Feature/ansible

patches/ansible/ansible/ini_file_keep_key_casing-issue_8050-ansible_1.6.2.diff

@@ -0,0 +1,28 @@
+--- ini_file	2014-05-23 21:16:25.000000000 +0000
++++ ini_file	2014-07-07 07:58:19.420050811 +0000
+@@ -95,6 +95,7 @@
+
+     changed = False
+     cp = ConfigParser.ConfigParser()
++    cp.optionxform = identity
+
+     try:
+         f = open(filename)
+@@ -151,6 +152,17 @@
+     return changed
+
+ # ==============================================================
++# identity
++
++def identity(arg):
++    """This function simply returns its argument. It serves as a
++    replacement for ConfigParser.optionxform, which by default
++    changes arguments to lower case. The identity function is a
++    better choice than str() or unicode(), because it is
++    encoding-agnostic."""
++    return arg
++
++# ==============================================================
+ # main
+
+ def main():

scripts/components/api.sh

@@ -1,93 +1,33 @@
 #!/bin/bash
 
-if [ ! -d /opt/www/OpenConext-api ]
-then
-  cd /opt/www
-  $GITCLONE $OC__API_REPO
-fi
-
-cd /opt/www/OpenConext-api
-$GITRESET # revert potential changes
-$GITFETCH
-$GITCHECKOUT ${API_VERSION}
-$MVN clean install -DskipTests
-
-# extract deployable artifact
-tar -zxf coin-api-dist/target/*-bin.tar.gz -C coin-api-dist/target
-
-API_DIST_BASEDIR=/opt/www/OpenConext-api/coin-api-dist/target/coin-api-dist-*/
-
-# remove old deployed war
-rm -f /usr/share/tomcat6/wars/coin-api-*.war 2> /dev/null
-# copy new war to Tomcat
-cp $API_DIST_BASEDIR/tomcat/webapps/*.war /usr/share/tomcat6/wars
-
-# Copy Tomcat-specific context configuration file
-install -d /usr/share/tomcat6/conf/Catalina/api.$OC_DOMAIN
-cp $API_DIST_BASEDIR/tomcat/conf/context/*.xml /usr/share/tomcat6/conf/Catalina/api.$OC_DOMAIN/
-
-
-
-sed \
-  -e "s/_OPENCONEXT_DOMAIN_/$OC_DOMAIN/" \
-  -e "s~spCertificate=.*$~spCertificate=$OC_CERT~" \
-  -e "s~idpCertificate=.*$~idpCertificate=$ENGINEBLOCK_CERT~" \
-  -e "s~spPrivateKey=.*$~spPrivateKey=$OC_KEY~" \
-  $API_DIST_BASEDIR/tomcat/conf/classpath_properties/coin-api.properties.vm \
-  > /tmp/coin-api.properties
-
-if $UPGRADE
-then
-  rm -rf /usr/share/tomcat6/work/Catalina
-  rm -rf /usr/share/tomcat6/webapps/*/*
-
-  backupFile /usr/share/tomcat6/conf/classpath_properties/coin-api.properties
-  perl $OC_SCRIPTDIR/tools/replaceProperties/replaceProperties.pl /tmp/coin-api.properties /usr/share/tomcat6/conf/classpath_properties/coin-api.properties
-
-else
-
-  cp $API_DIST_BASEDIR/tomcat/conf/classpath_properties/api-logback.xml.vm /usr/share/tomcat6/conf/classpath_properties/api-logback.xml
-  cp $API_DIST_BASEDIR/tomcat/conf/classpath_properties/api-ehcache.xml.vm /usr/share/tomcat6/conf/classpath_properties/api-ehcache.xml
-  cp /tmp/coin-api.properties /usr/share/tomcat6/conf/classpath_properties/
-
-  # Apply db credentials to file coin-api.properties
-  sed -i "s/__OC__ENGINE_DB_USER__/$OC__ENGINE_DB_USER/g" /opt/tomcat/conf/classpath_properties/coin-api.properties
-  sed -i "s/__OC__ENGINE_DB_PASS__/$OC__ENGINE_DB_PASS/g" /opt/tomcat/conf/classpath_properties/coin-api.properties
-  sed -i "s/__OC__TEAMS_DB_USER__/$OC__TEAMS_DB_USER/g" /opt/tomcat/conf/classpath_properties/coin-api.properties
-  sed -i "s/__OC__TEAMS_DB_PASS__/$OC__TEAMS_DB_PASS/g" /opt/tomcat/conf/classpath_properties/coin-api.properties
-  sed -i "s/__OC__API_DB_USER__/$OC__API_DB_USER/g" /opt/tomcat/conf/classpath_properties/coin-api.properties
-  sed -i "s/__OC__API_DB_PASS__/$OC__API_DB_PASS/g" /opt/tomcat/conf/classpath_properties/coin-api.properties
-
-  # Apply ldap credentials to file coin-api.properties
-  sed -i "s/__OC__LDAP_USER__/$OC__LDAP_USER/g" /opt/tomcat/conf/classpath_properties/coin-api.properties
-  sed -i "s/__OC__LDAP_PASS__/$OC__LDAP_PASS/g" /opt/tomcat/conf/classpath_properties/coin-api.properties
-
-  # Apply Serviceregistry (Janus) API credentials to file coin-api.properties
-  sed -i "s/__OC__API_JANUSAPI_USER__/$OC__API_JANUSAPI_USER/g" /opt/tomcat/conf/classpath_properties/coin-api.properties
-  sed -i "s/__OC__API_JANUSAPI_PASS__/$OC__API_JANUSAPI_PASS/g" /opt/tomcat/conf/classpath_properties/coin-api.properties
-
-  install -d /usr/share/tomcat6/webapps/api.$OC_DOMAIN
-  chown -Rf tomcat:tomcat /usr/share/tomcat6/webapps/
-
-  SERVERXMLLINE='<Host name="api.'$OC_DOMAIN'" appBase="webapps/api.'$OC_DOMAIN'"/>'
-  sed -i "s#</Engine>#$SERVERXMLLINE\n</Engine>#" /usr/share/tomcat6/conf/server.xml
-
-  mysql -u root --password=$OC__ROOT_DB_PASS -e "create database if not exists api default charset utf8 default collate utf8_unicode_ci;"
-
-  # Create api user/pass
-  mysql -uroot -p$OC__ROOT_DB_PASS -e "GRANT ALL PRIVILEGES ON api.* TO $OC__API_DB_USER@localhost IDENTIFIED BY '$OC__API_DB_PASS'"
-  mysql -uroot -p$OC__ROOT_DB_PASS -e "FLUSH PRIVILEGES"
-
-  success=`mysqladmin -u$OC__API_DB_USER -p$OC__API_DB_PASS ping | grep -c "mysqld is alive"`
-  if [[ $success == '1' ]]
-  then
-    echo -e "\nValidating new MySQL API password: SUCCESS!\n"     
-  else
-    echo -e "\nValidating new MySQL API password: FAILED\n"
-    exit
-  fi
-
-  cat $OC_BASEDIR/configs/httpd/conf.d/api.conf  | \
-    sed -e "s/_OPENCONEXT_DOMAIN_/$OC_DOMAIN/g" > \
-    /etc/httpd/conf.d/api.conf
-fi
+# Make sure Ansible is installed cleanly
+sudo yum erase -y ansible &&
+sudo yum install -y ansible MySQL-python patch python-lxml &&
+
+# Patch Ansible for: #8050: ini_file module still changes all option names to lower case.
+# -b = backup, -N = assume merged if failed, -u = Unified format, -p0 = 0 leading lines, -d chdir to dir before apply.
+sudo patch -b -N -u -p0 -d /usr/share/ansible/files < $OC_BASEDIR/patches/ansible/ansible/ini_file_keep_key_casing-issue_8050-ansible_1.6.2.diff
+
+# Run Ansible playbook
+echo "Provisioning API with Ansible..."
+sudo ansible-playbook \
+  -v \
+  -i /vagrant/tools/ansible/inventory/demo.openconext.org.ini \
+  -e "api_version=$API_VERSION" \
+  -e "api_db_user=$OC__API_DB_USER" \
+  -e "api_db_password=$OC__API_DB_PASS" \
+  -e "api_janus_user=$OC__API_JANUSAPI_USER" \
+  -e "api_janus_secret=$OC__API_JANUSAPI_PASS" \
+  -e "api_sp_key_string=$OC_KEY" \
+  -e "api_sp_cert_string=$OC_CERT" \
+  -e "api_ldap_bind_dn=$OC__LDAP_USER" \
+  -e "api_ldap_password=$OC__LDAP_PASS" \
+  -e "db_admin_password=$OC__ROOT_DB_PASS" \
+  -e "engine_db_user=$OC__ENGINE_DB_USER" \
+  -e "engine_db_password=$OC__ENGINE_DB_PASS" \
+  -e "engine_idp_cert_string=$ENGINEBLOCK_CERT" \
+  -e "openconext_domain=$OC_DOMAIN" \
+  -e "openconext_error_mail=$OC__ADMIN_EMAIL" \
+  -e "teams_db_user=$OC__TEAMS_DB_USER" \
+  -e "teams_db_password=$OC__TEAMS_DB_PASS" \
+  $OC_BASEDIR/tools/ansible/api.yml

scripts/components/engineblock.sh

@@ -1,119 +1,34 @@
 #!/bin/bash
 
-#######################
-# Install EngineBlock #
-#######################
-if [ ! -h /opt/www/engineblock ]
-then
-    $GITCLONE https://github.com/OpenConext/OpenConext-engineblock.git /opt/www/OpenConext-engineblock
-    ln -sf /opt/www/OpenConext-engineblock /opt/www/engineblock
-fi
-cd /opt/www/engineblock
-$GITRESET # revert potential changes
-$GITFETCH
-$GITCHECKOUT ${ENGINEBLOCK_VERSION}
-
-./bin/composer.phar --prefer-dist --no-interaction install
-# Restore SELinux labels, due to bug? in Composer (https://github.com/composer/composer/issues/1714)
-restorecon -r vendor
-
-if $UPGRADE
-then
-  source /etc/profile.d/openconext.sh
-
-else
-  # Create database
-  mysql -u root --password=$OC__ROOT_DB_PASS -e "drop database if exists engineblock; create database engineblock default charset utf8 default collate utf8_unicode_ci;"
-  cat $OC_BASEDIR/data/engineblock.sql | \
-    sed -e "s/_OPENCONEXT_DOMAIN_/$OC_DOMAIN/g" | \
-    mysql -u root --password=$OC__ROOT_DB_PASS engineblock
-
-  # Set database creadentials for engine
-  mysql -uroot -p$OC__ROOT_DB_PASS -e "GRANT ALL PRIVILEGES ON engineblock.* TO $OC__ENGINE_DB_USER@localhost IDENTIFIED BY '$OC__ENGINE_DB_PASS'"
-  success=`mysqladmin -u$OC__ENGINE_DB_USER -p$OC__ENGINE_DB_PASS ping | grep -c "mysqld is alive"`
-  if [[ $success == '1' ]]
-  then
-    echo -e "\nValidating new MySQL Engine password: SUCCESS!\n"     
-  else
-    echo -e "\nValidating new MySQL Engine password: FAILED\n"
-    exit
-  fi
-
-  #############################################
-  # Modify the EngineBlock configuration file #
-  #############################################
-  if [ -f /etc/surfconext/engineblock.ini ]
-  then
-    backupFile /etc/surfconext/engineblock.ini
-  fi
-  install -d /etc/surfconext/
-  sed -e "s/_OPENCONEXT_DOMAIN_/$OC_DOMAIN/g" $OC_BASEDIR/configs/surfconext/engineblock.ini > /etc/surfconext/engineblock.ini
-
-  echo "Apply db credentials to file engineblock.ini"
-  sed -i "s/__OC__ENGINE_DB_USER__/$OC__ENGINE_DB_USER/g" /etc/surfconext/engineblock.ini
-  sed -i "s/__OC__ENGINE_DB_PASS__/$OC__ENGINE_DB_PASS/g" /etc/surfconext/engineblock.ini
-
-  # Apply janus api credentials to file engineblock.ini
-  sed -i "s/__OC__ENGINE_JANUSAPI_USER__/$OC__ENGINE_JANUSAPI_USER/g" /etc/surfconext/engineblock.ini
-  sed -i "s/__OC__ENGINE_JANUSAPI_PASS__/$OC__ENGINE_JANUSAPI_PASS/g" /etc/surfconext/engineblock.ini
-
-  # Apply ldap credentials to file engineblock.ini
-  sed -i "s/__OC__LDAP_ENGINE_USER__/$OC__LDAP_ENGINE_USER/g" /etc/surfconext/engineblock.ini
-  sed -i "s/__OC__LDAP_ENGINE_PASS__/$OC__LDAP_ENGINE_PASS/g" /etc/surfconext/engineblock.ini
-
-  # Apply timezone to file engineblock.ini
-  sed -i "s|__OC__TIMEZONE__|$OC__TIMEZONE|g" /etc/surfconext/engineblock.ini
-
-  # Edit the profile.sh file to set correct environment variable
-  echo 'export ENGINEBLOCK_ENV="demo"' > /etc/profile.d/openconext.sh
-
-  chmod +x /etc/profile.d/openconext.sh
-  source /etc/profile.d/openconext.sh
-
-  if [ -f /etc/surfconext/engineblock.crt ]
-  then
-    backupFile /etc/surfconext/engineblock.crt
-  fi
-  # Generate Self Signed Certificate for EngineBlock and add it to the configuration
-  cd /tmp &&
-    openssl req -subj '/CN=Engine/OU=Services/O=OpenConext/C=NL/' -newkey rsa:2048 -new -x509 -days 3652 -nodes -out example.org.crt -keyout example.org.pem > /dev/null
-  EB_CRT=`cat example.org.crt` &&
-  EB_KEY=`cat example.org.pem` &&
-  EB_CRT_NO_HEADERS=`sed '1d;$d' example.org.crt` &&
-  echo "" >> /etc/surfconext/engineblock.ini &&
-  echo "encryption.key.public = \"${EB_CRT}\"" >> /etc/surfconext/engineblock.ini &&
-  echo "encryption.key.private = \"${EB_KEY}\"" >> /etc/surfconext/engineblock.ini &&
-  echo "auth.simplesamlphp.idp.cert       = \"${EB_CRT_NO_HEADERS}\"" >> /etc/surfconext/engineblock.ini
-  cp example.org.crt /etc/surfconext/engineblock.crt &&
-  rm example.org.crt example.org.pem
-
-  install -d /var/log/surfconext
-  # TODO: is this chmod really neccessary?
-  chmod o+w /var/log/surfconext
-  touch /var/log/surfconext/engineblock.log
-  chmod o+w /var/log/surfconext/engineblock.log
-
-    # Updating LDAP schema some more...
-  ldapmodify -x -D cn=admin,cn=config -h localhost -w $OC__LDAP_PASS -f /opt/www/engineblock/ldap/changes/addDeprovisionWarningSentAttributes.ldif
-  ldapmodify -x -D cn=admin,cn=config -h localhost -w $OC__LDAP_PASS -f /opt/www/engineblock/ldap/changes/addCollabPersonUUID.ldif
-
-  # Apply LDAP credentials to file engineblock.ini
-  sed -i "s/__OC__ENGINE_LDAP_PASSWD__/$OC__LDAP_PASS/g" /etc/surfconext/engineblock.ini
-
-  # Update apache conf
-  cat $OC_BASEDIR/configs/httpd/conf.d/engine.conf  | \
-    sed -e "s/_OPENCONEXT_DOMAIN_/$OC_DOMAIN/g" > \
-    /etc/httpd/conf.d/engine.conf
-  cat $OC_BASEDIR/configs/httpd/conf.d/engine-internal.conf  | \
-    sed -e "s/_OPENCONEXT_DOMAIN_/$OC_DOMAIN/g" > \
-    /etc/httpd/conf.d/engine-internal.conf
-  cat $OC_BASEDIR/configs/httpd/conf.d/profile.conf  | \
-    sed -e "s/_OPENCONEXT_DOMAIN_/$OC_DOMAIN/g" > \
-    /etc/httpd/conf.d/profile.conf
-
-  # Make public key available for other components
-  ENGINEBLOCK_CERT=`sed '1d;$d' /etc/surfconext/engineblock.crt | tr -d '\n'`
-fi
-
-cd /opt/www/engineblock/
-./bin/migrate
+# Make sure Ansible is installed cleanly
+sudo yum erase -y ansible &&
+sudo yum install -y ansible MySQL-python patch &&
+
+# Patch Ansible for: #8050: ini_file module still changes all option names to lower case.
+# -b = backup, -N = assume merged if failed, -u = Unified format, -p0 = 0 leading lines, -d chdir to dir before apply.
+sudo patch -b -N -u -p0 -d /usr/share/ansible/files < $OC_BASEDIR/patches/ansible/ansible/ini_file_keep_key_casing-issue_8050-ansible_1.6.2.diff &&
+
+# Run Ansible playbook
+echo "Provisioning EngineBlock with Ansible..." &&
+sudo ansible-playbook \
+  -v \
+  -i $OC_BASEDIR/tools/ansible/inventory/demo.openconext.org.ini \
+  -e "db_admin_user=root" \
+  -e "db_admin_password=$OC__ROOT_DB_PASS" \
+  -e "engine_db_name=engineblock" \
+  -e "engine_db_host=localhost" \
+  -e "engine_db_port=3306" \
+  -e "engine_db_user=$OC__ENGINE_DB_USER" \
+  -e "engine_db_password=$OC__ENGINE_DB_PASS" \
+  -e "engine_janus_url=https://serviceregistry.$OC_DOMAIN/simplesaml/module.php/janus/services/rest/" \
+  -e "engine_janus_user=$OC__ENGINE_JANUSAPI_USER" \
+  -e "engine_janus_secret=$OC__ENGINE_JANUSAPI_PASS" \
+  -e "engine_ldap_bind_dn=$OC__LDAP_ENGINE_USER" \
+  -e "engine_ldap_password=$OC__LDAP_ENGINE_PASS" \
+  -e "engine_version=$ENGINEBLOCK_VERSION" \
+  -e "ldap_admin_bind_dn=$OC__LDAPADMIN_USER" \
+  -e "ldap_admin_password=$OC__LDAPADMIN_PASS" \
+  -e "openconext_domain=$OC_DOMAIN" \
+  $OC_BASEDIR/tools/ansible/engineblock.yml
+
+ENGINEBLOCK_CERT=`sed '1d;$d' /etc/surfconext/engineblock.crt | tr -d '\n'`

scripts/dependencies/mysql_install.sh

@@ -6,10 +6,19 @@ $YUM -y install mysql mysql-server mysql-connector-java
 service mysqld restart
 chkconfig mysqld on
 
-# configure MySQL
-echo -e "\n\nSetting new MySQL Root password \n\n"
-mysqladmin -u root password $OC__ROOT_DB_PASS
+# Root PW already set? Ignore any errors on this one.
+set +e
+success=`mysqladmin -uroot -p$OC__ROOT_DB_PASS ping | grep -c "mysqld is alive"`
+set -e
 
+if [[ $success != '1' ]]
+then
+    # If not then try to connect without a password and set it
+    echo -e "\n\nSetting new MySQL Root password \n\n"
+    mysqladmin -u root password $OC__ROOT_DB_PASS
+fi
+
+# Test connection with proper root password.
 success=`mysqladmin -uroot -p$OC__ROOT_DB_PASS ping | grep -c "mysqld is alive"`
 if [[ $success == '1' ]]
 then
@@ -18,3 +27,7 @@ else
     echo -e "\nValidating MySQL Root password: FAILED\n"
     exit
 fi
+
+echo -e "Enabling root access on db.$OC_DOMAIN"
+echo "GRANT ALL ON *.* TO 'root'@'db.$OC_DOMAIN' IDENTIFIED BY '$OC__ROOT_DB_PASS' WITH GRANT OPTION;" \
+  | mysql -u root -p$OC__ROOT_DB_PASS

scripts/versions.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 
 # these versions are tag names
-export ENGINEBLOCK_VERSION=develop
+export ENGINEBLOCK_VERSION=feature/ansible
 export API_VERSION=develop
 export MANAGE_VERSION=develop
 export SERVICEREGISTRY_VERSION=develop

tools/ansible/.librarian/ansible/config

@@ -0,0 +1,3 @@
+---
+LIBRARIAN_ANSIBLE_PATH: roles
+LIBRARIAN_ANSIBLE_TMP: /tmp

tools/ansible/Ansiblefile

@@ -0,0 +1,15 @@
+#!/usr/bin/env ruby
+#^syntax detection
+
+role "openconext-engineblock",
+    git: "[email protected]:OpenConext/OpenConext-engineblock.git",
+    ref: "feature/ansible",
+    path: "./tools/ansible-role-openconext-engineblock"
+
+role "openconext-api",
+    git: "[email protected]:OpenConext/OpenConext-api.git",
+    ref: "feature/ansible",
+    path: "./coin-api-dist/src/main/ansible"
+
+role "ansible-xml",
+    github: "relaxnow/ansible-xml"

tools/ansible/Ansiblefile.lock

@@ -0,0 +1,28 @@
+GIT
+  remote: [email protected]:OpenConext/OpenConext-api.git
+  path: ./coin-api-dist/src/main/ansible
+  ref: feature/ansible
+  sha: d83128625e35ec608dada60942aee285505b554e
+  specs:
+    openconext-api (4.2.0)
+
+GIT
+  remote: [email protected]:OpenConext/OpenConext-engineblock.git
+  path: ./tools/ansible-role-openconext-engineblock
+  ref: feature/ansible
+  sha: 9cb71737ff62320103ac419e90cacca27166b671
+  specs:
+    openconext-engineblock (4.2.0)
+
+GIT
+  remote: https://github.com/relaxnow/ansible-xml
+  ref: master
+  sha: 3a9c9ab2c93c512520be8d227519bc552e05c7a9
+  specs:
+    ansible-xml (0.3.1)
+
+DEPENDENCIES
+  ansible-xml (>= 0)
+  openconext-api (>= 0)
+  openconext-engineblock (>= 0)
+