Split out cgit module
Depends-On: Ibae9f2aa1d40d4b7afe0882c684251b5fc8a7135 Change-Id: I0c6ae1cf29924f1380288790fa53373d3767072d
This commit is contained in:
Jonathan Harker
Joshua Hesketh
parent
1fc55d4dc9
commit
1dcb21a849
@ -61,6 +61,7 @@ INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-ansible"]=
|
|||||||
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-asterisk"]="origin/master"
|
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-asterisk"]="origin/master"
|
||||||
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-bup"]="origin/master"
|
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-bup"]="origin/master"
|
||||||
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-bugdaystats"]="origin/master"
|
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-bugdaystats"]="origin/master"
|
||||||
|
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-cgit"]="origin/master"
|
||||||
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-elasticsearch"]="origin/master"
|
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-elasticsearch"]="origin/master"
|
||||||
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-etherpad_lite"]="origin/master"
|
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-etherpad_lite"]="origin/master"
|
||||||
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-elastic_recheck"]="origin/master"
|
INTEGRATION_MODULES["https://git.openstack.org/openstack-infra/puppet-elastic_recheck"]="origin/master"
|
||||||
|
|||||||
@ -1,14 +0,0 @@
|
|||||||
# default: off
|
|
||||||
# description: The git dæmon allows git repositories to be exported using \
|
|
||||||
# the git:// protocol.
|
|
||||||
|
|
||||||
service git
|
|
||||||
{
|
|
||||||
disable = yes
|
|
||||||
socket_type = stream
|
|
||||||
wait = no
|
|
||||||
user = nobody
|
|
||||||
server = /usr/libexec/git-core/git-daemon
|
|
||||||
server_args = --base-path=/var/lib/git --export-all --syslog --inetd --verbose /var/lib/git
|
|
||||||
log_on_failure += USERID
|
|
||||||
}
|
|
||||||
@ -1,175 +0,0 @@
|
|||||||
# Copyright 2013 Hewlett-Packard Development Company, L.P.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# Class: cgit
|
|
||||||
#
|
|
||||||
class cgit(
|
|
||||||
$vhost_name = $::fqdn,
|
|
||||||
$serveradmin = "webmaster@${::fqdn}",
|
|
||||||
$serveraliases = '',
|
|
||||||
$cgitdir = '/var/www/cgit',
|
|
||||||
$staticfiles = '/var/www/cgit/static',
|
|
||||||
$ssl_cert_file = '',
|
|
||||||
$ssl_key_file = '',
|
|
||||||
$ssl_chain_file = '',
|
|
||||||
$ssl_cert_file_contents = '', # If left empty puppet will not create file.
|
|
||||||
$ssl_key_file_contents = '', # If left empty puppet will not create file.
|
|
||||||
$ssl_chain_file_contents = '', # If left empty puppet will not create file.
|
|
||||||
$behind_proxy = false,
|
|
||||||
) {
|
|
||||||
|
|
||||||
if $behind_proxy == true {
|
|
||||||
$http_port = 8080
|
|
||||||
$https_port = 4443
|
|
||||||
$daemon_port = 29418
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
$http_port = 80
|
|
||||||
$https_port = 443
|
|
||||||
$daemon_port = 9418
|
|
||||||
}
|
|
||||||
|
|
||||||
include apache
|
|
||||||
|
|
||||||
if ($::osfamily == 'RedHat') {
|
|
||||||
include cgit::selinux
|
|
||||||
}
|
|
||||||
|
|
||||||
package { [
|
|
||||||
'cgit',
|
|
||||||
'git-daemon',
|
|
||||||
'highlight',
|
|
||||||
]:
|
|
||||||
ensure => present,
|
|
||||||
}
|
|
||||||
|
|
||||||
user { 'cgit':
|
|
||||||
ensure => present,
|
|
||||||
home => '/home/cgit',
|
|
||||||
shell => '/bin/bash',
|
|
||||||
gid => 'cgit',
|
|
||||||
managehome => true,
|
|
||||||
require => Group['cgit'],
|
|
||||||
}
|
|
||||||
|
|
||||||
group { 'cgit':
|
|
||||||
ensure => present,
|
|
||||||
}
|
|
||||||
|
|
||||||
file {'/home/cgit':
|
|
||||||
ensure => directory,
|
|
||||||
owner => 'cgit',
|
|
||||||
group => 'cgit',
|
|
||||||
mode => '0755',
|
|
||||||
require => User['cgit'],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { '/var/lib/git':
|
|
||||||
ensure => directory,
|
|
||||||
owner => 'cgit',
|
|
||||||
group => 'cgit',
|
|
||||||
mode => '0644',
|
|
||||||
require => User['cgit'],
|
|
||||||
}
|
|
||||||
|
|
||||||
apache::vhost { $vhost_name:
|
|
||||||
port => $https_port,
|
|
||||||
serveraliases => $serveraliases,
|
|
||||||
docroot => 'MEANINGLESS ARGUMENT',
|
|
||||||
priority => '50',
|
|
||||||
template => 'cgit/git.vhost.erb',
|
|
||||||
ssl => true,
|
|
||||||
require => [
|
|
||||||
File[$staticfiles],
|
|
||||||
Package['cgit'],
|
|
||||||
],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { '/etc/httpd/conf/httpd.conf':
|
|
||||||
ensure => present,
|
|
||||||
owner => 'root',
|
|
||||||
group => 'root',
|
|
||||||
mode => '0644',
|
|
||||||
content => template('cgit/httpd.conf.erb'),
|
|
||||||
require => Package['httpd'],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { '/etc/httpd/conf.d/ssl.conf':
|
|
||||||
ensure => present,
|
|
||||||
owner => 'root',
|
|
||||||
group => 'root',
|
|
||||||
mode => '0644',
|
|
||||||
content => template('cgit/ssl.conf.erb'),
|
|
||||||
require => Package[$::apache::params::ssl_package],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $cgitdir:
|
|
||||||
ensure => directory,
|
|
||||||
owner => 'root',
|
|
||||||
group => 'root',
|
|
||||||
mode => '0755',
|
|
||||||
}
|
|
||||||
|
|
||||||
file { $staticfiles:
|
|
||||||
ensure => directory,
|
|
||||||
owner => 'root',
|
|
||||||
group => 'root',
|
|
||||||
mode => '0755',
|
|
||||||
require => File[$cgitdir],
|
|
||||||
}
|
|
||||||
|
|
||||||
file { '/etc/init.d/git-daemon':
|
|
||||||
ensure => present,
|
|
||||||
owner => 'root',
|
|
||||||
group => 'root',
|
|
||||||
mode => '0755',
|
|
||||||
content => template('cgit/git-daemon.init.erb'),
|
|
||||||
}
|
|
||||||
|
|
||||||
service { 'git-daemon':
|
|
||||||
ensure => running,
|
|
||||||
enable => true,
|
|
||||||
subscribe => File['/etc/init.d/git-daemon'],
|
|
||||||
}
|
|
||||||
|
|
||||||
if $ssl_cert_file_contents != '' {
|
|
||||||
file { $ssl_cert_file:
|
|
||||||
owner => 'root',
|
|
||||||
group => 'root',
|
|
||||||
mode => '0640',
|
|
||||||
content => $ssl_cert_file_contents,
|
|
||||||
before => Apache::Vhost[$vhost_name],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if $ssl_key_file_contents != '' {
|
|
||||||
file { $ssl_key_file:
|
|
||||||
owner => 'root',
|
|
||||||
group => 'root',
|
|
||||||
mode => '0640',
|
|
||||||
content => $ssl_key_file_contents,
|
|
||||||
before => Apache::Vhost[$vhost_name],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
if $ssl_chain_file_contents != '' {
|
|
||||||
file { $ssl_chain_file:
|
|
||||||
owner => 'root',
|
|
||||||
group => 'root',
|
|
||||||
mode => '0640',
|
|
||||||
content => $ssl_chain_file_contents,
|
|
||||||
before => Apache::Vhost[$vhost_name],
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,55 +0,0 @@
|
|||||||
# Copyright 2014 Hewlett-Packard Development Company, L.P.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may
|
|
||||||
# not use this file except in compliance with the License. You may obtain
|
|
||||||
# a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
|
||||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
|
||||||
# License for the specific language governing permissions and limitations
|
|
||||||
# under the License.
|
|
||||||
#
|
|
||||||
# Class: cgit::selinux
|
|
||||||
#
|
|
||||||
class cgit::selinux {
|
|
||||||
exec { 'restorecon -R -v /var/lib/git':
|
|
||||||
path => '/sbin',
|
|
||||||
require => File['/var/lib/git'],
|
|
||||||
subscribe => File['/var/lib/git'],
|
|
||||||
refreshonly => true,
|
|
||||||
}
|
|
||||||
|
|
||||||
selboolean { 'httpd_enable_cgi':
|
|
||||||
persistent => true,
|
|
||||||
value => on
|
|
||||||
}
|
|
||||||
|
|
||||||
package { 'policycoreutils-python':
|
|
||||||
ensure => present,
|
|
||||||
}
|
|
||||||
|
|
||||||
exec { 'cgit_allow_http_port':
|
|
||||||
# If we cannot add the rule modify the existing rule.
|
|
||||||
onlyif => "bash -c \'! semanage port -a -t http_port_t -p tcp ${::cgit::http_port}\'",
|
|
||||||
command => "semanage port -m -t http_port_t -p tcp ${::cgit::http_port}",
|
|
||||||
path => '/bin:/usr/sbin',
|
|
||||||
before => Service['httpd'],
|
|
||||||
require => Package['policycoreutils-python'],
|
|
||||||
subscribe => File['/etc/httpd/conf/httpd.conf'],
|
|
||||||
refreshonly => true,
|
|
||||||
}
|
|
||||||
|
|
||||||
exec { 'cgit_allow_https_port':
|
|
||||||
# If we cannot add the rule modify the existing rule.
|
|
||||||
onlyif => "bash -c \'! semanage port -a -t http_port_t -p tcp ${::cgit::https_port}\'",
|
|
||||||
command => "semanage port -m -t http_port_t -p tcp ${::cgit::https_port}",
|
|
||||||
path => '/bin:/usr/sbin',
|
|
||||||
require => Package['policycoreutils-python'],
|
|
||||||
subscribe => File['/etc/httpd/conf.d/ssl.conf'],
|
|
||||||
refreshonly => true,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
@ -1,63 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
#
|
|
||||||
# Startup/shutdown script for the git daemon
|
|
||||||
# chkconfig: 345 56 10
|
|
||||||
#
|
|
||||||
# description: Startup/shutdown script for the git daemon
|
|
||||||
#
|
|
||||||
. /etc/init.d/functions
|
|
||||||
|
|
||||||
NAME=git-daemon
|
|
||||||
USER=nobody
|
|
||||||
DAEMON=/usr/libexec/git-core/git-daemon
|
|
||||||
GIT_REPO=/var/lib/git
|
|
||||||
PORT=<%= scope.lookupvar("cgit::daemon_port") %>
|
|
||||||
ARGS="--base-path=/var/lib/git --user=$USER --export-all --syslog --detach --verbose --port=$PORT $GIT_REPO"
|
|
||||||
|
|
||||||
start () {
|
|
||||||
echo -n $"Starting $NAME: "
|
|
||||||
|
|
||||||
# start daemon
|
|
||||||
daemon $DAEMON $ARGS
|
|
||||||
RETVAL=$?
|
|
||||||
echo
|
|
||||||
[ $RETVAL = 0 ] && touch /var/lock/git-daemon
|
|
||||||
return $RETVAL
|
|
||||||
}
|
|
||||||
|
|
||||||
stop () {
|
|
||||||
# stop daemon
|
|
||||||
|
|
||||||
echo -n $"Stopping $NAME: "
|
|
||||||
killproc $DAEMON
|
|
||||||
RETVAL=$?
|
|
||||||
echo
|
|
||||||
[ $RETVAL = 0 ] && rm -f /var/lock/git-daemon
|
|
||||||
}
|
|
||||||
|
|
||||||
restart() {
|
|
||||||
stop
|
|
||||||
start
|
|
||||||
}
|
|
||||||
|
|
||||||
case $1 in
|
|
||||||
start)
|
|
||||||
start
|
|
||||||
;;
|
|
||||||
stop)
|
|
||||||
stop
|
|
||||||
;;
|
|
||||||
restart)
|
|
||||||
restart
|
|
||||||
;;
|
|
||||||
status)
|
|
||||||
status $DAEMON
|
|
||||||
RETVAL=$?
|
|
||||||
;;
|
|
||||||
*)
|
|
||||||
echo $"Usage: $NAME {start|stop|restart|status}"
|
|
||||||
exit 3
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
|
|
||||||
exit $RETVAL
|
|
||||||
@ -1,70 +0,0 @@
|
|||||||
<VirtualHost *:<%= scope.lookupvar("cgit::http_port") %>>
|
|
||||||
ServerName <%= scope.lookupvar("cgit::vhost_name") %>
|
|
||||||
ServerAdmin <%= scope.lookupvar("cgit::serveradmin") %>
|
|
||||||
|
|
||||||
<% if @serveraliases.is_a? Array -%>
|
|
||||||
<% @serveraliases.each do |name| -%><%= " ServerAlias #{name}\n" %><% end -%>
|
|
||||||
<% elsif @serveraliases != '' -%>
|
|
||||||
<%= " ServerAlias #{@serveraliases}" -%>
|
|
||||||
<% end -%>
|
|
||||||
|
|
||||||
Alias /cgit-data /usr/share/cgit
|
|
||||||
ScriptAlias /cgit /var/www/cgi-bin/cgit
|
|
||||||
Alias /static <%= scope.lookupvar("cgit::staticfiles") %>
|
|
||||||
RewriteEngine On
|
|
||||||
RewriteRule ^/$ /cgit [R]
|
|
||||||
|
|
||||||
SetEnv GIT_PROJECT_ROOT /var/lib/git/
|
|
||||||
SetEnv GIT_HTTP_EXPORT_ALL
|
|
||||||
SetEnv GIT_NOTES_DISPLAY_REF refs/notes/*
|
|
||||||
|
|
||||||
AliasMatch ^/(.*/objects/[0-9a-f]{2}/[0-9a-f]{38})$ /var/lib/git/$1
|
|
||||||
AliasMatch ^/(.*/objects/pack/pack-[0-9a-f]{40}.(pack|idx))$ /var/lib/git/$1
|
|
||||||
ScriptAlias / /usr/libexec/git-core/git-http-backend/
|
|
||||||
|
|
||||||
ErrorLog /var/log/httpd/git-error.log
|
|
||||||
|
|
||||||
LogLevel warn
|
|
||||||
|
|
||||||
CustomLog /var/log/httpd/git-access.log combined
|
|
||||||
</VirtualHost>
|
|
||||||
|
|
||||||
<VirtualHost *:<%= scope.lookupvar("cgit::https_port") %>>
|
|
||||||
ServerName <%= scope.lookupvar("cgit::vhost_name") %>
|
|
||||||
ServerAdmin <%= scope.lookupvar("cgit::serveradmin") %>
|
|
||||||
|
|
||||||
<% if @serveraliases.is_a? Array -%>
|
|
||||||
<% @serveraliases.each do |name| -%><%= " ServerAlias #{name}\n" %><% end -%>
|
|
||||||
<% elsif @serveraliases != '' -%>
|
|
||||||
<%= " ServerAlias #{@serveraliases}" -%>
|
|
||||||
<% end -%>
|
|
||||||
|
|
||||||
Alias /cgit-data /usr/share/cgit
|
|
||||||
ScriptAlias /cgit /var/www/cgi-bin/cgit
|
|
||||||
Alias /static <%= scope.lookupvar("cgit::staticfiles") %>
|
|
||||||
RewriteEngine On
|
|
||||||
RewriteRule ^/$ /cgit [R]
|
|
||||||
|
|
||||||
SetEnv GIT_PROJECT_ROOT /var/lib/git/
|
|
||||||
SetEnv GIT_HTTP_EXPORT_ALL
|
|
||||||
SetEnv GIT_NOTES_DISPLAY_REF refs/notes/*
|
|
||||||
|
|
||||||
AliasMatch ^/(.*/objects/[0-9a-f]{2}/[0-9a-f]{38})$ /var/lib/git/$1
|
|
||||||
AliasMatch ^/(.*/objects/pack/pack-[0-9a-f]{40}.(pack|idx))$ /var/lib/git/$1
|
|
||||||
ScriptAlias / /usr/libexec/git-core/git-http-backend/
|
|
||||||
|
|
||||||
ErrorLog /var/log/httpd/git-error.log
|
|
||||||
|
|
||||||
LogLevel warn
|
|
||||||
|
|
||||||
CustomLog /var/log/httpd/git-access.log combined
|
|
||||||
|
|
||||||
SSLEngine on
|
|
||||||
SSLProtocol All -SSLv2 -SSLv3
|
|
||||||
|
|
||||||
SSLCertificateFile <%= scope.lookupvar("cgit::ssl_cert_file") %>
|
|
||||||
SSLCertificateKeyFile <%= scope.lookupvar("cgit::ssl_key_file") %>
|
|
||||||
<% if scope.lookupvar("cgit::ssl_chain_file") != "" %>
|
|
||||||
SSLCertificateChainFile <%= scope.lookupvar("cgit::ssl_chain_file") %>
|
|
||||||
<% end %>
|
|
||||||
</VirtualHost>
|
|
||||||
File diff suppressed because it is too large
Load Diff
@ -1,68 +0,0 @@
|
|||||||
#
|
|
||||||
# This is the Apache server configuration file providing SSL support.
|
|
||||||
# It contains the configuration directives to instruct the server how to
|
|
||||||
# serve pages over an https connection. For detailing information about these
|
|
||||||
# directives see <URL:http://httpd.apache.org/docs/2.2/mod/mod_ssl.html>
|
|
||||||
#
|
|
||||||
# Do NOT simply read the instructions in here without understanding
|
|
||||||
# what they do. They're here only as hints or reminders. If you are unsure
|
|
||||||
# consult the online docs. You have been warned.
|
|
||||||
#
|
|
||||||
|
|
||||||
LoadModule ssl_module modules/mod_ssl.so
|
|
||||||
|
|
||||||
#
|
|
||||||
# When we also provide SSL we have to listen to the
|
|
||||||
# the HTTPS port in addition.
|
|
||||||
#
|
|
||||||
Listen <%= scope.lookupvar("cgit::https_port") %>
|
|
||||||
|
|
||||||
##
|
|
||||||
## SSL Global Context
|
|
||||||
##
|
|
||||||
## All SSL configuration in this context applies both to
|
|
||||||
## the main server and all SSL-enabled virtual hosts.
|
|
||||||
##
|
|
||||||
|
|
||||||
# Pass Phrase Dialog:
|
|
||||||
# Configure the pass phrase gathering process.
|
|
||||||
# The filtering dialog program (`builtin' is a internal
|
|
||||||
# terminal dialog) has to provide the pass phrase on stdout.
|
|
||||||
SSLPassPhraseDialog builtin
|
|
||||||
|
|
||||||
# Inter-Process Session Cache:
|
|
||||||
# Configure the SSL Session Cache: First the mechanism
|
|
||||||
# to use and second the expiring timeout (in seconds).
|
|
||||||
SSLSessionCache shmcb:/var/cache/mod_ssl/scache(512000)
|
|
||||||
SSLSessionCacheTimeout 300
|
|
||||||
|
|
||||||
# Semaphore:
|
|
||||||
# Configure the path to the mutual exclusion semaphore the
|
|
||||||
# SSL engine uses internally for inter-process synchronization.
|
|
||||||
SSLMutex default
|
|
||||||
|
|
||||||
# Pseudo Random Number Generator (PRNG):
|
|
||||||
# Configure one or more sources to seed the PRNG of the
|
|
||||||
# SSL library. The seed data should be of good random quality.
|
|
||||||
# WARNING! On some platforms /dev/random blocks if not enough entropy
|
|
||||||
# is available. This means you then cannot use the /dev/random device
|
|
||||||
# because it would lead to very long connection times (as long as
|
|
||||||
# it requires to make more entropy available). But usually those
|
|
||||||
# platforms additionally provide a /dev/urandom device which doesn't
|
|
||||||
# block. So, if available, use this one instead. Read the mod_ssl User
|
|
||||||
# Manual for more details.
|
|
||||||
SSLRandomSeed startup file:/dev/urandom 256
|
|
||||||
SSLRandomSeed connect builtin
|
|
||||||
#SSLRandomSeed startup file:/dev/random 512
|
|
||||||
#SSLRandomSeed connect file:/dev/random 512
|
|
||||||
#SSLRandomSeed connect file:/dev/urandom 512
|
|
||||||
|
|
||||||
#
|
|
||||||
# Use "SSLCryptoDevice" to enable any supported hardware
|
|
||||||
# accelerators. Use "openssl engine -v" to list supported
|
|
||||||
# engine names. NOTE: If you enable an accelerator and the
|
|
||||||
# server does not start, consult the error logs and ensure
|
|
||||||
# your accelerator is functioning properly.
|
|
||||||
#
|
|
||||||
SSLCryptoDevice builtin
|
|
||||||
#SSLCryptoDevice ubsec
|
|
||||||
Loading…
x
Reference in New Issue
Block a user