custom.pp 7.08 KB
Newer Older
intrigeri's avatar
intrigeri committed
1
# Manage Tails custom APT repository
2
class tails::reprepro::custom (
3 4 5
  Stdlib::Absolutepath $basedir = '/srv/reprepro',
  String $email_recipient       = 'root',
  Array[String] $uploaders      = [
intrigeri's avatar
intrigeri committed
6
    'C92949B8A63BB098+',
intrigeri's avatar
intrigeri committed
7 8
    '1D84CCF010CC5BC7',
    '91F73701D9C99DC9',
9
    'A3B04CAE97F0FA3E',
10
    '9E2DA89E55D2257C',
11
    'E3ADB00850605636',
intrigeri's avatar
intrigeri committed
12
  ],
13 14 15
  String $origin                = 'Tails',
  Stdlib::Fqdn $web_hostname    = 'deb.tails.boum.org',
  String $onion_hostname        = '',
16
  Stdlib::Port $web_port        = 80,
17
  String $git_remote            = 'https://git-tails.immerda.ch/tails'
18
) {
intrigeri's avatar
intrigeri committed
19

20 21 22
  ### Sanity checks

  if !defined(Class['::nginx']) {
23
    fail('Depends on the nginx class')
24 25
  }

26 27 28 29
  if !defined(Class['::reprepro']) {
    fail('Depends on the reprepro class')
  }

intrigeri's avatar
intrigeri committed
30 31
  if !defined(Class['::tails_secrets_apt']) {
    fail('Depends on the tails_secrets_apt class')
32 33
  }

intrigeri's avatar
intrigeri committed
34
  ### Class variables
intrigeri's avatar
intrigeri committed
35 36

  $git_repo = "${basedir}/tails.git"
intrigeri's avatar
intrigeri committed
37
  $shell_lib = '/usr/local/share/tails-reprepro/functions.sh'
intrigeri's avatar
intrigeri committed
38

intrigeri's avatar
intrigeri committed
39 40
  ### Resources

41
  reprepro::repository { 'tails':
intrigeri's avatar
intrigeri committed
42 43 44 45 46
    uploaders                    => $uploaders,
    basedir                      => $basedir,
    origin                       => $origin,
    basedir_mode                 => '0751',
    incoming_mode                => '1775',
47 48 49
    manage_distributions_conf    => false,
    manage_incoming_conf         => false,
    handle_incoming_with_inotify => true,
50
    index_template               => 'tails/reprepro/index.html.erb',
51 52
  }

53
  ensure_packages(['git', 'moreutils'])
intrigeri's avatar
intrigeri committed
54 55

  file {
intrigeri's avatar
misc  
intrigeri committed
56 57 58

    '/usr/local/share/tails-reprepro':
      ensure => directory,
intrigeri's avatar
Lint.  
intrigeri committed
59 60 61
      mode   => '0755',
      owner  => root,
      group  => reprepro;
intrigeri's avatar
misc  
intrigeri committed
62

intrigeri's avatar
intrigeri committed
63
    $shell_lib:
intrigeri's avatar
Lint.  
intrigeri committed
64 65 66
      mode    => '0644',
      owner   => root,
      group   => reprepro,
67
      source  => 'puppet:///modules/tails/reprepro/custom/functions.sh',
intrigeri's avatar
misc  
intrigeri committed
68 69
      require => File['/usr/local/share/tails-reprepro'];

70
    '/usr/local/bin/tails-diff-suites':
71
      source  => 'puppet:///modules/tails/reprepro/custom/tails-diff-suites',
72
      require => File[$shell_lib],
intrigeri's avatar
Lint.  
intrigeri committed
73 74 75
      mode    => '0755',
      owner   => root,
      group   => root;
76

77
    '/usr/local/bin/tails-merge-suite':
78
      source  => 'puppet:///modules/tails/reprepro/custom/tails-merge-suite',
intrigeri's avatar
intrigeri committed
79
      require => File[$shell_lib],
intrigeri's avatar
Lint.  
intrigeri committed
80 81 82
      mode    => '0755',
      owner   => root,
      group   => root;
83

intrigeri's avatar
misc  
intrigeri committed
84
    '/usr/local/bin/tails-suites-list':
85
      source  => 'puppet:///modules/tails/reprepro/custom/tails-suites-list',
intrigeri's avatar
intrigeri committed
86
      require => File[$shell_lib],
intrigeri's avatar
Lint.  
intrigeri committed
87 88 89
      mode    => '0755',
      owner   => root,
      group   => root;
intrigeri's avatar
misc  
intrigeri committed
90 91

    '/usr/local/bin/tails-suites-to-distributions':
92
      source => 'puppet:///modules/tails/reprepro/custom/tails-suites-to-distributions',
intrigeri's avatar
Lint.  
intrigeri committed
93 94 95
      mode   => '0755',
      owner  => root,
      group  => root;
intrigeri's avatar
misc  
intrigeri committed
96 97

    '/usr/local/bin/tails-suites-to-incoming':
98
      source => 'puppet:///modules/tails/reprepro/custom/tails-suites-to-incoming',
intrigeri's avatar
Lint.  
intrigeri committed
99 100 101
      mode   => '0755',
      owner  => root,
      group  => root;
intrigeri's avatar
misc  
intrigeri committed
102 103

    '/usr/local/bin/tails-update-reprepro-config':
104
      source  => 'puppet:///modules/tails/reprepro/custom/tails-update-reprepro-config',
intrigeri's avatar
misc  
intrigeri committed
105
      require => [
intrigeri's avatar
intrigeri committed
106
        Exec['tails-reprepro-git-clone'],
intrigeri's avatar
intrigeri committed
107
        File[$shell_lib],
intrigeri's avatar
intrigeri committed
108 109 110 111 112
        File['/usr/local/bin/tails-suites-list'],
        File['/usr/local/bin/tails-suites-to-distributions'],
        File['/usr/local/bin/tails-suites-to-incoming'],
        Package['moreutils'],
      ],
intrigeri's avatar
Lint.  
intrigeri committed
113 114 115
      mode    => '0755',
      owner   => root,
      group   => root;
intrigeri's avatar
misc  
intrigeri committed
116

intrigeri's avatar
intrigeri committed
117
    "${basedir}/conf/deny_all_uploaders":
intrigeri's avatar
Lint.  
intrigeri committed
118 119 120
      mode    => '0660',
      owner   => root,
      group   => reprepro,
intrigeri's avatar
misc  
intrigeri committed
121
      content => '',
intrigeri's avatar
intrigeri committed
122
      require => File["${basedir}/conf"];
intrigeri's avatar
misc  
intrigeri committed
123

intrigeri's avatar
intrigeri committed
124 125
  }

intrigeri's avatar
misc  
intrigeri committed
126
  cron { 'tails-update-reprepro-config':
127 128 129 130 131
    user        => 'reprepro',
    minute      => '*',
    command     => "flock -n /var/lock/tails-update-reprepro-config /usr/local/bin/tails-update-reprepro-config '${git_repo}' '${origin}' '${basedir}'", # lint:ignore:140chars -- command
    require     => File['/usr/local/bin/tails-update-reprepro-config'],
    environment => [ "MAILTO=${email_recipient}" ],
intrigeri's avatar
intrigeri committed
132 133
  }

134 135 136
  # Can't use vcsrepo, that doesn't support --mirror before
  # https://github.com/puppetlabs/puppetlabs-vcsrepo/commit/b8f25cea95317a4b2a622e2799f1aa7ba159bdca
  # that is not part of an upstream release as of 20160523
intrigeri's avatar
intrigeri committed
137
  exec { 'tails-reprepro-git-clone':
intrigeri's avatar
misc  
intrigeri committed
138 139
    user    => reprepro,
    group   => reprepro,
intrigeri's avatar
intrigeri committed
140
    cwd     => $basedir,
intrigeri's avatar
intrigeri committed
141
    command => "git clone --bare --mirror '${git_remote}' '${git_repo}' && chmod -R g+rX '${git_repo}'",
intrigeri's avatar
intrigeri committed
142 143 144 145
    creates => "${git_repo}/config",
    require => Package['git'],
    timeout => -1,
  }
intrigeri's avatar
misc  
intrigeri committed
146

147 148 149 150 151 152 153 154
  exec { 'tails-reprepro-import-keys':
    user        => reprepro,
    group       => reprepro,
    command     => "gpg --homedir '${basedir}/.gnupg' --batch --quiet --import '${tails_secrets_apt::keys}'",
    subscribe   => File[$tails_secrets_apt::keys],
    refreshonly => true,
    notify      => Exec["/usr/local/bin/reprepro-export-key '${basedir}'"],
    require     => Mount[$tails_secrets_apt::gnupg_homedir],
intrigeri's avatar
misc  
intrigeri committed
155 156
  }

intrigeri's avatar
intrigeri committed
157 158
  mailalias { 'reprepro': ensure => present, recipient => ['root']; }

159
  class { '::tails::reprepro::custom::nginx':
intrigeri's avatar
intrigeri committed
160
    hostname      => $web_hostname,
161 162
    basedir       => $basedir,
    vhost_content => template('tails/reprepro/custom/nginx/site.erb'),
163 164
  }

165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194
  # Refresh OpenPGP keys

  package { ['dbus-x11', 'parcimonie']:
    ensure          => present,
    install_options => [ '--no-install-recommends' ],
  }

  file { '/etc/systemd/system/parcimonie-reprepro.service':
    ensure  => present,
    owner   => root,
    group   => root,
    mode    => '0644',
    require => Package['dbus-x11', 'parcimonie'],
    content => "[Unit]
Description=Refresh reprepro's GnuPG keyring

[Service]
Type=simple
ExecStart=/usr/bin/dbus-launch /usr/bin/parcimonie --verbose
User=reprepro

[Install]
WantedBy=multi-user.target
",
  }

  service { 'parcimonie-reprepro.service':
    ensure    => running,
    enable    => true,
    provider  => systemd,
195 196 197 198
    require   => [
      File['/etc/systemd/system/parcimonie-reprepro.service'],
      File_line['set_onion_keyserver_in_dirmngr'],
    ],
199 200 201
    subscribe => File['/etc/systemd/system/parcimonie-reprepro.service'],
  }

202 203 204 205 206 207 208 209 210 211 212 213 214 215
  # Fix parcimonie in Stretch (see debian bug #898085)
  file { '/srv/reprepro/.gnupg/dirmngr.conf':
    ensure => present,
    owner  => reprepro,
    group  => reprepro,
    mode   => '0644',
  }

  file_line { 'set_onion_keyserver_in_dirmngr':
    path => '/srv/reprepro/.gnupg/dirmngr.conf',
    line => 'keyserver hkp://jirk5u4osbsr34t5.onion',
  }

  exec { 'shutdown_reprepro_dirmngr':
216 217 218 219
    user        => reprepro,
    command     => 'dirmngr --shutdown',
    subscribe   => File_line['set_onion_keyserver_in_dirmngr'],
    refreshonly => true,
220 221
  }

222 223 224 225 226 227 228
  # Make sure the exported public key is up-to-date
  cron { 'tails-reprepro-export-key':
    user    => reprepro,
    minute  => 17,
    command => "/usr/local/bin/reprepro-export-key '${basedir}'",
    require => Reprepro::Repository['tails'],
  }
229 230 231

  class { '::tails::reprepro::custom::notify_incoming':
    ensure           => present,
232
    mail_to          => $email_recipient,
233
    mail_from        => 'reprepro@lizard.tails.boum.org',
234 235
    reprepro_basedir => $basedir,
  }
intrigeri's avatar
intrigeri committed
236
}