BryanDavis has uploaded a new change for review.
https://gerrit.wikimedia.org/r/193665
Change subject: [WIP] Add role::mediawiki_vagrant_lxc
......................................................................
[WIP] Add role::mediawiki_vagrant_lxc
Add a role and modules to provision and configure Vagrant to manage an LXC
container to run as a MediaWiki-Vagrant instance.
Marked as work in progress because it contains some nasty hacks for installing
the latest version of Vagrant.
Change-Id: I04cfa3d143cad92b2be57d3813f0b09ecfb45bf5
---
A manifests/role/mediawiki_vagrant_lxc.pp
A modules/vagrant/files/lxc/container-base
A modules/vagrant/manifests/init.pp
A modules/vagrant/manifests/lxc.pp
A modules/vagrant/manifests/mediawiki.pp
A modules/vagrant/templates/mwvagrant.erb
6 files changed, 339 insertions(+), 0 deletions(-)
git pull ssh://gerrit.wikimedia.org:29418/operations/puppet
refs/changes/65/193665/1
diff --git a/manifests/role/mediawiki_vagrant_lxc.pp
b/manifests/role/mediawiki_vagrant_lxc.pp
new file mode 100644
index 0000000..98bfa49
--- /dev/null
+++ b/manifests/role/mediawiki_vagrant_lxc.pp
@@ -0,0 +1,12 @@
+# Provision LXC, Vagrant and MediaWiki-Vagrant
+#
+# Install Linux Containers (LXC) and Vagarnt along wth helper programs and
+# provision a MediaWiki-Vagrant clone for shared use.
+#
+# Conflicts with role::labs_vagrant.
+class role::mediawiki_vagrant_lxc {
+ require ::role::labs::lvm::srv
+ include ::vagrant
+ include ::vagrant::lxc
+ include ::vagrant::mediawiki
+}
diff --git a/modules/vagrant/files/lxc/container-base
b/modules/vagrant/files/lxc/container-base
new file mode 100644
index 0000000..c16f742
--- /dev/null
+++ b/modules/vagrant/files/lxc/container-base
@@ -0,0 +1,170 @@
+ network,
+ capability,
+ file,
+ umount,
+
+ # dbus, signal, ptrace and unix are only supported by recent apparmor
+ # versions. Comment them if the apparmor parser doesn't recognize them.
+
+ # This also needs additional rules to reach outside of the container via
+ # DBus, so just let all of DBus within the container.
+ dbus,
+
+ # Allow us to receive signals from anywhere. Note: if per-container profiles
+ # are supported, for container isolation this should be changed to something
+ # like:
+ # signal (receive) peer=unconfined,
+ # signal (receive) peer=/usr/bin/lxc-start,
+ signal (receive),
+
+ # Allow us to send signals to ourselves
+ signal peer=@{profile_name},
+
+ # Allow other processes to read our /proc entries, futexes, perf tracing and
+ # kcmp for now (they will need 'read' in the first place). Administrators can
+ # override with:
+ # deny ptrace (readby) ...
+ ptrace (readby),
+
+ # Allow other processes to trace us by default (they will need 'trace' in
+ # the first place). Administrators can override with:
+ # deny ptrace (tracedby) ...
+ ptrace (tracedby),
+
+ # Allow us to ptrace ourselves
+ ptrace peer=@{profile_name},
+
+ # Allow receive via unix sockets from anywhere. Note: if per-container
+ # profiles are supported, for container isolation this should be changed to
+ # something like:
+ # unix (receive) peer=(label=unconfined),
+ #unix (receive),
+
+ # Allow all unix in the container
+ #unix peer=(label=@{profile_name}),
+
+ # ignore DENIED message on / remount
+ deny mount options=(ro, remount) -> /,
+ deny mount options=(ro, remount, silent) -> /,
+
+ # allow tmpfs mounts everywhere
+ mount fstype=tmpfs,
+
+ # allow hugetlbfs mounts everywhere
+ mount fstype=hugetlbfs,
+
+ # allow mqueue mounts everywhere
+ mount fstype=mqueue,
+
+ # allow fuse mounts everywhere
+ mount fstype=fuse.*,
+
+ # allow NFS
+ # http://bridge.grumpy-troll.org/2014/03/lxc-routed-on-ubuntu/
+ mount fstype=nfs,
+ mount fstype=nfs4,
+ mount fstype=rpc_pipefs,
+
+ # allow bind mount of /lib/init/fstab for lxcguest
+ mount options=(rw, bind) /lib/init/fstab.lxc/ -> /lib/init/fstab/,
+
+ # deny writes in /proc/sys/fs but allow binfmt_misc to be mounted
+ mount fstype=binfmt_misc -> /proc/sys/fs/binfmt_misc/,
+ deny @{PROC}/sys/fs/** wklx,
+
+ # allow efivars to be mounted, writing to it will be blocked though
+ mount fstype=efivarfs -> /sys/firmware/efi/efivars/,
+
+ # block some other dangerous paths
+ deny @{PROC}/sysrq-trigger rwklx,
+ deny @{PROC}/mem rwklx,
+ deny @{PROC}/kmem rwklx,
+
+ # deny writes in /sys except for /sys/fs/cgroup, also allow
+ # fusectl, securityfs and debugfs to be mounted there (read-only)
+ mount fstype=fusectl -> /sys/fs/fuse/connections/,
+ mount fstype=securityfs -> /sys/kernel/security/,
+ mount fstype=debugfs -> /sys/kernel/debug/,
+ deny mount fstype=debugfs -> /var/lib/ureadahead/debugfs/,
+ mount fstype=proc -> /proc/,
+ mount fstype=sysfs -> /sys/,
+ deny /sys/firmware/efi/efivars/** rwklx,
+ deny /sys/kernel/security/** rwklx,
+ mount options=(move) /sys/fs/cgroup/cgmanager/ ->
/sys/fs/cgroup/cgmanager.lower/,
+
+ # generated by: lxc-generate-aa-rules.py container-rules.base
+ deny /proc/sys/[^kn]*{,/**} wklx,
+ deny /proc/sys/k[^e]*{,/**} wklx,
+ deny /proc/sys/ke[^r]*{,/**} wklx,
+ deny /proc/sys/ker[^n]*{,/**} wklx,
+ deny /proc/sys/kern[^e]*{,/**} wklx,
+ deny /proc/sys/kerne[^l]*{,/**} wklx,
+ deny /proc/sys/kernel/[^smhd]*{,/**} wklx,
+ deny /proc/sys/kernel/d[^o]*{,/**} wklx,
+ deny /proc/sys/kernel/do[^m]*{,/**} wklx,
+ deny /proc/sys/kernel/dom[^a]*{,/**} wklx,
+ deny /proc/sys/kernel/doma[^i]*{,/**} wklx,
+ deny /proc/sys/kernel/domai[^n]*{,/**} wklx,
+ deny /proc/sys/kernel/domain[^n]*{,/**} wklx,
+ deny /proc/sys/kernel/domainn[^a]*{,/**} wklx,
+ deny /proc/sys/kernel/domainna[^m]*{,/**} wklx,
+ deny /proc/sys/kernel/domainnam[^e]*{,/**} wklx,
+ deny /proc/sys/kernel/domainname?*{,/**} wklx,
+ deny /proc/sys/kernel/h[^o]*{,/**} wklx,
+ deny /proc/sys/kernel/ho[^s]*{,/**} wklx,
+ deny /proc/sys/kernel/hos[^t]*{,/**} wklx,
+ deny /proc/sys/kernel/host[^n]*{,/**} wklx,
+ deny /proc/sys/kernel/hostn[^a]*{,/**} wklx,
+ deny /proc/sys/kernel/hostna[^m]*{,/**} wklx,
+ deny /proc/sys/kernel/hostnam[^e]*{,/**} wklx,
+ deny /proc/sys/kernel/hostname?*{,/**} wklx,
+ deny /proc/sys/kernel/m[^s]*{,/**} wklx,
+ deny /proc/sys/kernel/ms[^g]*{,/**} wklx,
+ deny /proc/sys/kernel/msg*/** wklx,
+ deny /proc/sys/kernel/s[^he]*{,/**} wklx,
+ deny /proc/sys/kernel/se[^m]*{,/**} wklx,
+ deny /proc/sys/kernel/sem*/** wklx,
+ deny /proc/sys/kernel/sh[^m]*{,/**} wklx,
+ deny /proc/sys/kernel/shm*/** wklx,
+ deny /proc/sys/kernel?*{,/**} wklx,
+ deny /proc/sys/n[^e]*{,/**} wklx,
+ deny /proc/sys/ne[^t]*{,/**} wklx,
+ deny /proc/sys/net?*{,/**} wklx,
+ deny /sys/[^fdc]*{,/**} wklx,
+ deny /sys/c[^l]*{,/**} wklx,
+ deny /sys/cl[^a]*{,/**} wklx,
+ deny /sys/cla[^s]*{,/**} wklx,
+ deny /sys/clas[^s]*{,/**} wklx,
+ deny /sys/class/[^n]*{,/**} wklx,
+ deny /sys/class/n[^e]*{,/**} wklx,
+ deny /sys/class/ne[^t]*{,/**} wklx,
+ deny /sys/class/net?*{,/**} wklx,
+ deny /sys/class?*{,/**} wklx,
+ deny /sys/d[^e]*{,/**} wklx,
+ deny /sys/de[^v]*{,/**} wklx,
+ deny /sys/dev[^i]*{,/**} wklx,
+ deny /sys/devi[^c]*{,/**} wklx,
+ deny /sys/devic[^e]*{,/**} wklx,
+ deny /sys/device[^s]*{,/**} wklx,
+ deny /sys/devices/[^v]*{,/**} wklx,
+ deny /sys/devices/v[^i]*{,/**} wklx,
+ deny /sys/devices/vi[^r]*{,/**} wklx,
+ deny /sys/devices/vir[^t]*{,/**} wklx,
+ deny /sys/devices/virt[^u]*{,/**} wklx,
+ deny /sys/devices/virtu[^a]*{,/**} wklx,
+ deny /sys/devices/virtua[^l]*{,/**} wklx,
+ deny /sys/devices/virtual/[^n]*{,/**} wklx,
+ deny /sys/devices/virtual/n[^e]*{,/**} wklx,
+ deny /sys/devices/virtual/ne[^t]*{,/**} wklx,
+ deny /sys/devices/virtual/net?*{,/**} wklx,
+ deny /sys/devices/virtual?*{,/**} wklx,
+ deny /sys/devices?*{,/**} wklx,
+ deny /sys/f[^s]*{,/**} wklx,
+ deny /sys/fs/[^c]*{,/**} wklx,
+ deny /sys/fs/c[^g]*{,/**} wklx,
+ deny /sys/fs/cg[^r]*{,/**} wklx,
+ deny /sys/fs/cgr[^o]*{,/**} wklx,
+ deny /sys/fs/cgro[^u]*{,/**} wklx,
+ deny /sys/fs/cgrou[^p]*{,/**} wklx,
+ deny /sys/fs/cgroup?*{,/**} wklx,
+ deny /sys/fs?*{,/**} wklx,
diff --git a/modules/vagrant/manifests/init.pp
b/modules/vagrant/manifests/init.pp
new file mode 100644
index 0000000..36fe3fe
--- /dev/null
+++ b/modules/vagrant/manifests/init.pp
@@ -0,0 +1,58 @@
+# == Class: vagrant
+#
+# Provision Vagrant
+#
+# === Parameters:
+# [*vagrant_home*]
+# Directory where Vagrant stores global state.
+# (default: '/srv/vagrant-data')
+#
+class vagrant(
+ $vagrant_home = '/srv/vagrant-data',
+) {
+ requires_os('ubuntu >= trusty')
+
+ # Installing vagrant plugins often requires compiling ruby gems
+ # FIXME: this should probably come from somewhere else
+ package { 'build-essential':
+ ensure => present,
+ }
+
+ # FIXME: vagrant-lxc needs vagrant 1.7+; 14.04 ships 1.4.3
+ # This ugly hack installs the deb downloaded from the main vagrant
+ # distribution site. It would be nicer to import this to our local apt
+ # repo.
+ exec { 'download_vagrant_deb':
+ command => '/usr/bin/wget
https://dl.bintray.com/mitchellh/vagrant/vagrant_1.7.2_x86_64.deb',
+ cwd => '/tmp',
+ creates => '/tmp/vagrant_1.7.2_x86_64.deb',
+ }
+ exec { 'install_vagrant_deb':
+ command => '/usr/bin/dpkg -i /tmp/vagrant_1.7.2_x86_64.deb',
+ unless => '/usr/bin/dpkg-query -l vagrant',
+ require => Exec['download_vagrant_deb'],
+ }
+
+ file { $vagrant_home:
+ ensure => 'directory',
+ owner => 'vagrant',
+ group => 'vagrant',
+ }
+
+ sudo::group { 'wikidev_vagrant':
+ privileges => [
+ 'ALL=(vagrant) NOPASSWD: ALL',
+ ],
+ group => 'wikidev',
+ }
+
+ # Wrapper script to make it easier to invoke vagrant in a shared
+ # environment.
+ file { '/usr/local/bin/mwvagrant':
+ ensure => 'present',
+ owner => 'root',
+ group => 'root',
+ mode => '0555',
+ content => template('vagrant/mwvagrant.erb'),
+ }
+}
diff --git a/modules/vagrant/manifests/lxc.pp b/modules/vagrant/manifests/lxc.pp
new file mode 100644
index 0000000..c370cee
--- /dev/null
+++ b/modules/vagrant/manifests/lxc.pp
@@ -0,0 +1,46 @@
+# == Class: vagrant::lxc
+#
+# Provision LXC for use as a Vagrant container
+#
+# === Parameters:
+# [*container_root*]
+# Directory where LXC will store containers (default: '/srv/lxc')
+#
+class vagrant::lxc(
+ $container_root = '/srv/lxc',
+) {
+ require ::vagrant
+
+ package { [
+ 'lxc',
+ 'lxc-templates',
+ 'cgroup-lite',
+ 'redir',
+ ]:
+ ensure => present,
+ }
+
+ exec { 'install_vagrant_lxc':
+ command => '/usr/bin/vagrant plugin install vagrant-lxc',
+ unless => '/usr/bin/vagrant plugin list | /bin/grep vagrant-lxc',
+ user => 'vagrant',
+ environment => "VAGRANT_HOME=${::vagrant::vagrant_home}",
+ require => [ Package['lxc'], Package['build-essential'] ],
+ }
+
+ exec { 'vagrant_lcx_sudoers':
+ command => "/usr/bin/vagrant lxc sudoers --user vagrant",
+ creates => '/usr/local/bin/vagrant-lxc-wrapper',
+ environment => "VAGRANT_HOME=${::vagrant::vagrant_home}",
+ require => Exec['install_vagrant_lxc'],
+ }
+
+ file { $container_root:
+ ensure => 'directory',
+ }
+
+ file { '/var/lib/lxc':
+ ensure => 'link',
+ target => $container_root,
+ }
+}
diff --git a/modules/vagrant/manifests/mediawiki.pp
b/modules/vagrant/manifests/mediawiki.pp
new file mode 100644
index 0000000..6a639d4
--- /dev/null
+++ b/modules/vagrant/manifests/mediawiki.pp
@@ -0,0 +1,45 @@
+# == Class: vagrant::mediawiki
+#
+# Provision MediaWiki-Vagrant
+#
+# === Parameters:
+# [*install_directory*]
+# Directory where Vagrant stores global state.
+# (default: '/srv/vagrant-data')
+#
+class vagrant::mediawiki(
+ $install_directory = '/srv/mediawiki-vagrant',
+) {
+ require ::vagrant
+
+ package { 'nfs-kernel-server':
+ ensure => present,
+ }
+
+ # Add custom apparmor profile that allows NFS mounts
+ file { '/etc/apparmor.d/abstractions/lxc/container-base':
+ ensure => 'present',
+ source => 'puppet:///modules/vagrant/lxc/container-base',
+ require => [ Package['lxc'], Package['lxc-templates'] ],
+ notify => Service['apparmor'],
+ }
+
+ git::clone { 'mediawiki/vagrant':
+ directory => $install_directory,
+ origin => 'https://gerrit.wikimedia.org/r/mediawiki/vagrant',
+ owner => 'vagrant',
+ group => 'wikidev',
+ shared => true,
+ }
+
+ exec { 'mediawiki_vagrant_setup':
+ command => "${install_directory}/setup.sh",
+ unless => '/usr/bin/vagrant plugin list | /bin/grep
mediawiki-vagrant',
+ cwd => $install_directory,
+ user => 'vagrant',
+ environment => [
+ "VAGRANT_HOME=${::vagrant::vagrant_home}",
+ ],
+ require => Git::Clone['mediawiki/vagrant'],
+ }
+}
diff --git a/modules/vagrant/templates/mwvagrant.erb
b/modules/vagrant/templates/mwvagrant.erb
new file mode 100755
index 0000000..870d01a
--- /dev/null
+++ b/modules/vagrant/templates/mwvagrant.erb
@@ -0,0 +1,8 @@
+#!/bin/sh
+# Execute vagrant using a shared user and configuration directory.
+# Helps manage a Vagrant install that is shared by multiple users.
+#
+# Adding `alias vagrant=/usr/bin/local//mwvagrant` to your shell will make
+# usage more natural.
+
+exec sudo -u vagrant -- env VAGRANT_HOME=<%= @vagrant_home %> /usr/bin/vagrant
"$@"
--
To view, visit https://gerrit.wikimedia.org/r/193665
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: newchange
Gerrit-Change-Id: I04cfa3d143cad92b2be57d3813f0b09ecfb45bf5
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: BryanDavis <[email protected]>
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
