setup.yaml

global @once:
  labsconsole:
    - location: 'https://wikitech.wikimedia.org/wiki/Special:NovaServiceGroup'
    - project: cvn
    - add-service-group:
      - cvnservice (local-cvnservice; cvn.cvnservice)
  setup: |
      ssh cvn-{name}.eqiad.wmflabs
      umask 0002
      #
      ## Prepare directory structure on on NFS
      #
      cd /data/project
      sudo mkdir cvn-common
      sudo chgrp project-cvn cvn-common/
      sudo chmod 2775 cvn-common/
      mkdir cvn-common/backup/ cvn-common/dropbox/

node @each:
  # sudo apt-get install ..
  - packages:
    - git
    - nano
    - vim
  # Remember:
  # * /data/project is an NFS mount shared between all servers.
  # * /srv is local to the individual server.
  - setup: |
      $ ssh cvn-X.cvn.eqiad.wmflabs
      #
      ## Create local directory structure
      #
      cd /srv
      sudo mkdir cvn
      sudo chgrp project-cvn cvn/
      sudo chmod 2775 cvn/
      mkdir cvn/git/ cvn/services/ cvn/log/
      sudo chgrp cvn.cvnservice cvn/services
      #
      ## Add repos
      #
      cd /srv/cvn/git
      git clone https://github.com/countervandalism/infrastructure.git
      git clone https://github.com/countervandalism/stillalive.git
      #
      ## Configure profile.d
      #
      cd /etc/profile.d/
      sudo ln -s /srv/cvn/git/infrastructure/environment-config/profile-d-umask-cvn.sh umask-cvn.sh
      #
      ## Configure stillalive
      #
      cd /srv/cvn/git/stillalive
      ln -s localSettings-cvn.yaml localSettings.yaml
      #
      ## File permissions
      #
      sudo chown root /srv/cvn/git/infrastructure/crontab-config/*.cron
      sudo chmod 644 /srv/cvn/git/infrastructure/crontab-config/*.cron
      sudo chown root /srv/cvn/git/infrastructure/bin/backup-wmflabs-node
      sudo chown root /srv/cvn/git/infrastructure/bin/cvndb-CVNBot14-publish
      sudo chown root /srv/cvn/git/infrastructure/bin/cvndb-pull

node [type=webserver]:
  - services:
    - www

node [type=appserver]:
  - services:
    - stillalive
    - CVNBot
  - setup: |
      #
      ## Back up data via hourly cron
      #
      sudo ln -s /srv/cvn/git/infrastructure/bin/backup-wmflabs-node /etc/cron.hourly/cvn-backup-data

node cvn-app8:
  - setup: |
      # Add cron
      sudo ln -s /srv/cvn/git/infrastructure/crontab-config/cvndb-CVNBot14-publish.cron /etc/cron.d/cvndb-CVNBot14-publish

node cvn-app9:
  - services:
    - CVNClerkBot

service stillalive:
  - packages:
    - php7.0-cli
    - php7.0-mbstring # used by ulrichsg/getopt-php
  - setup: |
      # Add cron
      sudo ln -s /srv/cvn/git/infrastructure/crontab-config/stillalive.cron /etc/cron.d/stillalive

service www:
  - packages:
    - apache2
    - libapache2-mod-php7.0
    - php-apcu
    - php-apcu-bc
    - php7.0-cli
    - php7.0-curl
    - php7.0-mysql
    - php7.0-sqlite3
  - setup: |
    #
    ## Add repos
    #
    cd /srv/cvn/git
    git clone https://github.com/countervandalism/cvn-api.git
    #
    ## Create document root
    #
    ln -s /srv/cvn/git/infrastructure/cvn-docroot /srv/cvn/services/www
    ln -s /srv/cvn/git/cvn-api/public_html/api.php /srv/cvn/services/www/api.php
    #
    ## Setup cvn-api
    #
    sudo ln -s /srv/cvn/git/infrastructure/crontab-config/cvndb-pull.cron /etc/cron.d/cvndb-pull
    #
    ## Configure PHP
    #
    sudo ln -s /srv/cvn/git/infrastructure/php-cvn.ini /etc/php/7.0/mods-available/cvn.ini
    sudo ln -s /etc/php/7.0/mods-available/cvn.ini /etc/php/7.0/apache2/conf.d/50-cvn.ini
    #
    ## Configure webserver
    #
    sudo ln -s /srv/cvn/git/infrastructure/apache-config/cvn.conf /etc/apache2/sites-available/cvn.conf
    sudo ln -s /etc/apache2/sites-available/cvn.conf /etc/apache2/sites-enabled/100-cvn.conf
    sudo apachectl graceful

service CVNBot:
  # Wikimedia Foundation projects require TLS 1.2 which
  # Mono 4.6 (Debian 9 Stretch default) does not support.
  # https://github.com/countervandalism/CVNBot/issues/46
  # Install latest Mono (5.16) from Mono's official repository instead.
  - packages: |
    # https://www.mono-project.com/download/stable/#download-lin-debian
    sudo apt install apt-transport-https dirmngr
    sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 3FA7E0328081BFF6A14DA29AA6A19B38D3D831EF
    echo "deb https://download.mono-project.com/repo/debian stable-stretch main" | sudo tee /etc/apt/sources.list.d/mono-official-stable.list
    sudo apt update
    # Packages we need
    sudo apt-get install mono-complete
    sudo apt-get install ca-certificates-mono
  - setup: |
    #
    ## Add repos
    #
    cd /srv/cvn/git
    git clone https://github.com/countervandalism/CVNBot.git
    cd /srv/cvn/services
    mkdir cvnbot
    #
    ## Import SSL certificates
    #
    # http://stackoverflow.com/a/11451213/319266
    # http://www.mono-project.com/docs/faq/security/
    # https://github.com/duplicati/duplicati/wiki/SSL-TLS-support-in-Mono#generic-debian--ubuntu
    #
    sudo -iu cvn.cvnservice mozroots --import --sync
    sudo mozroots --import --ask-remove --sync
    sudo cert-sync /etc/ssl/certs/ca-certificates.crt

service CVNClerkBot:
  # https://github.com/countervandalism/CVNClerkBot
  - packages:
    - python # version 2.7
    - mysql-client
    - mysql-server
    - python-mysqldb
    - python-twisted
  - prepare:
    - database:
      - shell: |
        mysql -u root -proot -e 'CREATE DATABASE cvnclerkbot;'
  - backup:
    - database:
      - shell: |
        mysqldump cvnclerkbot -u root -proot --extended-insert=FALSE > ~/mysql_cvnclerkbot.sql
  - restore:
    - database:
      - shell: |
        mysql -u root -proot cvnclerkbot < /srv/cvn/git/infrastructure/mysql_cvnclerkbot.sql
  - setup: |
    #
    ## Add repos
    #
    cd /srv/cvn/git
    git clone https://github.com/countervandalism/CVNClerkBot.git
    #
    ## Configure CVNClerkBot
    #
    cp /srv/cvn/git/infrastructure/clerkbotconfig.py CVNClerkBot/cvnclerkbotconfig.py
    # edit 'password' in CVNClerkBot/cvnclerkbotconfig.py
    #
    # Run the steps of 'prepare.database'