource.group
153   end
154
155   template "#{rails_directory}/config/database.yml" do
156     cookbook "web"
157     source "database.yml.erb"
158     owner new_resource.user
159     group new_resource.group
160     mode "664"
161     variables :host => new_resource.database_host,
162               :port => new_resource.database_port,
163               :name => new_resource.database_name,
164               :username => new_resource.database_username,
165               :password => new_resource.database_password
166   end
167
168   application_yml = edit_file "#{rails_directory}/config/example.application.yml" do |line|
169     line.gsub!(/^( *)server_protocol:.*$/, "\\1server_protocol: \"https\"")
170     line.gsub!(/^( *)server_url:.*$/, "\\1server_url: \"#{new_resource.site}\"")
171
172     line.gsub!(/^( *)support_email:.*$/, "\\1support_email: \"support@openstreetmap.org\"")
173
174     if new_resource.email_from
175       line.gsub!(/^( *)email_from:.*$/, "\\1email_from: \"#{new_resource.email_from}\"")
176     end
177
178     line.gsub!(/^( *)email_return_path:.*$/, "\\1email_return_path: \"bounces@openstreetmap.org\"")
179
180     line.gsub!(/^( *)status:.*$/, "\\1status: :#{new_resource.status}")
181
182     if new_resource.messages_domain
183       line.gsub!(/^( *)#messages_domain:.*$/, "\\1messages_domain: \"#{new_resource.messages_domain}\"")
184     end
185
186     line.gsub!(/^( *)#geonames_username:.*$/, "\\1geonames_username: \"openstreetmap\"")
187
188     line.gsub!(/^( *)#maxmind_database:.*$/, "\\1maxmind_database: \"#{node[:geoipupdate][:directory]}/GeoLite2-Country.mmdb\"")
189
190     if new_resource.gpx_dir
191       line.gsub!(/^( *)gpx_trace_dir:.*$/, "\\1gpx_trace_dir: \"#{new_resource.gpx_dir}/traces\"")
192       line.gsub!(/^( *)gpx_image_dir:.*$/, "\\1gpx_image_dir: \"#{new_resource.gpx_dir}/images\"")
193     end
194
195     if new_resource.attachments_dir
196       line.gsub!(/^( *)attachments_dir:.*$/, "\\1attachments_dir: \"#{new_resource.attachments_dir}\"")
197     end
198
199     if new_resource.log_path
200       line.gsub!(/^( *)#log_path:.*$/, "\\1log_path: \"#{new_resource.log_path}\"")
201     end
202
203     if new_resource.logstash_path
204       line.gsub!(/^( *)#logstash_path:.*$/, "\\1logstash_path: \"#{new_resource.logstash_path}\"")
205     end
206
207     if new_resource.memcache_servers
208       line.gsub!(/^( *)#memcache_servers:.*$/, "\\1memcache_servers: [ \"#{new_resource.memcache_servers.join('", "')}\" ]")
209     end
210
211     if new_resource.potlatch2_key
212       line.gsub!(/^( *)#potlatch2_key:.*$/, "\\1potlatch2_key: \"#{new_resource.potlatch2_key}\"")
213     end
214
215     if new_resource.id_key
216       line.gsub!(/^( *)#id_key:.*$/, "\\1id_key: \"#{new_resource.id_key}\"")
217     end
218
219     if new_resource.id_application
220       line.gsub!(/^( *)#id_application:.*$/, "\\1id_application: \"#{new_resource.id_application}\"")
221     end
222
223     if new_resource.oauth_key
224       line.gsub!(/^( *)#oauth_key:.*$/, "\\1oauth_key: \"#{new_resource.oauth_key}\"")
225     end
226
227     if new_resource.oauth_application
228       line.gsub!(/^( *)#oauth_application:.*$/, "\\1oauth_application: \"#{new_resource.oauth_application}\"")
229     end
230
231     if new_resource.nominatim_url
232       line.gsub!(/^( *)nominatim_url:.*$/, "\\1nominatim_url: \"#{new_resource.nominatim_url}\"")
233     end
234
235     if new_resource.overpass_url
236       line.gsub!(/^( *)overpass_url:.*$/, "\\1overpass_url: \"#{new_resource.overpass_url}\"")
237     end
238
239     if new_resource.google_auth_id
240       line.gsub!(/^( *)#google_auth_id:.*$/, "\\1google_auth_id: \"#{new_resource.google_auth_id}\"")
241       line.gsub!(/^( *)#google_auth_secret:.*$/, "\\1google_auth_secret: \"#{new_resource.google_auth_secret}\"")
242       line.gsub!(/^( *)#google_openid_realm:.*$/, "\\1google_openid_realm: \"#{new_resource.google_openid_realm}\"")
243     end
244
245     if new_resource.facebook_auth_id
246       line.gsub!(/^( *)#facebook_auth_id:.*$/, "\\1facebook_auth_id: \"#{new_resource.facebook_auth_id}\"")
247       line.gsub!(/^( *)#facebook_auth_secret:.*$/, "\\1facebook_auth_secret: \"#{new_resource.facebook_auth_secret}\"")
248     end
249
250     if new_resource.microsoft_auth_id
251       line.gsub!(/^( *)#microsoft_auth_id:.*$/, "\\1microsoft_auth_id: \"#{new_resource.microsoft_auth_id}\"")
252       line.gsub!(/^( *)#microsoft_auth_secret:.*$/, "\\1microsoft_auth_secret: \"#{new_resource.microsoft_auth_secret}\"")
253     end
254
255     if new_resource.github_auth_id
256       line.gsub!(/^( *)#github_auth_id:.*$/, "\\1github_auth_id: \"#{new_resource.github_auth_id}\"")
257       line.gsub!(/^( *)#github_auth_secret:.*$/, "\\1github_auth_secret: \"#{new_resource.github_auth_secret}\"")
258     end
259
260     if new_resource.wikipedia_auth_id
261       line.gsub!(/^( *)#wikipedia_auth_id:.*$/, "\\1wikipedia_auth_id: \"#{new_resource.wikipedia_auth_id}\"")
262       line.gsub!(/^( *)#wikipedia_auth_secret:.*$/, "\\1wikipedia_auth_secret: \"#{new_resource.wikipedia_auth_secret}\"")
263     end
264
265     if new_resource.thunderforest_key
266       line.gsub!(/^( *)#thunderforest_key:.*$/, "\\1thunderforest_key: \"#{new_resource.thunderforest_key}\"")
267     end
268
269     if new_resource.totp_key
270       line.gsub!(/^( *)#totp_key:.*$/, "\\1totp_key: \"#{new_resource.totp_key}\"")
271     end
272
273     if new_resource.csp_enforce
274       line.gsub!(/^( *)csp_enforce:.*$/, "\\1csp_enforce: \"#{new_resource.csp_enforce}\"")
275     end
276
277     if new_resource.csp_report_url
278       line.gsub!(/^( *)#csp_report_url:.*$/, "\\1csp_report_url: \"#{new_resource.csp_report_url}\"")
279     end
280
281     line.gsub!(/^( *)require_terms_seen:.*$/, "\\1require_terms_seen: true")
282     line.gsub!(/^( *)require_terms_agreed:.*$/, "\\1require_terms_agreed: true")
283     line.gsub!(/^( *)trace_use_job_queue:.*$/, "\\1trace_use_job_queue: false")
284
285     line
286   end
287
288   file "create:#{rails_directory}/config/application.yml" do
289     path "#{rails_directory}/config/application.yml"
290     owner new_resource.user
291     group new_resource.group
292     mode "664"
293     content application_yml
294     only_if { ::File.exist?("#{rails_directory}/config/example.application.yml") }
295   end
296
297   file "delete:#{rails_directory}/config/application.yml" do
298     path "#{rails_directory}/config/application.yml"
299     action :delete
300     not_if { ::File.exist?("#{rails_directory}/config/example.application.yml") }
301   end
302
303   settings = new_resource.to_hash.transform_keys(&:to_s).slice(
304     "email_from",
305     "status",
306     "messages_domain",
307     "attachments_dir",
308     "log_path",
309     "logstash_path",
310     "potlatch2_key",
311     "id_key",
312     "id_application",
313     "oauth_key",
314     "oauth_application",
315     "nominatim_url",
316     "overpass_url",
317     "overpass_credentials",
318     "google_auth_id",
319     "google_auth_secret",
320     "google_openid_realm",
321     "facebook_auth_id",
322     "facebook_auth_secret",
323     "microsoft_auth_id",
324     "microsoft_auth_secret",
325     "github_auth_id",
326     "github_auth_secret",
327     "wikipedia_auth_id",
328     "wikipedia_auth_secret",
329     "thunderforest_key",
330     "tracestrack_key",
331     "totp_key",
332     "csp_enforce",
333     "csp_report_url",
334     "trace_use_job_queue",
335     "diary_feed_delay",
336     "storage_service",
337     "storage_url",
338     "avatar_storage",
339     "trace_file_storage",
340     "trace_image_storage",
341     "trace_icon_storage",
342     "avatar_storage_url",
343     "trace_image_storage_url",
344     "trace_icon_storage_url",
345     "tile_cdn_url",
346     "imagery_blacklist",
347     "signup_ip_per_day",
348     "signup_ip_max_burst",
349     "signup_email_per_day",
350     "signup_email_max_burst",
351     "doorkeeper_signing_key"
352   ).compact.merge(
353     "server_protocol" => "https",
354     "server_url" => new_resource.site,
355     "support_email" => "support@openstreetmap.org",
356     "email_return_path" => "bounces@openstreetmap.org",
357     "geonames_username" => "openstreetmap",
358     "maxmind_database" => "#{node[:geoipupdate][:directory]}/GeoLite2-Country.mmdb",
359     "max_request_area" => node[:web][:max_request_area],
360     "max_number_of_nodes" => node[:web][:max_number_of_nodes],
361     "max_number_of_way_nodes" => node[:web][:max_number_of_way_nodes],
362     "max_number_of_relation_members" => node[:web][:max_number_of_relation_members]
363   )
364
365   if new_resource.memcache_servers
366     settings["memcache_servers"] = new_resource.memcache_servers.to_a
367   end
368
369   if new_resource.gpx_dir
370     settings["gpx_trace_dir"] = "#{new_resource.gpx_dir}/traces"
371     settings["gpx_image_dir"] = "#{new_resource.gpx_dir}/images"
372   end
373
374   if new_resource.matomo_configuration
375     settings["matomo"] = new_resource.matomo_configuration.to_h
376   end
377
378   file "#{rails_directory}/config/settings.local.yml" do
379     owner new_resource.user
380     group new_resource.group
381     mode "664"
382     content YAML.dump(settings)
383     only_if { ::File.exist?("#{rails_directory}/config/settings.yml") }
384   end
385
386   storage_configuration = new_resource.storage_configuration.merge(
387     "local" => {
388       "service" => "Disk",
389       "root" => "#{rails_directory}/storage"
390     }
391   )
392
393   file "#{rails_directory}/config/storage.yml" do
394     owner new_resource.user
395     group new_resource.group
396     mode "664"
397     content YAML.dump(storage_configuration)
398   end
399
400   file "#{rails_directory}/config/piwik.yml" do
401     action :delete
402   end
403
404   bundle_install "#{rails_directory}" do
405     action :nothing
406     user "root"
407     group "root"
408     environment "NOKOGIRI_USE_SYSTEM_LIBRARIES" => "yes"
409     subscribes :run, "git[#{rails_directory}]"
410   end
411
412   bundle_exec "#{rails_directory}/db/migrate" do
413     action :nothing
414     directory rails_directory
415     command "rails db:migrate"
416     user new_resource.user
417     group new_resource.group
418     subscribes :run, "git[#{rails_directory}]"
419     only_if { new_resource.run_migrations }
420   end
421
422   bundle_exec "#{rails_directory}/package.json" do
423     action :nothing
424     directory rails_directory
425     command "rails yarn:install"
426     environment "HOME" => rails_directory,
427                 "RAILS_ENV" => "production"
428     user new_resource.user
429     group new_resource.group
430     subscribes :run, "git[#{rails_directory}]"
431     only_if { new_resource.build_assets }
432   end
433
434   bundle_exec "#{rails_directory}/app/assets/javascripts/i18n" do
435     action :nothing
436     directory rails_directory
437     command "rails i18n:js:export"
438     environment "HOME" => rails_directory,
439                 "RAILS_ENV" => "production"
440     user new_resource.user
441     group new_resource.group
442     subscribes :run, "git[#{rails_directory}]"
443     only_if { new_resource.build_assets }
444   end
445
446   bundle_exec "#{rails_directory}/public/assets" do
447     action :nothing
448     directory rails_directory
449     command "rails assets:precompile"
450     environment "HOME" => rails_directory,
451                 "RAILS_ENV" => "production"
452     user new_resource.user
453     group new_resource.group
454     subscribes :run, "git[#{rails_directory}]"
455     subscribes :run, "file[create:#{rails_directory}/config/application.yml]"
456     subscribes :run, "file[#{rails_directory}/config/settings.local.yml]"
457     subscribes :run, "file[#{rails_directory}/config/storage.yml]"
458     subscribes :run, "bundle_exec[#{rails_directory}/package.json]"
459     subscribes :run, "bundle_exec[#{rails_directory}/app/assets/javascripts/i18n]"
460     only_if { new_resource.build_assets }
461   end
462
463   file "#{rails_directory}/public/export/embed.html" do
464     action :nothing
465     subscribes :delete, "git[#{rails_directory}]"
466     subscribes :delete, "file[#{rails_directory}/config/settings.local.yml]"
467   end
468
469   passenger_application rails_directory do
470     action :nothing
471     subscribes :restart, "git[#{rails_directory}]"
472     subscribes :restart, "file[#{rails_directory}/config/database.yml]"
473     subscribes :restart, "file[create:#{rails_directory}/config/application.yml]"
474     subscribes :restart, "file[#{rails_directory}/config/settings.local.yml]"
475     subscribes :restart, "file[#{rails_directory}/config/storage.yml]"
476     subscribes :restart, "bundle_installl[#{rails_directory}]"
477     subscribes :restart, "bundle_exec[#{rails_directory}/db/migrate]"
478     subscribes :restart, "bundle_exec[#{rails_directory}/package.json]"
479     subscribes :restart, "bundle_exec[#{rails_directory}/app/assets/javascripts/i18n]"
480     subscribes :restart, "bundle_exec[#{rails_directory}/public/assets]"
481     only_if { ::File.exist?("/usr/bin/passenger-config") }
482   end
483
484   template "/etc/cron.daily/rails-#{new_resource.site.tr('.', '-')}" do
485     cookbook "web"
486     source "rails.cron.erb"
487     owner "root"
488     group "root"
489     mode "755"
490     variables :directory => rails_directory
491   end
492 end
493
494 action :restart do
495   passenger_application rails_directory do
496     action :restart
497   end
498 end
499
500 action_class do
501   include OpenStreetMap::Mixin::EditFile
502
503   def rails_directory
504     new_resource.directory || "/srv/#{new_resource.site}"
505   end
506 end