Skip to content

Commit 530d216

Browse files
author
Rohit Yadav
committed
devops: baagi.org automated
Signed-off-by: Rohit Yadav <[email protected]>
0 parents  commit 530d216

File tree

20 files changed

+445
-0
lines changed

20 files changed

+445
-0
lines changed

‎.gitignore

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
*.pyc
2+
*~
3+
.DS_Store
4+
keys/*

‎README.md

+22
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# DevOps automation using Fabric and Puppet
2+
3+
Install Fabric:
4+
5+
pip install fabric
6+
7+
Initialize and bootstrap puppet repository and keys, deploy for the first time
8+
on a node:
9+
10+
fab -R <role> -H <host> init
11+
12+
Check changes on server:
13+
14+
fab -R baagi noop
15+
16+
Push eventual changes on server:
17+
18+
fab -R baagi deploy
19+
20+
Upgrading packages:
21+
22+
fab -R baagi upgrade

‎fabfile.py

+113
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
from fabric.api import *
2+
import getpass
3+
import sys
4+
5+
# Enforce sysadmin params
6+
env.user = "bhaisaab"
7+
env.port = "1009"
8+
9+
# Forward local agent
10+
env.forward_agent = True
11+
12+
# Move to a reusable map/hash module
13+
env.roledefs = {
14+
"baagi": [""],
15+
}
16+
17+
# Add role to capture all nodes
18+
all_servers = []
19+
for key in env.roledefs:
20+
all_servers = all_servers + env.roledefs[key]
21+
22+
env.roledefs["all"] = all_servers
23+
24+
if len(env.hosts) != 0:
25+
for key in env.roledefs.keys():
26+
env.roledefs[key] = []
27+
28+
29+
print """
30+
_____ __ __
31+
/ _ \ __ ___/ |_ ____ _____ _____ _/ |_ ___________
32+
/ /_\ \| | \ __\/ _ \ / \\\\__ \\\\ __\/ _ \_ __ \\
33+
/ | \ | /| | ( <_> ) Y Y \/ __ \| | ( <_> ) | \/
34+
\____|__ /____/ |__| \____/|__|_| (____ /__| \____/|__|
35+
\/ \/ \/
36+
"""
37+
38+
print "Tasks:", env['tasks']
39+
print "Roles:", env['roles']
40+
print "Hosts:", env['hosts']
41+
print "SSH Port:", env['port']
42+
43+
44+
if "init" not in sys.argv and not env.password:
45+
env.password = getpass.getpass("Enter OTP for sudo ops: ")
46+
47+
48+
def info():
49+
run("uname -a")
50+
run("lsb_release -a")
51+
run("uptime")
52+
run("last | head -5")
53+
run("hostname && hostname -f")
54+
55+
56+
def upgrade():
57+
sudo("apt-get update && apt-get upgrade -V")
58+
59+
60+
def noop():
61+
sudo("cd /etc/puppet/ && git clean -fd && git checkout -- /etc/puppet/ && git pull --rebase origin master")
62+
sudo("puppet apply --modulepath /etc/puppet/modules --noop /etc/puppet/manifests/site.pp --templatedir /etc/puppet/templates/")
63+
64+
65+
def deploy():
66+
"""
67+
Runs puppet apply
68+
"""
69+
sudo("cd /etc/puppet/ && git clean -fd && git checkout -- /etc/puppet/ && git pull --rebase origin master")
70+
sudo("puppet apply --modulepath /etc/puppet/modules /etc/puppet/manifests/site.pp --templatedir /etc/puppet/templates/ --debug")
71+
72+
73+
def reboot():
74+
sudo("reboot")
75+
76+
77+
def init():
78+
"""
79+
Assumed that root user will setup initial environment before admin takes control
80+
"""
81+
if len(env.hosts) > 1:
82+
print "WARNING: You're initializing more than one host in one go!"
83+
84+
env.user = "root"
85+
env.port = "22"
86+
87+
# host info
88+
info()
89+
90+
# basic package management
91+
run("apt-get update && apt-get upgrade -y")
92+
run("apt-get purge -y exim* mutt procmail bind9 apache2* php5* mysql* mailagent")
93+
run("apt-get install --no-install-recommends -y vim htop sudo openssh-client ssh wget gcc build-essential python-pip git tig")
94+
95+
# append local public key to authorized_keys
96+
put("~/.ssh/id_rsa.pub", "/tmp")
97+
run("mkdir -p /root/.ssh && cat /tmp/id_rsa.pub >> /root/.ssh/authorized_keys")
98+
99+
# fix ulimits
100+
run("echo -e '* \t soft \t nofile \t 64000' >> /etc/security/limits.conf")
101+
run("echo -e '* \t hard \t nofile \t 128000' >> /etc/security/limits.conf")
102+
run("echo -e 'root \t soft \t nofile \t 64000' >> /etc/security/limits.conf")
103+
run("echo -e 'root \t hard \t nofile \t 128000' >> /etc/security/limits.conf")
104+
105+
# install puppet based on Debian codename
106+
run("if [ `lsb_release --codename | grep wheezy | wc -l` -eq 1 ]; then cd /tmp && wget http://apt.puppetlabs.com/puppetlabs-release-wheezy.deb && dpkg -i puppetlabs-release-wheezy.deb; else cd /tmp && wget http://apt.puppetlabs.com/puppetlabs-release-squeeze.deb && dpkg -i puppetlabs-release-squeeze.deb; fi")
107+
108+
# install puppet and git, clone repo
109+
run("apt-get update && apt-get install puppet -y --no-install-recommends")
110+
run("cd /etc && rm -fr puppet && git clone https://github.com/baagi/devops.git puppet")
111+
112+
# first deploy
113+
deploy()

‎files/.gitkeep

Whitespace-only changes.

‎fileserver.conf

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[files]
2+
allow *.baagi.org
3+
path /etc/puppet/files

‎manifests/modules.pp

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import "base"
2+
import "locale"
3+
import "ntp"
4+
import "ssh"
5+
import "timezone"

‎manifests/nodes.pp

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
node basenode {
2+
include base
3+
include ntp
4+
5+
class { "ssh":
6+
allowed_users => "bhaisaab",
7+
}
8+
9+
timezone { "server timezone":
10+
tz => "UTC",
11+
}
12+
13+
users::admin { "bhaisaab": }
14+
locale { "default": }
15+
}
16+
17+
node default inherits basenode {
18+
}
19+
20+
node /^baagi(\.org)?$/ inherits basenode {
21+
}

‎manifests/site.pp

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
import "modules"
2+
import "nodes"
3+
4+
# global defaults
5+
Exec { path => "/usr/bin:/usr/sbin/:/bin:/sbin:/usr/local/bin" }
6+
7+
Package {
8+
provider => $operatingsystem ? {
9+
debian => aptitude,
10+
ubuntu => aptitude,
11+
redhat => yum,
12+
fedora => yum,
13+
centos => yum,
14+
}
15+
}
16+
17+

‎modules/base/manifests/init.pp

+17
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
class base {
2+
$packages = [ "sudo", "htop", "rsync", "tar", "tmux", "vim", "locales" ]
3+
package { $packages: ensure => installed }
4+
5+
# file { "/etc/hosts":
6+
# ensure => file,
7+
# content => template("base/hosts.erb"),
8+
# }
9+
10+
# firewall { '000 allow packets with valid state':
11+
# state => ['RELATED', 'ESTABLISHED'],
12+
# action => 'accept',
13+
# }
14+
# resources { 'firewall':
15+
# purge => false,
16+
# }
17+
}

‎modules/base/templates/hosts.erb

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
127.0.0.1 <%= @fqdn %> <%= @hostname %> localhost
2+
3+
# The following lines are desirable for IPv6 capable hosts
4+
::1 ip6-localhost ip6-loopback
5+
fe00::0 ip6-localnet
6+
ff00::0 ip6-mcastprefix
7+
ff02::1 ip6-allnodes
8+
ff02::2 ip6-allrouters

‎modules/dotfiles/manifests/init.pp

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
class dotfiles($user = 'bhaisaab') {
2+
3+
$packages = [ "zsh" ]
4+
package { $packages: ensure => installed } ->
5+
exec { "set dotfiles for user":
6+
path => "/bin:/usr/bin:/usr/local/bin",
7+
user => "$user",
8+
unless => "ls /home/${user}/.dotfiles && ls /home/${user}/.oh-my-zsh",
9+
command => 'git clone git://github.com/bhaisaab/dotfiles.git /home/${user}/.dotfiles \
10+
&& git clone git://github.com/robbyrussell/oh-my-zsh.git /home/${user}/.oh-my-zsh \
11+
&& /bin/bash /home/${user}/.dotfiles/install.sh',
12+
}
13+
}

‎modules/locale/files/default.gen

+2
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
en_US.UTF-8 UTF-8
2+
en_US ISO-8859-1

‎modules/locale/manifests/init.pp

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
define locale($role = $title) {
2+
3+
$localefile = $role ? {
4+
default => 'default.gen',
5+
}
6+
7+
# configure locale
8+
file { "/etc/locale.gen":
9+
ensure => present,
10+
owner => root,
11+
group => root,
12+
mode => 644,
13+
source => "puppet:///modules/locale/$localefile",
14+
notify => Exec["locale-gen"],
15+
}
16+
17+
exec { "locale-gen":
18+
command => "/usr/sbin/locale-gen",
19+
refreshonly => true,
20+
}
21+
}

‎modules/ntp/manifests/init.pp

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
class ntp {
2+
3+
package { 'ntpdate':
4+
ensure => latest
5+
}
6+
7+
package { "ntp":
8+
ensure => latest,
9+
}
10+
11+
service { "ntp":
12+
ensure => "running"
13+
}
14+
15+
}

‎modules/ssh/manifests/init.pp

+33
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
class ssh($allowed_users = 'bhaisaab rohit rohityadav') {
2+
3+
$packages = [ "openssh-client", "openssh-server" ]
4+
package { $packages: ensure => latest }
5+
6+
service { "ssh":
7+
ensure => "running",
8+
enable => "true",
9+
hasstatus => true,
10+
require => Package["openssh-server"],
11+
}
12+
13+
file { "/etc/ssh/sshd_config":
14+
ensure => file,
15+
notify => Service["ssh"],
16+
mode => 600,
17+
owner => "root",
18+
group => "root",
19+
content => template("ssh/sshd_config.erb"),
20+
require => Package["openssh-server"],
21+
}
22+
23+
file { "/root/.ssh":
24+
ensure => directory,
25+
mode => 700,
26+
owner => root,
27+
group => root,
28+
selrange => s0,
29+
seltype => home_ssh_t,
30+
selrole => object_r,
31+
seluser => system_u,
32+
}
33+
}

‎modules/ssh/templates/sshd_config.erb

+88
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
Port 1009
2+
# Use these options to restrict which interfaces/protocols sshd will bind to
3+
#ListenAddress ::
4+
#ListenAddress 0.0.0.0
5+
6+
Protocol 2
7+
# HostKeys for protocol version 2
8+
HostKey /etc/ssh/ssh_host_rsa_key
9+
HostKey /etc/ssh/ssh_host_dsa_key
10+
#Privilege Separation is turned on for security
11+
UsePrivilegeSeparation yes
12+
13+
# Lifetime and size of ephemeral version 1 server key
14+
KeyRegenerationInterval 3600
15+
ServerKeyBits 768
16+
17+
# Logging
18+
SyslogFacility AUTH
19+
LogLevel INFO
20+
21+
# Authentication:
22+
LoginGraceTime 30
23+
PermitRootLogin no
24+
StrictModes yes
25+
26+
RSAAuthentication yes
27+
PubkeyAuthentication yes
28+
AuthorizedKeysFile %h/.ssh/authorized_keys
29+
30+
# Don't read the user's ~/.rhosts and ~/.shosts files
31+
IgnoreRhosts yes
32+
# For this to work you will also need host keys in /etc/ssh_known_hosts
33+
RhostsRSAAuthentication no
34+
# similar for protocol version 2
35+
HostbasedAuthentication no
36+
# Uncomment if you don't trust ~/.ssh/known_hosts for RhostsRSAAuthentication
37+
#IgnoreUserKnownHosts yes
38+
39+
# To enable empty passwords, change to yes (NOT RECOMMENDED)
40+
PermitEmptyPasswords no
41+
42+
# Change to yes to enable challenge-response passwords (beware issues with
43+
# some PAM modules and threads)
44+
ChallengeResponseAuthentication no
45+
46+
# Change to no to disable tunnelled clear text passwords
47+
PasswordAuthentication yes
48+
49+
# Kerberos options
50+
#KerberosAuthentication no
51+
#KerberosGetAFSToken no
52+
#KerberosOrLocalPasswd yes
53+
#KerberosTicketCleanup yes
54+
55+
# GSSAPI options
56+
#GSSAPIAuthentication no
57+
#GSSAPICleanupCredentials yes
58+
59+
X11Forwarding no
60+
X11DisplayOffset 10
61+
AllowTcpForwarding no
62+
63+
PrintMotd no
64+
PrintLastLog yes
65+
TCPKeepAlive yes
66+
#UseLogin no
67+
68+
MaxStartups 4:50:16
69+
#Banner /etc/issue.net
70+
71+
# Allow client to pass locale environment variables
72+
AcceptEnv LANG LC_*
73+
74+
Subsystem sftp /usr/lib/openssh/sftp-server
75+
76+
# Set this to 'yes' to enable PAM authentication, account processing,
77+
# and session processing. If this is enabled, PAM authentication will
78+
# be allowed through the ChallengeResponseAuthentication and
79+
# PasswordAuthentication. Depending on your PAM configuration,
80+
# PAM authentication via ChallengeResponseAuthentication may bypass
81+
# the setting of "PermitRootLogin without-password".
82+
# If you just want the PAM account and session checks to run without
83+
# PAM authentication, then enable this but set PasswordAuthentication
84+
# and ChallengeResponseAuthentication to 'no'.
85+
UsePAM yes
86+
UseDNS no
87+
88+
AllowUsers <%= @allowed_users %>

0 commit comments

Comments
 (0)