Ryan Lane has submitted this change and it was merged.
Change subject: Initial puppetization for git.wikimedia.org
......................................................................
Initial puppetization for git.wikimedia.org
- Install apache
- Setup replication destination for repositories
- Create gitblit user
Change-Id: Ic2f3a7fd82360c21845ac916db91f555806cbec0
---
A manifests/misc/gitblit.pp
A manifests/role/gitblit.pp
M manifests/site.pp
A templates/apache/sites/git.wikimedia.org.erb
4 files changed, 141 insertions(+), 2 deletions(-)
Approvals:
Ryan Lane: Verified; Looks good to me, approved
diff --git a/manifests/misc/gitblit.pp b/manifests/misc/gitblit.pp
new file mode 100644
index 0000000..43a9bc2
--- /dev/null
+++ b/manifests/misc/gitblit.pp
@@ -0,0 +1,34 @@
+# manifests/gitblit.pp
+# manifest to setup a gitblit instance
+
+# Setup apache for the git viewer and replicated git repos
+# Also needs gerrit::replicationdest installed
+class gitblit($host,
+ $user = "gitblit",
+ $git_repo_owner="gerritslave",
+ $ssl_cert="",
+ $ssl_cert_key="") {
+
+ systemuser { $user: name => $user }
+
+ file {
+ "/etc/apache2/sites-available/git.wikimedia.org":
+ mode => 0644,
+ owner => root,
+ group => root,
+ content =>
template('apache/sites/git.wikimedia.org.erb'),
+ ensure => present;
+ "/var/lib/git":
+ mode => 0644,
+ owner => $git_repo_owner,
+ group => $git_repo_owner,
+ ensure => directory,
+ require => User[$git_repo_owner];
+ }
+
+ apache_site { git: name => "git.wikimedia.org" }
+ apache_module { rewrite: name => "rewrite" }
+ apache_module { proxy: name => "proxy" }
+ apache_module { proxy_http: name => "proxy_http" }
+ apache_module { ssl: name => "ssl" }
+}
diff --git a/manifests/role/gitblit.pp b/manifests/role/gitblit.pp
new file mode 100644
index 0000000..01d690b
--- /dev/null
+++ b/manifests/role/gitblit.pp
@@ -0,0 +1,13 @@
+# manifests/role/gitblit.pp
+
+class role::gitblit {
+ system_role { "role::gitblit": description => "Gitblit, a git viewer" }
+
+ include role::gerrit::production::replicationdest
+
+ class { "gitblit":
+ host => "git.wikimedia.org",
+ ssl_cert => "git.wikimedia.org",
+ ssl_cert_key => "git.wikimedia.org"
+ }
+}
diff --git a/manifests/site.pp b/manifests/site.pp
index 1065ffe..ae59765 100644
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -205,12 +205,12 @@
# git.wikimedia.org
node "antimony.wikimedia.org" {
- install_certificate{ "star.wikimedia.org": }
+ install_certificate{ "git.wikimedia.org": }
include standard,
groups::wikidev,
accounts::demon,
- role::gerrit::production::replicationdest
+ role::gitblit
# full root for gerrit admin (RT-3698)
sudo_user { "demon": privileges => ['ALL = NOPASSWD: ALL'] }
diff --git a/templates/apache/sites/git.wikimedia.org.erb
b/templates/apache/sites/git.wikimedia.org.erb
new file mode 100644
index 0000000..a9008fc
--- /dev/null
+++ b/templates/apache/sites/git.wikimedia.org.erb
@@ -0,0 +1,92 @@
+#####################################################################
+#####################################################################
+### THIS FILE IS MANAGED BY PUPPET
+### puppet:///templates/apache/sites/git.wikimedia.org.erb
+#####################################################################
+# vim: filetype=apache
+
+LogFormat "%h %l %u %t \"%r\" %>s %O T=%Ts \"%{Referer}i\" \"%{User-Agent}i\""
combined_time
+
+NameVirtualHost *:80
+<VirtualHost *:80>
+ ServerAdmin [email protected]
+ ServerName <%= host %>
+
+ DocumentRoot /var/www
+ <Directory />
+ Options FollowSymLinks
+ AllowOverride None
+ </Directory>
+ <Directory /var/www/>
+ Options Indexes FollowSymLinks MultiViews
+ AllowOverride None
+ Order allow,deny
+ allow from all
+ </Directory>
+
+ ErrorLog /var/log/apache2/error.log
+
+ # Possible values include: debug, info, notice, warn, error, crit,
+ # alert, emerg.
+ LogLevel warn
+
+ CustomLog /var/log/apache2/access.log combined_time
+ ServerSignature Off
+
+ RewriteEngine on
+ RewriteCond %{SERVER_PORT} !^443$
+ RewriteRule ^/(.*)$ https://<%= host %>/$1 [L,R,NE]
+</VirtualHost>
+
+NameVirtualHost *:443
+<VirtualHost *:443>
+ ServerAdmin [email protected]
+ ServerName <%= host %>
+
+ SSLEngine on
+ SSLCertificateFile /etc/ssl/certs/<%= ssl_cert %>.pem
+ SSLCertificateKeyFile /etc/ssl/private/<%= ssl_cert_key %>.key
+ SSLCACertificatePath /etc/ssl/certs/
+
+ SetEnvIf User-Agent 80legs bad_browser
+ SetEnvIf User-Agent bingbot bad_browser
+
+ TimeOut 720
+
+ DocumentRoot /var/www
+ <Directory />
+ Options FollowSymLinks
+ AllowOverride None
+ Order deny,allow
+ deny from env=bad_browser
+ deny from 208.110.84.34
+ </Directory>
+ <Directory /var/www/>
+ Options Indexes FollowSymLinks MultiViews
+ AllowOverride None
+ </Directory>
+
+ ProxyRequests Off
+ ProxyVia Off
+ ProxyPreserveHost On
+
+ <Proxy *>
+ Order deny,allow
+ deny from env=bad_browser
+ deny from 208.110.84.34
+ </Proxy>
+
+ AllowEncodedSlashes NoDecode
+ RewriteEngine On
+ RewriteRule ^/(.*) http://127.0.0.1:8080/$1 [NE,P]
+
+ ErrorLog /var/log/apache2/error.log
+
+ # Possible values include: debug, info, notice, warn, error, crit,
+ # alert, emerg.
+ LogLevel warn
+
+ CustomLog /var/log/apache2/access.log combined_time
+ ServerSignature Off
+
+</VirtualHost>
--
To view, visit https://gerrit.wikimedia.org/r/59857
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: Ic2f3a7fd82360c21845ac916db91f555806cbec0
Gerrit-PatchSet: 11
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Demon <[email protected]>
Gerrit-Reviewer: Ryan Lane <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
