Fulcrum demo

.gitignore

@@ -24,3 +24,4 @@
 .DS_Store
 /modules/
 Puppetfile.lock
+.tool-versions

manifests/profile/fulcrum/fedora.pp

@@ -8,46 +8,59 @@
   String $fedora_username = 'fedora',
   String $fedora_password = lookup('nebula::profile::fulcrum::mysql::fedora_password'),
 ) {
+  $jdk_version = lookup('nebula::jdk_version')
+  # used in erb file
+  $java_home = "/usr/lib/jvm/temurin-${jdk_version}-jre-amd64"
+
+  nebula::usergroup { 'fulcrum': }
+
   ensure_packages([
-    'tomcat8-user',
+    'tomcat9-user',
+    "temurin-${jdk_version}-jre",
   ])
 
   file { '/etc/sudoers.d/fedora':
     content => template('nebula/profile/fulcrum/sudoers-fedora.erb'),
   }
 
-  file {
-    ['/var/lib/fedora', '/var/log/fedora', '/opt/fedora', '/tmp/fedora']:
-      ensure => directory,
-      owner  => 'fulcrum',
-      group  => 'fulcrum',
-    ;
-  }
-
   exec { 'create fedora tomcat':
-    command => '/usr/bin/tomcat8-instance-create fedora',
+    command => '/usr/bin/tomcat9-instance-create fedora',
     cwd     => '/opt',
-    user    => 'fulcrum',
     creates => '/opt/fedora',
+    user    => 'fulcrum',
     require => [
-      User['fulcrum'],
-      Package['tomcat8-user'],
+      Package['tomcat9-user'],
     ],
   }
 
+  file {
+    ['/var/lib/fedora', '/var/log/fedora', '/opt/fedora', '/tmp/fedora']:
+      ensure  => directory,
+      owner   => 'fulcrum',
+      group   => 'fulcrum',
+      require => Exec['create fedora tomcat'],
+    ;
+  }
+
+  exec { 'chown -r /opt/fedora':
+    command => '/usr/bin/chown -R fulcrum:fulcrum /opt/fedora',
+    require => Exec['create fedora tomcat'],
+  }
+
   file { '/opt/fedora/logs':
     ensure  => 'symlink',
     owner   => 'fulcrum',
     group   => 'fulcrum',
+    force   => true,
     target  => '/var/log/fedora',
     require => Exec['create fedora tomcat'],
   }
 
   archive { '/opt/fedora/webapps/fedora.war':
     ensure        => present,
     extract       => false,
-    source        => 'https://github.com/fcrepo/fcrepo/releases/download/fcrepo-4.7.4/fcrepo-webapp-4.7.4.war',
-    checksum      => '11e06c843f40cf2b9f26bda94ddfe6d85d69a591',
+    source        => 'https://github.com/fcrepo/fcrepo/releases/download/fcrepo-4.7.6/fcrepo-webapp-4.7.6.war',
+    checksum      => '5882d8a4dc8b3817374503dff2043be79d9bbd72',
     checksum_type => 'sha1',
     cleanup       => false,
     user          => 'fulcrum',
@@ -81,7 +94,7 @@
       File['/etc/systemd/system/fedora.service'],
       File['/var/lib/fedora'],
       Archive['/opt/fedora/webapps/fedora.war'],
-      Mysql::Db['fedora'],
+      Service['mysqld'],
     ],
   }
 }

manifests/profile/fulcrum/hosts.pp

@@ -6,6 +6,7 @@
 class nebula::profile::fulcrum::hosts (
   $fedora = '127.0.0.1',
   $mysql = '127.0.0.1',
+  $keycard = '127.0.0.1',
   $redis = '127.0.0.1',
   $solr = '127.0.0.1',
 ) {
@@ -17,6 +18,10 @@
     ip => $mysql,
   }
 
+  host { 'keycard':
+    ip => $keycard,
+  }
+
   host { 'redis':
     ip => $redis,
   }

manifests/profile/fulcrum/mysql.pp

@@ -7,32 +7,52 @@
 class nebula::profile::fulcrum::mysql (
   String $fedora_password,
   String $fulcrum_password,
-  String $checkpoint_password,
   String $shibd_password,
+  String $root_password,
 ) {
-  include nebula::profile::mysql
 
-  mysql::db { 'fedora':
-    user     => 'fedora',
-    password => $fedora_password,
-    host     => 'localhost',
+  # Install and configure mysql server
+  ensure_packages(['mariadb-common','mariadb-server', 'mariadb-client'])
+
+# at some point need to do equivalent to `mysql_install_db --user=mysql --ldata=/var/lib/mysql`
+
+  service { 'mysqld':
+    ensure  => running,
+    enable  => true,
+    require => Package['mariadb-server'],
+  }
+
+  file { '/etc/mysql/conf.d':
+    ensure => 'directory'
   }
 
-  mysql::db { 'fulcrum':
-    user     => 'fulcrum',
-    password => $fulcrum_password,
-    host     => 'localhost',
+  file { '/etc/mysql/my.cnf':
+    owner   => 'mysql',
+    group   => 'mysql',
+    content => template('nebula/mysql/my.cnf.erb'),
+    notify  => Service['mysqld'],
+    require => Package['mariadb-server'],
   }
 
-  mysql::db { 'checkpoint':
-    user     => 'checkpoint',
-    password => $checkpoint_password,
-    host     => 'localhost',
+  exec { 'set-mysql-password':
+    unless  => "mysqladmin -uroot -p${root_password} status",
+    path    => ['/bin', '/usr/bin'],
+    command => "mysqladmin -uroot password ${root_password}",
+    require => Service['mysqld'],
   }
 
-  mysql::db { 'shibd':
-    user     => 'shibd',
-    password => $shibd_password,
-    host     => 'localhost',
+  $dbs = [['fedora', 'fedora', $fedora_password], ['fulcrum', 'fulcrum', $fulcrum_password],
+  ['checkpoint', 'fulcrum', $fulcrum_password], ['shibd', 'shibd', $shibd_password]]
+
+  $dbs.each |$db| {
+    $name = $db[0]
+    $user = $db[1]
+    $password = $db[2]
+    exec { "create-${name}-db":
+      unless  => "/usr/bin/mysql -u${user} -p${password} ${name}",
+      command => "/usr/bin/mysql -uroot -p${root_password} -e \"create database ${name}; grant all on ${name}.* to ${user}@localhost identified by '${password}';\"",
+      require => Service['mysqld'],
+    }
   }
+
 }

manifests/profile/fulcrum/nginx.pp

@@ -197,6 +197,6 @@
     proto  => 'tcp',
     dport  => 443,
     state  => 'NEW',
-    jump   => 'accept',
+    action => 'accept',
   }
 }

manifests/profile/fulcrum/perl.pp

@@ -0,0 +1,37 @@
+# The perl profile is needed for monitor_pl to work, but it pulls in a
+# ton of stuff. We should probably allow for different haproxy http checks
+# for a service, and eliminate the perl/monitor_pl dependency here.
+
+class nebula::profile::fulcrum::perl (
+  Hash $hosts = {}
+) {
+
+  include nebula::profile::www_lib::perl
+
+  create_resources('host',$hosts)
+
+  include nebula::profile::www_lib::apache::base
+  include nebula::profile::www_lib::apache::fulcrum
+
+  cron {
+    default:
+      user => 'root',
+    ;
+
+    'purge apache access logs 1/2':
+      hour    => 1,
+      minute  => 7,
+      command => '/usr/bin/find /var/log/apache2 -type f -mtime +14 -name "*log*" -exec /bin/rm {} \; > /dev/null 2>&1',
+    ;
+
+    'purge apache access logs 2/2':
+      hour    => 1,
+      minute  => 17,
+      command => '/usr/bin/find /var/log/apache2 -type f -mtime +2  -name "*log*" ! -name "*log*gz" -exec /usr/bin/pigz {} \; > /dev/null 2>&1',
+      require => Package['pigz'],
+    ;
+  }
+
+  ensure_packages(['pigz'])
+
+}

manifests/profile/fulcrum/shibboleth.pp

@@ -7,9 +7,9 @@
 class nebula::profile::fulcrum::shibboleth {
   ensure_packages([
     'unixodbc',
-    'shibboleth-sp2-common',
-    'shibboleth-sp2-utils',
-    'mariadb-unixodbc',
+    'shibboleth-sp-common',
+    'shibboleth-sp-utils',
+    'odbc-mariadb',
   ])
 
   file { '/etc/odbcinst.ini':
@@ -52,7 +52,7 @@
     ensure     => 'running',
     enable     => true,
     hasrestart => true,
-    require    => [Package['shibboleth-sp2-utils'], Package['mariadb-unixodbc']]
+    require    => [Package['shibboleth-sp-utils'], Package['odbc-mariadb']]
   }
 
   service { 'shibauthorizer.socket':

manifests/profile/fulcrum/solr.pp

@@ -4,11 +4,75 @@
 
 # nebula::profile::fulcrum::solr
 
-class nebula::profile::fulcrum::solr {
-  class { 'nebula::profile::solr':
-    base => '/var/lib/solr',
-    home => '/var/lib/solr/data',
-    logs => '/var/log/solr',
+class nebula::profile::fulcrum::solr (
+  String $base = '/var/lib/solr',
+  String $home = "${base}/home",
+  String $logs = "${base}/logs",
+  String $log4j_properties = "${base}/log4j.properties",
+  String $solr_in_sh = "${base}/solr.in.sh",
+  String $solr_xml = "${home}/solr.xml",
+  String $jdk_version = '8',
+  String $solr_home = '/var/lib/solr',
+  String $java_home = "/usr/lib/jvm/temurin-${jdk_version}-jre-${::os['architecture']}",
+  String $heap = '16G',
+  String $timezone = 'America/Detroit',
+  String $solr_bin = '/opt/solr/bin/solr',
+){
+
+  ensure_packages([
+    "temurin-${jdk_version}-jre",
+    'solr',
+    'lsof',
+  ])
+
+  nebula::usergroup { 'solr': }
+
+  file {
+    default:
+      owner => 'solr',
+      group => 'solr',
+    ;
+    [$base, $home, $logs]:
+      ensure => 'directory',
+      mode   => '0750',
+    ;
+    $log4j_properties:
+      ensure  => 'file',
+      mode    => '0644',
+      content => template('nebula/profile/fulcrum/solr/log4j.properties.erb'),
+    ;
+    $solr_in_sh:
+      ensure  => 'file',
+      mode    => '0644',
+      content => template('nebula/profile/fulcrum/solr/solr.in.sh.erb'),
+    ;
+    $solr_xml:
+      ensure  => 'file',
+      mode    => '0644',
+      content => template('nebula/profile/fulcrum/solr/solr.xml.erb'),
+    ;
+  }
+  file { '/etc/systemd/system/solr.service':
+    owner   => 'root',
+    group   => 'root',
+    content => template('nebula/profile/fulcrum/solr/solr.service.erb'),
+  }
+  service { 'solr':
+    ensure  => 'running',
+    enable  => true,
+    require => [Package['solr'], File['/etc/systemd/system/solr.service']],
+  }
+
+  class { 'nebula::profile::openjdk_java':
+    jdk_packages     => ["temurin-${jdk_version}-jre"],
+    default_jdk      => "temurin-${jdk_version}-jre",
+    base_alternative => $java_home,
+    java_alternative => "temurin-${jdk_version}-jre-amd64",
+  }
+
+  file { '/etc/environment':
+      content => inline_template("JAVA_HOME=${java_home}")
+      ;
   }
 
   file {

manifests/profile/kubernetes/haproxy.pp

@@ -50,9 +50,9 @@
 
   firewall {
     default:
-      proto  => 'tcp',
-      state  => 'NEW',
-      jump   => 'accept',
+      proto => 'tcp',
+      state => 'NEW',
+      jump  => 'accept',
     ;
 
     '200 private api':

manifests/profile/letsencrypt.pp

@@ -19,9 +19,9 @@
   }
 
   firewall { '200 HTTP':
-    proto  => 'tcp',
-    dport  => 80,
-    state  => 'NEW',
-    jump   => 'accept',
+    proto => 'tcp',
+    dport => 80,
+    state => 'NEW',
+    jump  => 'accept',
   }
 }

manifests/profile/networking/firewall.pp

@@ -152,9 +152,9 @@
 
   # Default IPv4 items, sorted by title
   firewall { '001 accept related established rules':
-    proto  => 'all',
-    state  => ['RELATED', 'ESTABLISHED'],
-    jump   => 'accept',
+    proto => 'all',
+    state => ['RELATED', 'ESTABLISHED'],
+    jump  => 'accept',
   }
 
   firewall { '001 accept all to lo interface':

manifests/profile/prometheus.pp

@@ -173,10 +173,10 @@
       },
     }
     firewall { '200 HTTPS: Client Cert':
-      proto  => 'tcp',
-      dport  => [443],
-      state  => 'NEW',
-      jump   => 'accept',
+      proto => 'tcp',
+      dport => [443],
+      state => 'NEW',
+      jump  => 'accept',
     }
   }
 

manifests/profile/solr.pp

@@ -22,7 +22,7 @@
   ensure_packages(["openjdk-${jdk_version}-jre-headless",'solr','lsof'])
 
   # Note: Along with variables above these are used in erb files also.
-  $java_home = "/usr/lib/jvm/java-${jdk_version}-openjdk-amd64/jre"
+  $java_home = "/usr/lib/jvm/java-${jdk_version}-openjdk-amd64"
   $solr_bin = '/opt/solr/bin/solr'
 
   nebula::usergroup { 'solr': }