X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/03b7d5e985a34d01dccfd03dc11488015e97f7df..1934f47340e1cdd2ffb814c1d9b77d28a3fa621a:/cookbooks/wordpress/resources/site.rb diff --git a/cookbooks/wordpress/resources/site.rb b/cookbooks/wordpress/resources/site.rb index a5e19a1ef..2705bac2a 100644 --- a/cookbooks/wordpress/resources/site.rb +++ b/cookbooks/wordpress/resources/site.rb @@ -17,20 +17,195 @@ # limitations under the License. # -actions :create, :delete +require "securerandom" + default_action :create -attribute :name, :kind_of => String, :name_attribute => true -attribute :aliases, :kind_of => [String, Array] -attribute :directory, :kind_of => String -attribute :version, :kind_of => String -attribute :database_name, :kind_of => String, :required => true -attribute :database_user, :kind_of => String, :required => true -attribute :database_password, :kind_of => String, :required => true -attribute :database_prefix, :kind_of => String, :default => "wp_" -attribute :ssl_enabled, :kind_of => [TrueClass, FalseClass], :default => false -attribute :urls, :kind_of => Hash, :default => {} -attribute :reload_apache, :kind_of => [TrueClass, FalseClass], :default => true +property :site, :kind_of => String, :name_attribute => true +property :aliases, :kind_of => [String, Array] +property :directory, :kind_of => String +property :version, :kind_of => String +property :database_name, :kind_of => String, :required => true +property :database_user, :kind_of => String, :required => true +property :database_password, :kind_of => String, :required => true +property :database_prefix, :kind_of => String, :default => "wp_" +property :ssl_enabled, :kind_of => [TrueClass, FalseClass], :default => false +property :urls, :kind_of => Hash, :default => {} +property :reload_apache, :kind_of => [TrueClass, FalseClass], :default => true + +action :create do + version = new_resource.version || Chef::Wordpress.current_version + + node.normal_unless[:wordpress][:sites][new_resource.site] = {} + + node.normal[:wordpress][:sites][new_resource.site][:directory] = site_directory + + node.normal_unless[:wordpress][:sites][new_resource.site][:auth_key] = SecureRandom.base64(48) + node.normal_unless[:wordpress][:sites][new_resource.site][:secure_auth_key] = SecureRandom.base64(48) + node.normal_unless[:wordpress][:sites][new_resource.site][:logged_in_key] = SecureRandom.base64(48) + node.normal_unless[:wordpress][:sites][new_resource.site][:nonce_key] = SecureRandom.base64(48) + node.normal_unless[:wordpress][:sites][new_resource.site][:auth_salt] = SecureRandom.base64(48) + node.normal_unless[:wordpress][:sites][new_resource.site][:secure_auth_salt] = SecureRandom.base64(48) + node.normal_unless[:wordpress][:sites][new_resource.site][:logged_in_salt] = SecureRandom.base64(48) + node.normal_unless[:wordpress][:sites][new_resource.site][:nonce_salt] = SecureRandom.base64(48) + + mysql_user "#{new_resource.database_user}@localhost" do + password new_resource.database_password + end + + mysql_database new_resource.database_name do + permissions "#{new_resource.database_user}@localhost" => :all + end + + declare_resource :directory, site_directory do + owner node[:wordpress][:user] + group node[:wordpress][:group] + mode 0o755 + end + + subversion site_directory do + action :sync + repository "http://core.svn.wordpress.org/tags/#{version}" + user node[:wordpress][:user] + group node[:wordpress][:group] + ignore_failure true + end + + wp_config = edit_file "#{site_directory}/wp-config-sample.php" do |line| + line.gsub!(/database_name_here/, new_resource.database_name) + line.gsub!(/username_here/, new_resource.database_user) + line.gsub!(/password_here/, new_resource.database_password) + line.gsub!(/wp_/, new_resource.database_prefix) + + line.gsub!(/('AUTH_KEY', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:auth_key]}'") + line.gsub!(/('SECURE_AUTH_KEY', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:secure_auth_key]}'") + line.gsub!(/('LOGGED_IN_KEY', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:logged_in_key]}'") + line.gsub!(/('NONCE_KEY', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:nonce_key]}'") + line.gsub!(/('AUTH_SALT', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:auth_salt]}'") + line.gsub!(/('SECURE_AUTH_SALT', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:secure_auth_salt]}'") + line.gsub!(/('LOGGED_IN_SALT', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:logged_in_salt]}'") + line.gsub!(/('NONCE_SALT', *)'put your unique phrase here'/, "\\1'#{node[:wordpress][:sites][new_resource.site][:nonce_salt]}'") + + if line =~ /define\('WP_DEBUG'/ + line += "\n" + line += "/**\n" + line += " * Don't allow file editing.\n" + line += " */\n" + line += "define('DISALLOW_FILE_EDIT', true);\n" + if new_resource.ssl_enabled + line += "define('FORCE_SSL_LOGIN', true);\n" + line += "define('FORCE_SSL_ADMIN', true);\n" + end + end + + line + end + + file "#{site_directory}/wp-config.php" do + owner node[:wordpress][:user] + group node[:wordpress][:group] + mode 0o644 + content wp_config + end + + declare_resource :directory, "#{site_directory}/wp-content/uploads" do + owner "www-data" + group "www-data" + mode 0o755 + end + + file "#{site_directory}/sitemap.xml" do + action :delete + end + + file "#{site_directory}/sitemap.xml.gz" do + action :delete + end + + cookbook_file "#{site_directory}/googlefac54c35e800caab.html" do + cookbook "wordpress" + owner node[:wordpress][:user] + group node[:wordpress][:group] + mode 0o644 + backup false + end + + ssl_certificate new_resource.site do + domains [new_resource.site] + Array(new_resource.aliases) + only_if { new_resource.ssl_enabled } + end + + apache_site new_resource.site do + cookbook "wordpress" + template "apache.erb" + directory site_directory + variables :aliases => Array(new_resource.aliases), + :urls => new_resource.urls, + :ssl_enabled => new_resource.ssl_enabled + reload_apache false + end + + http_request "http://#{new_resource.site}/wp-admin/upgrade.php" do + action :nothing + url "http://#{new_resource.site}/wp-admin/upgrade.php?step=1" + subscribes :get, "subversion[#{site_directory}]" + end + + wordpress_plugin "wp-fail2ban" do + site new_resource.site + reload_apache false + end + + script "#{site_directory}/wp-content/plugins/wp-fail2ban" do + action :nothing + interpreter "php" + cwd site_directory + user "wordpress" + code <<-WP_FAIL2BAN + + WP_FAIL2BAN + subscribes :run, "wordpress_plugin[wp-fail2ban]" + end +end + +action :delete do + wordpress_plugin "wp-fail2ban" do + action :delete + site new_resource.site + reload_apache false + end + + apache_site new_resource.site do + action :delete + reload_apache false + end + + declare_resource :directory, site_directory do + action :delete + recursive true + end + + mysql_database new_resource.database_name do + action :drop + end + + mysql_user "#{new_resource.database_user}@localhost" do + action :drop + end +end + +action_class do + include Chef::Mixin::EditFile + + def site_directory + new_resource.directory || "/srv/#{new_resource.site}" + end +end def after_created notifies :reload, "service[apache2]" if reload_apache