reprepro.pp 5.22 KB
Newer Older
1
2
class tails::reprepro (
  $basedir = '/srv/reprepro',
intrigeri's avatar
intrigeri committed
3
  $uploaders = [
intrigeri's avatar
intrigeri committed
4
    'C92949B8A63BB098+',
intrigeri's avatar
intrigeri committed
5
6
7
8
    '1D84CCF010CC5BC7',
    '91F73701D9C99DC9',
    '7EF27D76B2177E1F'
  ],
9
10
11
  $origin = 'Tails',
  $web_hostname  = 'deb.tails.boum.org',
  $web_port      = 80,
12
  $nginx_managed = true,
13
  $git_remote    = 'https://git-tails.immerda.ch/tails'
14
) {
intrigeri's avatar
intrigeri committed
15

16
17
18
19
20
21
  ### Sanity checks

  if $::lsbdistcodename != 'jessie' {
    fail('The tails::tester module only supports Debian Jessie.')
  }

intrigeri's avatar
intrigeri committed
22
  ### Class variables
intrigeri's avatar
intrigeri committed
23
24

  $git_repo = "${basedir}/tails.git"
intrigeri's avatar
intrigeri committed
25
  $shell_lib = '/usr/local/share/tails-reprepro/functions.sh'
intrigeri's avatar
intrigeri committed
26

intrigeri's avatar
intrigeri committed
27
28
29
  ### Pull in external dependencies

  include tails_secrets_apt
30
  include ::reprepro
intrigeri's avatar
intrigeri committed
31
32
33

  ### Resources

34
  reprepro::repository { 'tails':
intrigeri's avatar
intrigeri committed
35
36
37
38
39
    uploaders                    => $uploaders,
    basedir                      => $basedir,
    origin                       => $origin,
    basedir_mode                 => '0751',
    incoming_mode                => '1775',
40
41
42
    manage_distributions_conf    => false,
    manage_incoming_conf         => false,
    handle_incoming_with_inotify => true,
43
    index_template               => 'tails/reprepro/index.html.erb',
44
45
  }

46
  ensure_packages(['git', 'moreutils'])
intrigeri's avatar
intrigeri committed
47
48

  file {
intrigeri's avatar
misc    
intrigeri committed
49
50
51

    '/usr/local/share/tails-reprepro':
      ensure => directory,
intrigeri's avatar
intrigeri committed
52
      mode => '0755', owner => root, group => reprepro;
intrigeri's avatar
misc    
intrigeri committed
53

intrigeri's avatar
intrigeri committed
54
    $shell_lib:
intrigeri's avatar
intrigeri committed
55
      mode => '0644', owner => root, group => reprepro,
intrigeri's avatar
intrigeri committed
56
      source  => [ 'puppet:///modules/tails/reprepro/functions.sh' ],
intrigeri's avatar
misc    
intrigeri committed
57
58
      require => File['/usr/local/share/tails-reprepro'];

59
60
61
62
63
    '/usr/local/bin/tails-diff-suites':
      source  => [ 'puppet:///modules/tails/reprepro/tails-diff-suites' ],
      require => File[$shell_lib],
      mode => '0755', owner => root, group => root;

64
    '/usr/local/bin/tails-merge-suite':
intrigeri's avatar
intrigeri committed
65
      source  => [ 'puppet:///modules/tails/reprepro/tails-merge-suite' ],
intrigeri's avatar
intrigeri committed
66
      require => File[$shell_lib],
intrigeri's avatar
intrigeri committed
67
      mode => '0755', owner => root, group => root;
68

intrigeri's avatar
misc    
intrigeri committed
69
    '/usr/local/bin/tails-suites-list':
intrigeri's avatar
intrigeri committed
70
      source  => [ 'puppet:///modules/tails/reprepro/tails-suites-list' ],
intrigeri's avatar
intrigeri committed
71
      require => File[$shell_lib],
intrigeri's avatar
intrigeri committed
72
      mode => '0755', owner => root, group => root;
intrigeri's avatar
misc    
intrigeri committed
73
74

    '/usr/local/bin/tails-suites-to-distributions':
intrigeri's avatar
intrigeri committed
75
      source => [ 'puppet:///modules/tails/reprepro/tails-suites-to-distributions' ],
intrigeri's avatar
intrigeri committed
76
      mode => '0755', owner => root, group => root;
intrigeri's avatar
misc    
intrigeri committed
77
78

    '/usr/local/bin/tails-suites-to-incoming':
intrigeri's avatar
intrigeri committed
79
      source => [ 'puppet:///modules/tails/reprepro/tails-suites-to-incoming' ],
intrigeri's avatar
intrigeri committed
80
      mode => '0755', owner => root, group => root;
intrigeri's avatar
misc    
intrigeri committed
81
82

    '/usr/local/bin/tails-update-reprepro-config':
intrigeri's avatar
intrigeri committed
83
      source  => [ 'puppet:///modules/tails/reprepro/tails-update-reprepro-config' ],
intrigeri's avatar
misc    
intrigeri committed
84
      require => [
intrigeri's avatar
intrigeri committed
85
        Exec['tails-reprepro-git-clone'],
intrigeri's avatar
intrigeri committed
86
        File[$shell_lib],
intrigeri's avatar
intrigeri committed
87
88
89
90
91
92
        File['/usr/local/bin/tails-suites-list'],
        File['/usr/local/bin/tails-suites-to-distributions'],
        File['/usr/local/bin/tails-suites-to-incoming'],
        Package['moreutils'],
      ],
      mode => '0755', owner => root, group => root;
intrigeri's avatar
misc    
intrigeri committed
93

intrigeri's avatar
intrigeri committed
94
    "${basedir}/conf/deny_all_uploaders":
intrigeri's avatar
intrigeri committed
95
      mode => '0660', owner => root, group => reprepro,
intrigeri's avatar
misc    
intrigeri committed
96
      content => '',
intrigeri's avatar
intrigeri committed
97
      require => File["${basedir}/conf"];
intrigeri's avatar
misc    
intrigeri committed
98

intrigeri's avatar
intrigeri committed
99
100
  }

intrigeri's avatar
misc    
intrigeri committed
101
  cron { 'tails-update-reprepro-config':
intrigeri's avatar
intrigeri committed
102
    user    => 'reprepro',
103
    minute  => '*',
104
    command => "flock -n /var/lock/tails-update-reprepro-config /usr/local/bin/tails-update-reprepro-config '${git_repo}' '${origin}' '${basedir}'",
intrigeri's avatar
intrigeri committed
105
    require => [ File['/usr/local/bin/tails-update-reprepro-config'], ],
intrigeri's avatar
intrigeri committed
106
107
  }

intrigeri's avatar
intrigeri committed
108
  # Can't use vcsrepo, that doesn't support --mirror
intrigeri's avatar
intrigeri committed
109
  exec { 'tails-reprepro-git-clone':
intrigeri's avatar
misc    
intrigeri committed
110
111
    user    => reprepro,
    group   => reprepro,
intrigeri's avatar
intrigeri committed
112
    cwd     => $basedir,
intrigeri's avatar
intrigeri committed
113
    command => "git clone --bare --mirror '${git_remote}' '${git_repo}' && chmod -R g+rX '${git_repo}'",
intrigeri's avatar
intrigeri committed
114
115
116
117
    creates => "${git_repo}/config",
    require => Package['git'],
    timeout => -1,
  }
intrigeri's avatar
misc    
intrigeri committed
118
119
120
121

  exec { 'tails-reprepro-import-keys':
    user        => reprepro,
    group       => reprepro,
intrigeri's avatar
intrigeri committed
122
123
    command     => "gpg --homedir '${basedir}/.gnupg' --batch --quiet --import '${tails_secrets_apt::keys}'",
    subscribe   => File[$tails_secrets_apt::keys],
intrigeri's avatar
misc    
intrigeri committed
124
    refreshonly => true,
intrigeri's avatar
intrigeri committed
125
126
    notify      => Exec["/usr/local/bin/reprepro-export-key '${basedir}'"],
    require     => Mount[$tails_secrets_apt::gnupg_homedir],
intrigeri's avatar
misc    
intrigeri committed
127
128
  }

intrigeri's avatar
intrigeri committed
129
130
  mailalias { 'reprepro': ensure => present, recipient => ['root']; }

131
  class { 'tails::reprepro::nginx':
132
133
    hostname => $web_hostname,
    port     => $web_port,
134
    basedir  => $basedir,
135
    managed  => $nginx_managed;
136
137
  }

138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
  # Refresh OpenPGP keys

  package { ['dbus-x11', 'parcimonie']:
    ensure          => present,
    install_options => [ '--no-install-recommends' ],
  }

  file { '/etc/systemd/system/parcimonie-reprepro.service':
    ensure  => present,
    owner   => root,
    group   => root,
    mode    => '0644',
    require => Package['dbus-x11', 'parcimonie'],
    content => "[Unit]
Description=Refresh reprepro's GnuPG keyring

[Service]
Type=simple
ExecStart=/usr/bin/dbus-launch /usr/bin/parcimonie --verbose
User=reprepro

[Install]
WantedBy=multi-user.target
",
  }

  service { 'parcimonie-reprepro.service':
    ensure    => running,
    enable    => true,
    provider  => systemd,
    require   => File['/etc/systemd/system/parcimonie-reprepro.service'],
    subscribe => File['/etc/systemd/system/parcimonie-reprepro.service'],
  }

intrigeri's avatar
intrigeri committed
172
}