]> git.openstreetmap.org Git - chef.git/blob - cookbooks/web/resources/rails_port.rb
Configure imagery blacklist for the web site
[chef.git] / cookbooks / web / resources / rails_port.rb
1 #
2 # Cookbook:: web
3 # Resource:: rails_port
4 #
5 # Copyright:: 2012, OpenStreetMap Foundation
6 #
7 # Licensed under the Apache License, Version 2.0 (the "License");
8 # you may not use this file except in compliance with the License.
9 # You may obtain a copy of the License at
10 #
11 #     https://www.apache.org/licenses/LICENSE-2.0
12 #
13 # Unless required by applicable law or agreed to in writing, software
14 # distributed under the License is distributed on an "AS IS" BASIS,
15 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 # See the License for the specific language governing permissions and
17 # limitations under the License.
18 #
19
20 require "yaml"
21
22 resource_name :rails_port
23 provides :rails_port
24
25 unified_mode true
26
27 default_action :create
28
29 property :site, String, :name_property => true
30 property :directory, String
31 property :user, String
32 property :group, String
33 property :repository, String, :default => "https://git.openstreetmap.org/public/rails.git"
34 property :revision, String, :default => "live"
35 property :run_migrations, [true, false], :default => false
36 property :build_assets, [true, false], :default => true
37 property :email_from, String, :default => "OpenStreetMap <support@openstreetmap.org>"
38 property :status, String, :default => "online"
39 property :database_host, String
40 property :database_port, String
41 property :database_name, String
42 property :database_username, String
43 property :database_password, String
44 property :email_from, String
45 property :messages_domain, String
46 property :gpx_dir, String
47 property :attachments_dir, String
48 property :log_path, String
49 property :logstash_path, String
50 property :memcache_servers, Array
51 property :potlatch2_key, String
52 property :id_key, String
53 property :id_application, String
54 property :oauth_key, String
55 property :oauth_application, String
56 property :nominatim_url, String
57 property :overpass_url, String
58 property :overpass_credentials, [true, false], :default => false
59 property :google_auth_id, String
60 property :google_auth_secret, String
61 property :google_openid_realm, String
62 property :facebook_auth_id, String
63 property :facebook_auth_secret, String
64 property :windowslive_auth_id, String
65 property :windowslive_auth_secret, String
66 property :github_auth_id, String
67 property :github_auth_secret, String
68 property :wikipedia_auth_id, String
69 property :wikipedia_auth_secret, String
70 property :thunderforest_key, String
71 property :totp_key, String
72 property :csp_enforce, [true, false], :default => false
73 property :csp_report_url, String
74 property :matomo_configuration, Hash
75 property :storage_service, String, :default => "local"
76 property :storage_url, String
77 property :trace_use_job_queue, [true, false], :default => false
78 property :diary_feed_delay, Integer
79 property :storage_configuration, Hash, :default => {}
80 property :avatar_storage, String
81 property :trace_file_storage, String
82 property :trace_image_storage, String
83 property :trace_icon_storage, String
84 property :avatar_storage_url, String
85 property :trace_image_storage_url, String
86 property :trace_icon_storage_url, String
87 property :tile_cdn_url, String
88 property :imagery_blacklist, Array
89
90 action :create do
91   package %W[
92     imagemagick
93     libvips42
94     nodejs
95     tzdata
96   ]
97
98   package %w[
99     g++
100     make
101     pkg-config
102     libpq-dev
103     libsasl2-dev
104     libxml2-dev
105     libxslt1-dev
106     libmemcached-dev
107     libffi-dev
108     libgd-dev
109     libarchive-dev
110     libbz2-dev
111   ]
112
113   package %w[
114     pngcrush
115     advancecomp
116     optipng
117     pngquant
118     jhead
119     jpegoptim
120     gifsicle
121     libjpeg-turbo-progs
122   ]
123
124   declare_resource :directory, rails_directory do
125     owner new_resource.user
126     group new_resource.group
127     mode "2775"
128   end
129
130   git rails_directory do
131     action :sync
132     repository new_resource.repository
133     revision new_resource.revision
134     depth 1
135     user new_resource.user
136     group new_resource.group
137   end
138
139   declare_resource :directory, "#{rails_directory}/tmp" do
140     owner new_resource.user
141     group new_resource.group
142   end
143
144   file "#{rails_directory}/config/environment.rb" do
145     owner new_resource.user
146     group new_resource.group
147   end
148
149   template "#{rails_directory}/config/database.yml" do
150     cookbook "web"
151     source "database.yml.erb"
152     owner new_resource.user
153     group new_resource.group
154     mode "664"
155     variables :host => new_resource.database_host,
156               :port => new_resource.database_port,
157               :name => new_resource.database_name,
158               :username => new_resource.database_username,
159               :password => new_resource.database_password
160   end
161
162   application_yml = edit_file "#{rails_directory}/config/example.application.yml" do |line|
163     line.gsub!(/^( *)server_protocol:.*$/, "\\1server_protocol: \"https\"")
164     line.gsub!(/^( *)server_url:.*$/, "\\1server_url: \"#{new_resource.site}\"")
165
166     line.gsub!(/^( *)support_email:.*$/, "\\1support_email: \"support@openstreetmap.org\"")
167
168     if new_resource.email_from
169       line.gsub!(/^( *)email_from:.*$/, "\\1email_from: \"#{new_resource.email_from}\"")
170     end
171
172     line.gsub!(/^( *)email_return_path:.*$/, "\\1email_return_path: \"bounces@openstreetmap.org\"")
173
174     line.gsub!(/^( *)status:.*$/, "\\1status: :#{new_resource.status}")
175
176     if new_resource.messages_domain
177       line.gsub!(/^( *)#messages_domain:.*$/, "\\1messages_domain: \"#{new_resource.messages_domain}\"")
178     end
179
180     line.gsub!(/^( *)#geonames_username:.*$/, "\\1geonames_username: \"openstreetmap\"")
181
182     line.gsub!(/^( *)#maxmind_database:.*$/, "\\1maxmind_database: \"#{node[:geoipupdate][:directory]}/GeoLite2-Country.mmdb\"")
183
184     if new_resource.gpx_dir
185       line.gsub!(/^( *)gpx_trace_dir:.*$/, "\\1gpx_trace_dir: \"#{new_resource.gpx_dir}/traces\"")
186       line.gsub!(/^( *)gpx_image_dir:.*$/, "\\1gpx_image_dir: \"#{new_resource.gpx_dir}/images\"")
187     end
188
189     if new_resource.attachments_dir
190       line.gsub!(/^( *)attachments_dir:.*$/, "\\1attachments_dir: \"#{new_resource.attachments_dir}\"")
191     end
192
193     if new_resource.log_path
194       line.gsub!(/^( *)#log_path:.*$/, "\\1log_path: \"#{new_resource.log_path}\"")
195     end
196
197     if new_resource.logstash_path
198       line.gsub!(/^( *)#logstash_path:.*$/, "\\1logstash_path: \"#{new_resource.logstash_path}\"")
199     end
200
201     if new_resource.memcache_servers
202       line.gsub!(/^( *)#memcache_servers:.*$/, "\\1memcache_servers: [ \"#{new_resource.memcache_servers.join('", "')}\" ]")
203     end
204
205     if new_resource.potlatch2_key
206       line.gsub!(/^( *)#potlatch2_key:.*$/, "\\1potlatch2_key: \"#{new_resource.potlatch2_key}\"")
207     end
208
209     if new_resource.id_key
210       line.gsub!(/^( *)#id_key:.*$/, "\\1id_key: \"#{new_resource.id_key}\"")
211     end
212
213     if new_resource.id_application
214       line.gsub!(/^( *)#id_application:.*$/, "\\1id_application: \"#{new_resource.id_application}\"")
215     end
216
217     if new_resource.oauth_key
218       line.gsub!(/^( *)#oauth_key:.*$/, "\\1oauth_key: \"#{new_resource.oauth_key}\"")
219     end
220
221     if new_resource.oauth_application
222       line.gsub!(/^( *)#oauth_application:.*$/, "\\1oauth_application: \"#{new_resource.oauth_application}\"")
223     end
224
225     if new_resource.nominatim_url
226       line.gsub!(/^( *)nominatim_url:.*$/, "\\1nominatim_url: \"#{new_resource.nominatim_url}\"")
227     end
228
229     if new_resource.overpass_url
230       line.gsub!(/^( *)overpass_url:.*$/, "\\1overpass_url: \"#{new_resource.overpass_url}\"")
231     end
232
233     if new_resource.google_auth_id
234       line.gsub!(/^( *)#google_auth_id:.*$/, "\\1google_auth_id: \"#{new_resource.google_auth_id}\"")
235       line.gsub!(/^( *)#google_auth_secret:.*$/, "\\1google_auth_secret: \"#{new_resource.google_auth_secret}\"")
236       line.gsub!(/^( *)#google_openid_realm:.*$/, "\\1google_openid_realm: \"#{new_resource.google_openid_realm}\"")
237     end
238
239     if new_resource.facebook_auth_id
240       line.gsub!(/^( *)#facebook_auth_id:.*$/, "\\1facebook_auth_id: \"#{new_resource.facebook_auth_id}\"")
241       line.gsub!(/^( *)#facebook_auth_secret:.*$/, "\\1facebook_auth_secret: \"#{new_resource.facebook_auth_secret}\"")
242     end
243
244     if new_resource.windowslive_auth_id
245       line.gsub!(/^( *)#windowslive_auth_id:.*$/, "\\1windowslive_auth_id: \"#{new_resource.windowslive_auth_id}\"")
246       line.gsub!(/^( *)#windowslive_auth_secret:.*$/, "\\1windowslive_auth_secret: \"#{new_resource.windowslive_auth_secret}\"")
247     end
248
249     if new_resource.github_auth_id
250       line.gsub!(/^( *)#github_auth_id:.*$/, "\\1github_auth_id: \"#{new_resource.github_auth_id}\"")
251       line.gsub!(/^( *)#github_auth_secret:.*$/, "\\1github_auth_secret: \"#{new_resource.github_auth_secret}\"")
252     end
253
254     if new_resource.wikipedia_auth_id
255       line.gsub!(/^( *)#wikipedia_auth_id:.*$/, "\\1wikipedia_auth_id: \"#{new_resource.wikipedia_auth_id}\"")
256       line.gsub!(/^( *)#wikipedia_auth_secret:.*$/, "\\1wikipedia_auth_secret: \"#{new_resource.wikipedia_auth_secret}\"")
257     end
258
259     if new_resource.thunderforest_key
260       line.gsub!(/^( *)#thunderforest_key:.*$/, "\\1thunderforest_key: \"#{new_resource.thunderforest_key}\"")
261     end
262
263     if new_resource.totp_key
264       line.gsub!(/^( *)#totp_key:.*$/, "\\1totp_key: \"#{new_resource.totp_key}\"")
265     end
266
267     if new_resource.csp_enforce
268       line.gsub!(/^( *)csp_enforce:.*$/, "\\1csp_enforce: \"#{new_resource.csp_enforce}\"")
269     end
270
271     if new_resource.csp_report_url
272       line.gsub!(/^( *)#csp_report_url:.*$/, "\\1csp_report_url: \"#{new_resource.csp_report_url}\"")
273     end
274
275     line.gsub!(/^( *)require_terms_seen:.*$/, "\\1require_terms_seen: true")
276     line.gsub!(/^( *)require_terms_agreed:.*$/, "\\1require_terms_agreed: true")
277     line.gsub!(/^( *)trace_use_job_queue:.*$/, "\\1trace_use_job_queue: false")
278
279     line
280   end
281
282   file "create:#{rails_directory}/config/application.yml" do
283     path "#{rails_directory}/config/application.yml"
284     owner new_resource.user
285     group new_resource.group
286     mode "664"
287     content application_yml
288     only_if { ::File.exist?("#{rails_directory}/config/example.application.yml") }
289   end
290
291   file "delete:#{rails_directory}/config/application.yml" do
292     path "#{rails_directory}/config/application.yml"
293     action :delete
294     not_if { ::File.exist?("#{rails_directory}/config/example.application.yml") }
295   end
296
297   settings = new_resource.to_hash.transform_keys(&:to_s).slice(
298     "email_from",
299     "status",
300     "messages_domain",
301     "attachments_dir",
302     "log_path",
303     "logstash_path",
304     "potlatch2_key",
305     "id_key",
306     "id_application",
307     "oauth_key",
308     "oauth_application",
309     "nominatim_url",
310     "overpass_url",
311     "overpass_credentials",
312     "google_auth_id",
313     "google_auth_secret",
314     "google_openid_realm",
315     "facebook_auth_id",
316     "facebook_auth_secret",
317     "windowslive_auth_id",
318     "windowslive_auth_secret",
319     "github_auth_id",
320     "github_auth_secret",
321     "wikipedia_auth_id",
322     "wikipedia_auth_secret",
323     "thunderforest_key",
324     "totp_key",
325     "csp_enforce",
326     "csp_report_url",
327     "trace_use_job_queue",
328     "diary_feed_delay",
329     "storage_service",
330     "storage_url",
331     "avatar_storage",
332     "trace_file_storage",
333     "trace_image_storage",
334     "trace_icon_storage",
335     "avatar_storage_url",
336     "trace_image_storage_url",
337     "trace_icon_storage_url",
338     "tile_cdn_url",
339     "imagery_blacklist"
340   ).compact.merge(
341     "server_protocol" => "https",
342     "server_url" => new_resource.site,
343     "support_email" => "support@openstreetmap.org",
344     "email_return_path" => "bounces@openstreetmap.org",
345     "geonames_username" => "openstreetmap",
346     "maxmind_database" => "#{node[:geoipupdate][:directory]}/GeoLite2-Country.mmdb",
347     "max_request_area" => node[:web][:max_request_area],
348     "max_number_of_nodes" => node[:web][:max_number_of_nodes],
349     "max_number_of_way_nodes" => node[:web][:max_number_of_way_nodes],
350     "max_number_of_relation_members" => node[:web][:max_number_of_relation_members]
351   )
352
353   if new_resource.memcache_servers
354     settings["memcache_servers"] = new_resource.memcache_servers.to_a
355   end
356
357   if new_resource.gpx_dir
358     settings["gpx_trace_dir"] = "#{new_resource.gpx_dir}/traces"
359     settings["gpx_image_dir"] = "#{new_resource.gpx_dir}/images"
360   end
361
362   if new_resource.matomo_configuration
363     settings["matomo"] = new_resource.matomo_configuration.to_h
364   end
365
366   file "#{rails_directory}/config/settings.local.yml" do
367     owner new_resource.user
368     group new_resource.group
369     mode "664"
370     content YAML.dump(settings)
371     only_if { ::File.exist?("#{rails_directory}/config/settings.yml") }
372   end
373
374   storage_configuration = new_resource.storage_configuration.merge(
375     "local" => {
376       "service" => "Disk",
377       "root" => "#{rails_directory}/storage"
378     }
379   )
380
381   file "#{rails_directory}/config/storage.yml" do
382     owner new_resource.user
383     group new_resource.group
384     mode "664"
385     content YAML.dump(storage_configuration)
386   end
387
388   file "#{rails_directory}/config/piwik.yml" do
389     action :delete
390   end
391
392   bundle_install "#{rails_directory}" do
393     action :nothing
394     user "root"
395     group "root"
396     environment "NOKOGIRI_USE_SYSTEM_LIBRARIES" => "yes"
397     subscribes :run, "git[#{rails_directory}]"
398   end
399
400   bundle_exec "#{rails_directory}/db/migrate" do
401     action :nothing
402     directory rails_directory
403     command "rails db:migrate"
404     user new_resource.user
405     group new_resource.group
406     subscribes :run, "git[#{rails_directory}]"
407     only_if { new_resource.run_migrations }
408   end
409
410   bundle_exec "#{rails_directory}/package.json" do
411     action :nothing
412     directory rails_directory
413     command "rails yarn:install"
414     environment "HOME" => rails_directory,
415                 "RAILS_ENV" => "production"
416     user new_resource.user
417     group new_resource.group
418     subscribes :run, "git[#{rails_directory}]"
419     only_if { new_resource.build_assets }
420   end
421
422   bundle_exec "#{rails_directory}/app/assets/javascripts/i18n" do
423     action :nothing
424     directory rails_directory
425     command "rails i18n:js:export"
426     environment "HOME" => rails_directory,
427                 "RAILS_ENV" => "production"
428     user new_resource.user
429     group new_resource.group
430     subscribes :run, "git[#{rails_directory}]"
431     only_if { new_resource.build_assets }
432   end
433
434   bundle_exec "#{rails_directory}/public/assets" do
435     action :nothing
436     directory rails_directory
437     command "rails assets:precompile"
438     environment "HOME" => rails_directory,
439                 "RAILS_ENV" => "production"
440     user new_resource.user
441     group new_resource.group
442     subscribes :run, "git[#{rails_directory}]"
443     subscribes :run, "file[create:#{rails_directory}/config/application.yml]"
444     subscribes :run, "file[#{rails_directory}/config/settings.local.yml]"
445     subscribes :run, "file[#{rails_directory}/config/storage.yml]"
446     subscribes :run, "bundle_exec[#{rails_directory}/package.json]"
447     subscribes :run, "bundle_exec[#{rails_directory}/app/assets/javascripts/i18n]"
448     only_if { new_resource.build_assets }
449   end
450
451   file "#{rails_directory}/public/export/embed.html" do
452     action :nothing
453     subscribes :delete, "git[#{rails_directory}]"
454     subscribes :delete, "file[#{rails_directory}/config/settings.local.yml]"
455   end
456
457   passenger_application rails_directory do
458     action :nothing
459     subscribes :restart, "git[#{rails_directory}]"
460     subscribes :restart, "file[#{rails_directory}/config/database.yml]"
461     subscribes :restart, "file[create:#{rails_directory}/config/application.yml]"
462     subscribes :restart, "file[#{rails_directory}/config/settings.local.yml]"
463     subscribes :restart, "file[#{rails_directory}/config/storage.yml]"
464     subscribes :restart, "bundle_installl[#{rails_directory}]"
465     subscribes :restart, "bundle_exec[#{rails_directory}/db/migrate]"
466     subscribes :restart, "bundle_exec[#{rails_directory}/package.json]"
467     subscribes :restart, "bundle_exec[#{rails_directory}/app/assets/javascripts/i18n]"
468     subscribes :restart, "bundle_exec[#{rails_directory}/public/assets]"
469     only_if { ::File.exist?("/usr/bin/passenger-config") }
470   end
471
472   template "/etc/cron.daily/rails-#{new_resource.site.tr('.', '-')}" do
473     cookbook "web"
474     source "rails.cron.erb"
475     owner "root"
476     group "root"
477     mode "755"
478     variables :directory => rails_directory
479   end
480 end
481
482 action :restart do
483   passenger_application rails_directory do
484     action :restart
485   end
486 end
487
488 action_class do
489   include OpenStreetMap::Mixin::EditFile
490
491   def rails_directory
492     new_resource.directory || "/srv/#{new_resource.site}"
493   end
494 end