{% from "ntp/map.jinja" import ntp with context %}
collectd_restart:
  cmd.wait:
    - name: service collectd restart
    - watch:
      - pkg: ntp

ntp:
  pkg.installed:
    - version: {{ ntp.version }}
  service.running:
    - watch:
      - file: /etc/ntp.conf
  file.managed:
    - name: /etc/ntp.conf
    - source: salt://ntp/templates/ntp.conf
    - mode: 644
    - template: jinja
    - require:
      - pkg: ntp

Fix collectd restart on ntp installation

{% from "ntp/map.jinja" import ntp with context %}
{% if salt['status.pid']('collectd') %}
collectd_restart:
  cmd.wait:
    - name: service collectd restart
    - watch:
      - pkg: ntp
{% endif %}

ntp:
  pkg.installed:
    - version: {{ ntp.version }}
  service.running:
    - watch:
      - file: /etc/ntp.conf
  file.managed:
    - name: /etc/ntp.conf
    - source: salt://ntp/templates/ntp.conf
    - mode: 644
    - template: jinja
    - require:
      - pkg: ntp


include:
  - EnterpriseLayer-HBSS.HBSS_iptables.sls
  - EnterpriseLayer-HBSS.HBSS_installsh_runner.sls

Remove suffixes from state-file includes

include:
  - EnterpriseLayer-HBSS.HBSS_iptables
  - EnterpriseLayer-HBSS.HBSS_installsh_runner


backerclient:
  user.present:
    - fullname: Backer Client User
    - shell: /bin/false
    - home: /home/backerclient
    - createhome: True
    - groups:
      - wheel

/home/backerclient/.ssh/:
  file.directory:
    - user: backerclient
    - group: users
    - mode: 700
    - require:
      - user: backerclient

ssh-keygen -N "" -f /home/backerclient/.ssh/id_rsa:
  cmd.run:
    - creates: /home/backerclient/.ssh/id_rsa

Make .ssh keys for backer user as the right user

backerclient:
  user.present:
    - fullname: Backer Client User
    - shell: /bin/false
    - home: /home/backerclient
    - createhome: True
    - groups:
      - wheel

/home/backerclient/.ssh/:
  file.directory:
    - user: backerclient
    - group: users
    - mode: 700
    - require:
      - user: backerclient

ssh-keygen -N "" -f /home/backerclient/.ssh/id_rsa:
  cmd.run:
    - user: backerclient
    - creates: /home/backerclient/.ssh/id_rsa
    - require:
      - user: backerclient


pip:
    pkg.installed:
        - name: python-pip

    pip.installed:
        - upgrade: True
        - require:
            - pkg: pip

virtualenv:
    pip.installed:
        - require:
            - pip: pip

python-dev:
    pkg.installed

pyopenssl-reqs:
    pkg.installed:
        - name: libffi-dev

pwm-server-virtualenv:
    virtualenv.managed:
        - name: /srv/pwm-server/venv

pwm-server:
    pip.installed:
        - name: /vagrant
        - upgrade: True
        - bin_env: /srv/pwm-server/venv
        - require:
            - virtualenv: pwm-server-virtualenv
            - pkg: python-dev

    service.running:
        - watch:
            - pip: pwm-server
            - file: pwm-server-config
            - file: pwm-server-job

pwm-server-config:
    file.managed:
        - name: /srv/pwm-server/config.py
        - source: salt://pwm-server/config.py

pwm-server-job:
    file.managed:
        - name: /etc/init/pwm-server.conf
        - source: salt://pwm-server/pwm-server.conf

Refactor salt state for pwm_server

pip:
    pkg.installed:
        - name: python-pip

    pip.installed:
        - upgrade: True
        - require:
            - pkg: pip

virtualenv:
    pip.installed:
        - require:
            - pip: pip

python-dev:
    pkg.installed

pyopenssl-reqs:
    pkg.installed:
        - name: libffi-dev

pwm-server:
    virtualenv.managed:
        - name: /srv/pwm-server/venv

    pip.installed:
        - name: /vagrant
        - upgrade: True
        - bin_env: /srv/pwm-server/venv
        - require:
            - virtualenv: pwm-server
            - pkg: python-dev

    file.managed:
        - name: /srv/pwm-server/config.py
        - source: salt://pwm-server/config.py

    service.running:
        - watch:
            - pip: pwm-server
            - file: pwm-server
            - file: pwm-server-job

pwm-server-job:
    file.managed:
        - name: /etc/init/pwm-server.conf
        - source: salt://pwm-server/pwm-server.conf


include:
  - latex
  - latex.xetex
  - pkgs.python.pip
  {%- if salt['config.get']('virtualenv_name', None)  %}
  - projects.virtualenv
  {%- endif %}
  - pkgs.python.sphinx
  - pkgs.system.dejavu-sans-fonts
  - pkgs.system.dejavu-sans-mono-fonts
  - pkgs.system.dejavu-serif-fonts

Make sure that the virtualenv is created

include:
  - latex
  - latex.xetex
  - pkgs.python.pip
  {%- if salt['config.get']('virtualenv_name', None)  %}
  - projects.virtualenv
  {%- endif %}
  - pkgs.python.sphinx
  - pkgs.system.dejavu-sans-fonts
  - pkgs.system.dejavu-sans-mono-fonts
  - pkgs.system.dejavu-serif-fonts

{%- if salt['config.get']('virtualenv_name', None)  %}
noop:
  test.succeed_without_changes:
    - require:
      - virtualenv: create-virtualenv
{%- endif %}


##########
# KOHA-COMMON
##########

local-apt-repo-priority:
  file.managed:
    - name: /etc/apt/preferences.d/local-apt-repo
    - source: salt://koha/files/local-apt-repo.tmpl

deichmanrepo:
  pkgrepo.managed:
    - name: deb http://datatest.deichman.no/repositories/koha/public/ wheezy main
    - watch:
      - file: local-apt-repo-priority

koharepo:
  pkgrepo.managed:
    - name: deb http://debian.koha-community.org/koha stable main
    - key_url: http://debian.koha-community.org/koha/gpg.asc

koha-common:
  pkg.installed:
    - skip_verify: True
    - version: 16.05.00+201606031346~patched
    - require:
      - pkgrepo: deichmanrepo
      - pkgrepo: koharepo

Update to 16.05.00+201606100734~patched with Plack fixes

##########
# KOHA-COMMON
##########

local-apt-repo-priority:
  file.managed:
    - name: /etc/apt/preferences.d/local-apt-repo
    - source: salt://koha/files/local-apt-repo.tmpl

deichmanrepo:
  pkgrepo.managed:
    - name: deb http://datatest.deichman.no/repositories/koha/public/ wheezy main
    - watch:
      - file: local-apt-repo-priority

koharepo:
  pkgrepo.managed:
    - name: deb http://debian.koha-community.org/koha stable main
    - key_url: http://debian.koha-community.org/koha/gpg.asc

koha-common:
  pkg.installed:
    - skip_verify: True
    - version: 16.05.00+201606100734~patched
    - require:
      - pkgrepo: deichmanrepo
      - pkgrepo: koharepo


#!stateconf
{% from 'states/nginx/map.jinja' import nginx as nginx_map with context %}

.params:
    stateconf.set: []
# --- end of state config ---

{% for protocol in ['http', 'https'] %}
{% if params[protocol] %}
nginx-iptables-{{ protocol }}:
  iptables.append:
    - table: filter
    - chain: ZONE_LOCAL
    - proto: tcp
    - jump: ACCEPT
    - dport: {{ nginx_map.ports[protocol] }}
    - family: ipv4
    - save: true
    - match: comment
    - comment: nginx {{ protocol|upper }}
    - require:
      - iptables: chain_zone_local_ipv4
{% endif %}
{% endfor %}

Add parameter for changing nginx access zone.

#!stateconf
{% from 'states/nginx/map.jinja' import nginx as nginx_map with context %}

.params:
    stateconf.set: []
# --- end of state config ---

{% for protocol in ['http', 'https'] %}
{% if params[protocol] %}
nginx-iptables-{{ protocol }}:
  iptables.append:
    - table: filter
    - chain: {{ 'ZONE_PUBLIC' if params.get('public', False) else 'ZONE_LOCAL' }}
    - proto: tcp
    - jump: ACCEPT
    - dport: {{ nginx_map.ports[protocol] }}
    - family: ipv4
    - save: true
    - match: comment
    - comment: nginx {{ protocol|upper }}
    - require:
      - iptables: chain_zone_local_ipv4
{% endif %}
{% endfor %}


/mnt/jenkins:
    file.directory: []

/etc/systemd/system/mnt-jenkins.mount:
    file.managed:
        - source: salt://slave/files/mnt-jenkins.mount
        - user: root
        - group: root
        - mode: 644

/etc/systemd/system/mnt-jenkins.automount:
    file.absent: []

mnt-jenkins.mount:
    service.running:
        - require:
            - file: /mnt/jenkins
            - file: /etc/systemd/system/mnt-jenkins.mount
            - file: /etc/systemd/system/mnt-jenkins.automount
        - enable: True

# vim: ft=yaml

Revert "jenkins: change automount to mount"

/mnt/jenkins:
    file.directory: []

/etc/systemd/system/mnt-jenkins.mount:
    file.managed:
        - source: salt://slave/files/mnt-jenkins.mount
        - user: root
        - group: root
        - mode: 644

/etc/systemd/system/mnt-jenkins.automount:
    file.absent: []

mnt-jenkins.automount:
    service.running:
        - require:
            - file: /mnt/jenkins
            - file: /etc/systemd/system/mnt-jenkins.mount
            - file: /etc/systemd/system/mnt-jenkins.automount
        - enable: True

# vim: ft=yaml


include:
  - kubectl-config

{%- set target = salt.caasp_pillar.get('target') %}
{%- set forced = salt.caasp_pillar.get('forced', False) %}

{%- set nodename = salt.caasp_net.get_nodename(host=target) %}

###############
# k8s cluster
###############

{%- set k8s_nodes = salt['mine.get']('roles:(kube-master|kube-minion)', 'nodename', tgt_type='grain_pcre').keys() %}
{%- if forced or target in k8s_nodes %}

{%- from '_macros/kubectl.jinja' import kubectl with context %}

{{ kubectl("remove-node",
           "delete node " + nodename) }}

{% endif %}

###############
# etcd node
###############

{%- set etcd_members = salt['mine.get']('roles:etcd', 'nodename', tgt_type='grain').keys() %}
{%- if forced or target in etcd_members %}

etcd-remove-member:
  caasp_etcd.member_remove:
  - nodename: {{ nodename }}

{%- endif %}

Use `expr_form` instead of `tgt_type` until we update salt

include:
  - kubectl-config

{%- set target = salt.caasp_pillar.get('target') %}
{%- set forced = salt.caasp_pillar.get('forced', False) %}

{%- set nodename = salt.caasp_net.get_nodename(host=target) %}

###############
# k8s cluster
###############

{%- set k8s_nodes = salt['mine.get']('roles:(kube-master|kube-minion)', 'nodename', expr_form='grain_pcre').keys() %}
{%- if forced or target in k8s_nodes %}

{%- from '_macros/kubectl.jinja' import kubectl with context %}

{{ kubectl("remove-node",
           "delete node " + nodename) }}

{% endif %}

###############
# etcd node
###############

{%- set etcd_members = salt['mine.get']('roles:etcd', 'nodename', expr_form='grain').keys() %}
{%- if forced or target in etcd_members %}

etcd-remove-member:
  caasp_etcd.member_remove:
  - nodename: {{ nodename }}

{%- endif %}


{% import 'project/_vars.sls' as vars with context %}

include:
  - supervisor.pip
  - project.dirs
  - project.venv
  - postfix

default_conf:
  file.managed:
    - name: /etc/supervisor/conf.d/{{ pillar['project_name'] }}-celery-default.conf
    - source: salt://project/worker/celery.conf
    - user: root
    - group: root
    - mode: 600
    - template: jinja
    - context:
        log_dir: "{{ vars.log_dir }}"
        settings: "{{ pillar['project_name'] }}.settings.deploy"
        virtualenv_root: "{{ vars.venv_dir }}"
        directory: "{{ vars.source_dir }}"
        name: "celery-default"
        use_newrelic: {{ vars.use_newrelic }}
        command: "worker"
        flags: "--loglevel=INFO"
    - require:
      - pip: supervisor
      - file: log_dir
      - pip: pip_requirements
    - watch_in:
      - cmd: supervisor_update

default_process:
  supervisord.running:
    - name: {{ pillar['project_name'] }}-celery-default
    - restart: True
    - require:
      - file: default_conf

Allow Celery worker arguments to be overridden

{% import 'project/_vars.sls' as vars with context %}

include:
  - supervisor.pip
  - project.dirs
  - project.venv
  - postfix

default_conf:
  file.managed:
    - name: /etc/supervisor/conf.d/{{ pillar['project_name'] }}-celery-default.conf
    - source: salt://project/worker/celery.conf
    - user: root
    - group: root
    - mode: 600
    - template: jinja
    - context:
        log_dir: "{{ vars.log_dir }}"
        settings: "{{ pillar['project_name'] }}.settings.deploy"
        virtualenv_root: "{{ vars.venv_dir }}"
        directory: "{{ vars.source_dir }}"
        name: "celery-default"
        use_newrelic: {{ vars.use_newrelic }}
        command: "worker"
        flags: "{{ pillar.get('celery_worker_arguments', '--loglevel=INFO') }}"
    - require:
      - pip: supervisor
      - file: log_dir
      - pip: pip_requirements
    - watch_in:
      - cmd: supervisor_update

default_process:
  supervisord.running:
    - name: {{ pillar['project_name'] }}-celery-default
    - restart: True
    - require:
      - file: default_conf


nginx:
  pkg.installed: []
  {% if grains.get('virtual_subtype', '') != 'Docker' %}
  service.running:
    - enable: True
    - watch:
      - pkg: nginx
      - file: /etc/nginx/sites-available/default
  {% endif %}

/etc/nginx/sites-available/default:
  file.managed:
    - source: salt://nginx/default
    - user: root
    - group: root
    - mode: 644

/etc/nginx/sites-enabled/default:
  file.symlink:
    - target: /etc/nginx/sites-available/default

Add cron job to renew build.servo.org cert.

nginx:
  pkg.installed: []
  {% if grains.get('virtual_subtype', '') != 'Docker' %}
  service.running:
    - enable: True
    - watch:
      - pkg: nginx
      - file: /etc/nginx/sites-available/default
  {% endif %}

/etc/nginx/sites-available/default:
  file.managed:
    - source: salt://nginx/default
    - user: root
    - group: root
    - mode: 644

/etc/nginx/sites-enabled/default:
  file.symlink:
    - target: /etc/nginx/sites-available/default

certbot:
  pkgrepo.managed:
    - ppa: certbot/certbot
  pkg.installed:
    - pkgs:
      - certbot
      - python-certbot-nginx

certbot renew:
  cron.present:
    - identifier: build-cert-renew
    - user: root
    - minute: 0
    - hour: 0
    - daymonth: 1
    - require:
      - pkg: certbot


redis-server:
    pkgrepo.managed:
        - ppa: chris-lea/redis-server
        - require_in:
            - pkg: redis-server
    pkg:
        - installed
    service.running:
        - enable: True
        - watch:
            - file: /etc/redis/common.conf
        - reload: True
        - require:
            - pkg: redis-server

/etc/redis/common.conf:
    file.managed:
        - source: salt://redis/files/common.conf
        - template: jinja
        - require:
            - pkg: redis-server

{% for server in pillar.get('redis', {}).get('servers', []) %}
/etc/redis/srv{{ server }}.conf:
    file.managed:
        - source: salt://redis/files/server.conf
        - template: jinja
        - context:
            server: {{ server }}
        - watch_in:
            - service: redis-server
        - require:
            - pkg: redis-server
{% endfor %}

/etc/init.d/redis-server:
    file.managed:
        - source: salt://redis/files/redis-server
        - mode: 755
        - watch_in:
            - service: redis-server
        - require:
            - pkg: redis-server

vm.overcommit_memory:
    sysctl.present:
        - value: 1
        - config: /etc/sysctl.d/10-redis.conf

Remove the default redis config

redis-server:
    pkgrepo.managed:
        - ppa: chris-lea/redis-server
        - require_in:
            - pkg: redis-server
    pkg:
        - installed
    service.running:
        - enable: True
        - watch:
            - file: /etc/redis/common.conf
        - reload: True
        - require:
            - pkg: redis-server

/etc/redis/common.conf:
    file.managed:
        - source: salt://redis/files/common.conf
        - template: jinja
        - require:
            - pkg: redis-server

/etc/redis/redis.conf:
    file.absent:
        - require:
            - file: /etc/redis/common.conf

{% for server in pillar.get('redis', {}).get('servers', []) %}
/etc/redis/srv{{ server }}.conf:
    file.managed:
        - source: salt://redis/files/server.conf
        - template: jinja
        - context:
            server: {{ server }}
        - watch_in:
            - service: redis-server
        - require:
            - pkg: redis-server
{% endfor %}

/etc/init.d/redis-server:
    file.managed:
        - source: salt://redis/files/redis-server
        - mode: 755
        - watch_in:
            - service: redis-server
        - require:
            - pkg: redis-server

vm.overcommit_memory:
    sysctl.present:
        - value: 1
        - config: /etc/sysctl.d/10-redis.conf


get-data:
  cmd.run:
    - name: wget http://rdspecialties.com/logs/access.log -O /opt/example-access.log
    - creates: /opt/example-access.log

insert-data:
  cmd.run:
    - name: cat /opt/example-access.log | nc localhost 3333
    - unless: test -d /var/lib/elasticsearch/elasticsearch/nodes/0/indices/logstash-*
    - require:
      - cmd: wget http://rdspecialties.com/logs/access.log -O /opt/example-access.log
      - service: logstash

create-dashboard:
  cmd.run:
    - name: elasticdump --input=/srv/salt/example-data/apache-kibana-dashboard.json --output=http://localhost:9200/.kibana
    - unless: test -d /var/lib/elasticsearch/elasticsearch/nodes/0/indices/.kibana
    - require:
      - npm: elasticdump
      - service: elasticsearch

Change the target example access log.

get-data:
  cmd.run:
    - name: wget http://derainsgharavi.com/liberys-access.log -O /opt/example-access.log
    - creates: /opt/example-access.log

insert-data:
  cmd.run:
    - name: cat /opt/example-access.log | nc localhost 3333
    - unless: test -d /var/lib/elasticsearch/elasticsearch/nodes/0/indices/logstash-*
    - require:
      - cmd: wget http://rdspecialties.com/logs/access.log -O /opt/example-access.log
      - service: logstash

create-dashboard:
  cmd.run:
    - name: elasticdump --input=/srv/salt/example-data/apache-kibana-dashboard.json --output=http://localhost:9200/.kibana
    - unless: test -d /var/lib/elasticsearch/elasticsearch/nodes/0/indices/.kibana
    - require:
      - npm: elasticdump
      - service: elasticsearch


#
# Install the Oozie package
#

{% set oozie_host = salt['mine.get']('G@stack_id:' ~ grains.stack_id ~ ' and G@roles:hdp2.oozie', 'grains.items', 'compound').values()[0]['fqdn'] %}

include:
  - hdp2.repo
{% if salt['pillar.get']('hdp2:security:enable', False) %}
  - krb5
  - hdp2.security
  - hdp2.oozie.security
{% endif %}

oozie-client:
  pkg:
    - installed
    - require:
      - module: hdp2_refresh_db

/etc/profile.d/oozie.sh:
  file:
    - managed
    - user: root
    - group: root
    - mode: 644
    - contents: export OOZIE_URL=http://{{ oozie_host }}:11000/oozie

Remove reference to non-existing module hdp2_refresh_db

#
# Install the Oozie package
#

{% set oozie_host = salt['mine.get']('G@stack_id:' ~ grains.stack_id ~ ' and G@roles:hdp2.oozie', 'grains.items', 'compound').values()[0]['fqdn'] %}

include:
  - hdp2.repo
{% if salt['pillar.get']('hdp2:security:enable', False) %}
  - krb5
  - hdp2.security
  - hdp2.oozie.security
{% endif %}

oozie-client:
  pkg:
    - installed

/etc/profile.d/oozie.sh:
  file:
    - managed
    - user: root
    - group: root
    - mode: 644
    - contents: export OOZIE_URL=http://{{ oozie_host }}:11000/oozie


# Values used only on the dev servers
default_branch: 'master'
domain_prefix: 'dev.'
banner_message: 'This is a development site with experimental features. Do not rely on it.'
cove:
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '1'
automatic_reboot: 'true'
extra_cove_branches:
# Add a new branch with the name of the branch, and increment the port number.
# Currently adding a new port number requires a manual uwsgi restart (ie. the
# reload in highstate will fail, so you will need to ssh and run "service uwsgi
# restart" instead)
  - name: minor-live-improvements
    uwsgi_port: 3032
  - name: stevens-fixes
    uwsgi_port: 3033
  - name: 43-catch-conversion-errors
    uwsgi_port: 3034

Add resourceprojects-wireframe cove dev branch

# Values used only on the dev servers
default_branch: 'master'
domain_prefix: 'dev.'
banner_message: 'This is a development site with experimental features. Do not rely on it.'
cove:
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '1'
automatic_reboot: 'true'
extra_cove_branches:
# Add a new branch with the name of the branch, and increment the port number.
# Currently adding a new port number requires a manual uwsgi restart (ie. the
# reload in highstate will fail, so you will need to ssh and run "service uwsgi
# restart" instead)
  - name: resourceprojects-wireframe
    uwsgi_port: 3032
  - name: stevens-fixes
    uwsgi_port: 3033
  - name: 43-catch-conversion-errors
    uwsgi_port: 3034


include:
  - devel.git

powerline-fonts:
  git.latest:
    - name: git://github.com/Lokaltog/powerline-fonts.git
    - runas: {{ pillar['username'] }}
    - target: /home/{{ pillar['username'] }}/.fonts/powerline
    - submodules: true
    - require:
      - pkg: git
  cmd.run:
    - name: fc-cache -fv
    - user: {{ pillar['username'] }}
    - group: {{ pillar['username'] }}
    - cwd: /home/{{ pillar['username'] }}
    - require:
      - git: powerline-fonts

Fix path to git saltstate

include:
  - vcs.git

powerline-fonts:
  git.latest:
    - name: git://github.com/Lokaltog/powerline-fonts.git
    - runas: {{ pillar['username'] }}
    - target: /home/{{ pillar['username'] }}/.fonts/powerline
    - submodules: true
    - require:
      - pkg: git
  cmd.run:
    - name: fc-cache -fv
    - user: {{ pillar['username'] }}
    - group: {{ pillar['username'] }}
    - cwd: /home/{{ pillar['username'] }}
    - require:
      - git: powerline-fonts


{% set image = 'elasticsearch' %}
{% set tag = '2.0.0-beta2' %}
{% set force_pull = false %}

{% include 'docker-pull.sls-fragment' %}

{% set container = 'elasticsearch_container' %}
{% set ports = ["9200/tcp", "9300/tcp"] %}
{% set environment = {} %}
{% set port_bindings = {'9200/tcp': { 'HostIp': pillar['redef']['elasticsearch']['http']['binding'], 'HostPort': pillar['redef']['elasticsearch']['http']['port'] } ,
                        '9300/tcp': { 'HostIp': pillar['redef']['elasticsearch']['native']['binding'], 'HostPort': pillar['redef']['elasticsearch']['native']['port'] } } %}
{% set data_volume = { 'container': 'elasticsearch_data', 'image': 'busybox', 'tag': 'latest', 'volumes': ['/usr/share/elasticsearch/data'] } %}
{% set command = 'elasticsearch --network.host _non_loopback_' %} # https://github.com/docker-library/elasticsearch/issues/52
{% set host_volume_bindings = [ { 'host': '/vagrant/salt/redef/elasticsearch/files/elasticsearch.yml', 'container': '/usr/share/elasticsearch/config/elasticsearch.yml', 'ro': false } ] %}

{% include 'docker-run.sls-fragment' %}

Remove files subdir in elasticsearch salt state

{% set image = 'elasticsearch' %}
{% set tag = '2.0.0-beta2' %}
{% set force_pull = false %}

{% include 'docker-pull.sls-fragment' %}

{% set container = 'elasticsearch_container' %}
{% set ports = ["9200/tcp", "9300/tcp"] %}
{% set environment = {} %}
{% set port_bindings = {'9200/tcp': { 'HostIp': pillar['redef']['elasticsearch']['http']['binding'], 'HostPort': pillar['redef']['elasticsearch']['http']['port'] } ,
                        '9300/tcp': { 'HostIp': pillar['redef']['elasticsearch']['native']['binding'], 'HostPort': pillar['redef']['elasticsearch']['native']['port'] } } %}
{% set data_volume = { 'container': 'elasticsearch_data', 'image': 'busybox', 'tag': 'latest', 'volumes': ['/usr/share/elasticsearch/data'] } %}
{% set command = 'elasticsearch --network.host _non_loopback_' %} # https://github.com/docker-library/elasticsearch/issues/52
{% set host_volume_bindings = [ { 'host': '/vagrant/salt/redef/elasticsearch/elasticsearch.yml', 'container': '/usr/share/elasticsearch/config/elasticsearch.yml', 'ro': false } ] %}

{% include 'docker-run.sls-fragment' %}


haskell:
  pkg.installed:
    - pkgs:
      - ghc
      - cabal-install
    - fromrepo: sid
    - refresh: True
    - requires:
      - pkg: apt-sources

zlib:
  pkg.installed:
    - pkgs:
      - zlib1g
      - zlib1g-dev

pcre:
  pkg.installed:
    - pkgs:
      - libpcre3
      - libpcre3-dev

happy:
  pkg.installed

cabal update:
  cmd.run:
    - user: vagrant
    # Don't update if the last update was within the last 10 days
    - unless: test -z "$(find ~vagrant/.cabal/packages/hackage.haskell.org/ -mtime +10 -name 00-index.\*)"
    - requires:
      - pkg: haskell

/etc/apt/preferences.d/haskell:
  file.managed:
    - source: salt://haskell/files/haskell.preferences
    - user: root
    - group: root
    - mode: 644
    - required_in:
      - pkg: haskell

Fix cabal update test for new installations

haskell:
  pkg.installed:
    - pkgs:
      - ghc
      - cabal-install
    - fromrepo: sid
    - refresh: True
    - requires:
      - pkg: apt-sources

zlib:
  pkg.installed:
    - pkgs:
      - zlib1g
      - zlib1g-dev

pcre:
  pkg.installed:
    - pkgs:
      - libpcre3
      - libpcre3-dev

happy:
  pkg.installed

cabal update:
  cmd.run:
    - user: vagrant
    # Don't update if the last update was within the last 10 days
    - unless: test -n "$(find ~vagrant/.cabal/packages/hackage.haskell.org/ -mtime -10 -name 00-index.\*)"
    - requires:
      - pkg: haskell

/etc/apt/preferences.d/haskell:
  file.managed:
    - source: salt://haskell/files/haskell.preferences
    - user: root
    - group: root
    - mode: 644
    - required_in:
      - pkg: haskell


Emet:
  5.1:
    installer: 'salt://emet_pkg/emetfiles/5.1/EMET Setup.msi'
    full_name: 'EMET 5.1'
    reboot: False
    install_flags: ' ALLUSERS=1 /quiet /qn /norestart'
    msiexec: True
    uninstaller: 'salt://emet_pkg/emetfiles/5.1/EMET Setup.msi'
    uninstall_flags: ' /qn'

Fix path to Emet installer

Emet:
  5.1:
    installer: 'salt://emet_pkg/emetfiles/5.1/EMET 5.1 Setup.msi'
    full_name: 'EMET 5.1'
    reboot: False
    install_flags: ' ALLUSERS=1 /quiet /qn /norestart'
    msiexec: True
    uninstaller: 'salt://emet_pkg/emetfiles/5.1/EMET 5.1 Setup.msi'
    uninstall_flags: ' /qn'


Init-control-node:
  cmd.run:
    - name: |
        zypper addrepo http://download.suse.de/ibs/Devel:/Galaxy:/ruby:/test/SLE_12/Devel:Galaxy:ruby:test.repo
        zypper addrepo http://download.suse.de/ibs/SUSE:/SLE-12:/Update/standard/SUSE:SLE-12:Update.repo
        zypper -n --gpg-auto-import-keys ref
        zypper -n in phantomjs

Enable rubygems and bin install

init-control-node-repo:
# control node is always sles-12-sp1, so stay true to KISS.
  cmd.run:
    - name: |
        zypper addrepo http://download.suse.de/ibs/Devel:/Galaxy:/ruby:/test/SLE_12/Devel:Galaxy:ruby:test.repo
        zypper addrepo http://download.suse.de/ibs/SUSE:/SLE-12:/Update/standard/SUSE:SLE-12:Update.repo
        zypper addrepo http://download.suse.de/ibs/Devel:/SLEnkins/SLE_12_SP1/Devel:SLEnkins.repo
        zypper addrepo http://dist.suse.de/install/SLP/SLE-12-SP1-Server-GM/x86_64/DVD1/ sles-12-sp1
        zypper addrepo http://download.suse.de/install/SLP/SLE-12-SP1-SDK-GM/x86_64/DVD1/ SDK
        zypper -n --gpg-auto-import-keys ref

binary-install:

  pkg.installed:
    - pkgs:
      - gcc
      - ruby
      - zlib-devel
      - ruby-devel
      - firefox-bin
      - apache2-worker
      - phantomjs
      - owasp-zap
      - mozilla-nss
# this are packaged gems
      - rubygem-cucumber
      - rubygem-syntax
      - twopence
      - rubygem-selenium-webdriver
      - ruby2.1-rubygem-poltergeist
      - rubygem-rack-1_2
      - rubygem-net-ssh
      - rubygem-websocket-1_0
      - rubygem-websocket-driver
      - ruby2.1-rubygem-jwt
      - rubygem-mime-types
      - ruby2.1-rubygem-builder
      - rubygem-owasp_zap
      - rubygem-cliver

gems-installation:

  gem.installed:
    - names:
       - rake
       - bundler
       - syntax
       - poltergeist
       - lavanda


{% from "template/map.jinja" import template with context %}

template:
  pkg:
    - installed
    - name: {{ template.pkg }}
  service:
    - running
    - name: {{ template.service }}
    - enable: True

Change states to use short-dec style

{% from "template/map.jinja" import template with context %}

template:
  pkg.installed:
    - name: {{ template.pkg }}
  service.running:
    - name: {{ template.service }}
    - enable: True


apache_certs:
  acme.cert:
    - name: {{ pillar['apache']['pki']['cn'] }}
    - aliases:
{% for san in pillar['apache']['pki']['san'] %}
      - {{ san }}
{% endfor %}
    - email: {{ pillar['apache']['pki']['email'] }}
    - renew: 14
    - require:
      pkg: python-certbot

python-certbot:
  pkg.latest

Fix error in pkg python-certbot requirement

apache_certs:
  acme.cert:
    - name: {{ pillar['apache']['pki']['cn'] }}
    - aliases:
{% for san in pillar['apache']['pki']['san'] %}
      - {{ san }}
{% endfor %}
    - email: {{ pillar['apache']['pki']['email'] }}
    - renew: 14
    - require:
      - pkg: python-certbot

python-certbot:
  pkg.latest


{% from "powerdns/map.jinja" import powerdns with context %}

include:
  - powerdns.config

powerdns_install_sqlite3:
  pkg.installed:
    - name: {{ powerdns.lookup.backend_sqlite3_pkg }}
    - require:
      - pkg: powerdns

powerdns_config_sqlite3:
  file.managed:
    {## Using .get below because direct access fails on the include keyword ##}
    - name: {{ powerdns.config.get('include-dir') }}/pdns.gsqlite3.conf
    - user: {{ powerdns.config.setuid }}
    - group: {{ powerdns.config.setuid }}
    - mode: 644
    - template: jinja
    - source: salt://powerdns/templates/pdns_sqlite.conf.jinja
    - makedirs: True

powerdns_schema_sqlite3:
  cmd.script:
    - source: salt://powerdns/files/sqlite_schema_load.sh
    - name: sqlite_schema_load.sh {{ powerdns.lookup.backend_sqlite3_file }}
    - runas: {{ powerdns.config.setuid }}
    - creates: {{ powerdns.lookup.backend_sqlite3_file }}
    - require:
      - pkg: {{ powerdns.lookup.backend_sqlite3_pkg }}

Create the sqlite3 data file directory

{% from "powerdns/map.jinja" import powerdns with context %}
{% set sqlite_data_dir = salt['file.basename'](powerdns.lookup.backend_sqlite3_file) %}
include:
  - powerdns.config

powerdns_install_sqlite3:
  pkg.installed:
    - name: {{ powerdns.lookup.backend_sqlite3_pkg }}
    - require:
      - pkg: powerdns

powerdns_config_sqlite3:
  file.managed:
    {## Using .get below because direct access fails on the include keyword ##}
    - name: {{ powerdns.config.get('include-dir') }}/pdns.gsqlite3.conf
    - user: {{ powerdns.config.setuid }}
    - group: {{ powerdns.config.setuid }}
    - mode: 644
    - template: jinja
    - source: salt://powerdns/templates/pdns_sqlite.conf.jinja
    - makedirs: True

powerdns_directory_sqlite3:
  file.directory:
    - name: {{ sqlite_data_dir }}
    - user: {{ powerdns.config.setuid }}
    - group: {{ powerdns.config.setuid }}
    - makedirs: True

powerdns_schema_sqlite3:
  cmd.script:
    - source: salt://powerdns/files/sqlite_schema_load.sh
    - name: sqlite_schema_load.sh {{ powerdns.lookup.backend_sqlite3_file }}
    - runas: {{ powerdns.config.setuid }}
    - creates: {{ powerdns.lookup.backend_sqlite3_file }}
    - require:
      - pkg: {{ powerdns.lookup.backend_sqlite3_pkg }}
      - file: {{ sqlite_data_dir }}


install_R:
  pkg.installed:
    - name: R

install_bioc_dependencies:
  pkg.installed:
    - pkgs:
      - libcurl-devel
      - libxml2-devel
      - openssl-devel

install_bioconductor:
  cmd.run:
    - name: /usr/bin/R --silent -e "source(\"https://bioconductor.org/biocLite.R\");biocLite();"

install_R_packages:
  cmd.run:
    - name: /usr/bin/R --silent -e "install.packages(c(\"data.table\", \"ggplot2\", \"splitstackshape\", \"devtools\", \"ggrepel\", \"rtracklayer\"))"

install_bioc_packages:
  cmd.run:
    - name: /usr/bin/R --silent -e "biocLite(c(\"VariantAnnotation\", \"GenomicFeatures\"));"

Add CRAN repo to package installation call.

install_R:
  pkg.installed:
    - name: R

install_bioc_dependencies:
  pkg.installed:
    - pkgs:
      - libcurl-devel
      - libxml2-devel
      - openssl-devel

install_bioconductor:
  cmd.run:
    - name: /usr/bin/R --silent -e "source(\"https://bioconductor.org/biocLite.R\");biocLite();"

install_R_packages:
  cmd.run:
    - name: /usr/bin/R --silent -e "install.packages(c(\"data.table\", \"ggplot2\", \"splitstackshape\", \"devtools\", \"ggrepel\", \"rtracklayer\"), repos=\"http://cran.us.r-project.org\")"

install_bioc_packages:
  cmd.run:
    - name: /usr/bin/R --silent -e "source(\"https://bioconductor.org/biocLite.R\");biocLite(c(\"VariantAnnotation\", \"GenomicFeatures\"));"


configure_nginx_status_module_for_edx:
  file.managed:
    - name: /etc/nginx/sites-enabled/status_monitor
    - contents: |
        server {
            listen 127.0.0.1:80;
            location /nginx_status {
                stub_status on;
                access_log off;
                allow 127.0.0.1;
                deny all;
            }
        }
    - group: www-data

reload_edx_nginx_service_after_updates:
  service.running:
    - name: nginx
    - reload: True
    - onchanges_any:
        - file: configure_nginx_status_module_for_edx
        - file: update_max_upload_size_for_lms

Remove outdated onchanges definition for edX Nginx service


# Include all Ubuntu related stuff for a desktop

setup multiverse:
  pkg.installed:
    - name: software-properties-common
  cmd.run:
    - name: add-apt-repository multiverse
    - require:
      - pkg: setup multiverse

desktop packages:
  pkg.installed:
    - pkgs:
      - chromium-browser
      - terminator
      - vim-gui-common

Install vim with python support

# Include all Ubuntu related stuff for a desktop

setup multiverse:
  pkg.installed:
    - name: software-properties-common
  cmd.run:
    - name: add-apt-repository multiverse
    - require:
      - pkg: setup multiverse

desktop packages:
  pkg.installed:
    - pkgs:
      - chromium-browser
      - terminator
      - vim-gtk
      - network-manager-openvpn


{% if grains['os'] == 'MacOS' %}

python2:
  pkg.installed:
    - pkgs:
      - python@2
    - refresh: True

python3:
  pkg.installed:
    - pkgs:
      - python

{% else %}

python2:
  pkg.installed:
    - pkgs:
      - python

python3:
  pkg.installed:
    - pkgs:
      - python3
      {% if grains['os'] == 'Ubuntu' %}
      {% if grains['osrelease'] == '14.04' %}
      - python3.4-venv
      {% else %}
      - python3-venv
      {% endif %}
      {% endif %}

{% endif %}

{% if grains['os'] == 'Ubuntu' %}
python2-dev:
  pkg.installed:
    - pkgs:
      - python-dev
{% endif %}

pip:
  pkg.installed:
    - pkgs:
      {% if grains['os'] in ['CentOS', 'Fedora', 'Ubuntu'] %}
      - python-pip
      {% elif grains['os'] == 'MacOS' %}
      - python@2 # pip is included with python in homebrew
      {% endif %}
    - reload_modules: True

# virtualenv == 14.0.6 package creates virtualenv and virtualenv-3.5 executables
# note that the version of the second may change between virtualenv versions
virtualenv:
  pip.installed:
    - pkgs:
      - virtualenv == 14.0.6
    {% if grains['os'] == 'MacOS' %}
    - ignore_installed: True
    {% endif %}
    - require:
      - pkg: pip

Install development python3 package on linux.

{% if grains['os'] == 'MacOS' %}

python2:
  pkg.installed:
    - pkgs:
      - python@2
    - refresh: True

python3:
  pkg.installed:
    - pkgs:
      - python

{% else %}

python2:
  pkg.installed:
    - pkgs:
      - python

python3:
  pkg.installed:
    - pkgs:
      - python3
      {% if grains['os'] == 'Ubuntu' %}
      {% if grains['osrelease'] == '14.04' %}
      - python3.4-venv
      {% else %}
      - python3-venv
      {% endif %}
      {% endif %}

{% endif %}

{% if grains['os'] == 'Ubuntu' %}
python-dev:
  pkg.installed:
    - pkgs:
      - python-dev
      - python3-dev
{% endif %}

pip:
  pkg.installed:
    - pkgs:
      {% if grains['os'] in ['CentOS', 'Fedora', 'Ubuntu'] %}
      - python-pip
      {% elif grains['os'] == 'MacOS' %}
      - python@2 # pip is included with python in homebrew
      {% endif %}
    - reload_modules: True

# virtualenv == 14.0.6 package creates virtualenv and virtualenv-3.5 executables
# note that the version of the second may change between virtualenv versions
virtualenv:
  pip.installed:
    - pkgs:
      - virtualenv == 14.0.6
    {% if grains['os'] == 'MacOS' %}
    - ignore_installed: True
    {% endif %}
    - require:
      - pkg: pip


# grantnav development
grantnav:
  allowedhosts: '.default.threesixtygiving.uk0.bigv.io'
  server_size: small
  branches:
    - master
    - iteration07.6
    - iteration08
    - 381-accents
  dataselections:
#    - all
    - acceptable_license_valid
#    - valid
  deploy_mode: matrix
  deploys:
    new:
      datadate: '2018-01-05'
    current:
      datadate: '2018-01-05'
    old:
      datadate: '2017-12-04'
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '6'

Add extra grantnav dev branch

# grantnav development
grantnav:
  allowedhosts: '.default.threesixtygiving.uk0.bigv.io'
  server_size: small
  branches:
    - master
    - iteration07.6
    - iteration08
    - 381-accents
    - 387-sum-currencies
  dataselections:
#    - all
    - acceptable_license_valid
#    - valid
  deploy_mode: matrix
  deploys:
    new:
      datadate: '2018-01-05'
    current:
      datadate: '2018-01-05'
    old:
      datadate: '2017-12-04'
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '6'


{% from "owncloud/map.jinja" import owncloud with context %}

include:
  - owncloud.server-repo

install-owncloud-server:
  pkg.latest:
    - name: {{ owncloud.pkg }}
    - refresh: True

autoconfig-owncloud-server:
  file.managed:
    - template: jinja
    - name: {{ owncloud.base_dir }}/config/autoconfig.php
    - source: salt://owncloud/files/autoconfig.php.jinja
    - user: www-data
    - group: www-data

Make autoconfig.php user and group configurable

{% from "owncloud/map.jinja" import owncloud with context %}

include:
  - owncloud.server-repo

install-owncloud-server:
  pkg.latest:
    - name: {{ owncloud.pkg }}
    - refresh: True

autoconfig-owncloud-server:
  file.managed:
    - template: jinja
    - name: {{ owncloud.base_dir }}/config/autoconfig.php
    - source: salt://owncloud/files/autoconfig.php.jinja
    - user: {{ owncloud.webserver_user }}
    - group: {{ owncloud.webserver_group }}


consul:
  group.present: []
  user.present:
    - shell: /usr/sbin/nologin
    - createhome: false
    - groups:
      - consul

{% for directory in
  "/opt/consul/",
  "/opt/consul/bin/",
  "/var/consul/",
  "/etc/consul.d/",
  "/etc/consul.d/ssl/"
%}
{{directory}}:
  file.directory:
    - user: consul
    - group: consul
{% endfor %}

packages:
  pkg.installed:
    - pkgs:
      - iptables-persistent
      - python-m2crypto

Kill off the salt minion

consul:
  group.present: []
  user.present:
    - shell: /usr/sbin/nologin
    - createhome: false
    - groups:
      - consul

{% for directory in
  "/opt/consul/",
  "/opt/consul/bin/",
  "/var/consul/",
  "/etc/consul.d/",
  "/etc/consul.d/ssl/"
%}
{{directory}}:
  file.directory:
    - user: consul
    - group: consul
{% endfor %}

packages:
  pkg.installed:
    - pkgs:
      - iptables-persistent
      - python-m2crypto

salt-minion:
  service.dead:
    - enable: false


{% set sublime = pillar.get('sublime-text', {}) %}
{% set build_def = sublime.get('build', '3126 sha256=f3f31634c05243e33a82a96e82c3cd691958057489e47eebe8ac3b0c0e6dd3b4') %}
{% set build, build_hash = build_def.split() %}

sublime-text:
    file.managed:
        - name: /usr/local/src/sublime-text_build-{{ build }}_amd64.deb
        - source: https://download.sublimetext.com/sublime-text_build-{{ build }}_amd64.deb
        - source_hash: {{ build_hash }}

    pkg.installed:
        - sources:
            - sublime-text: /usr/local/src/sublime-text_build-{{ build }}_amd64.deb

Update default sublime text version to 3

{% set sublime = pillar.get('sublime-text', {}) %}
{% set build_def = sublime.get('build', '3143 sha256=ecd78f6fd3a61dc2d68725a368343589d8df4193434c0275cd49b2026fd0fb81') %}
{% set build, build_hash = build_def.split() %}

sublime-text:
    file.managed:
        - name: /usr/local/src/sublime-text_build-{{ build }}_amd64.deb
        - source: https://download.sublimetext.com/sublime-text_build-{{ build }}_amd64.deb
        - source_hash: {{ build_hash }}

    pkg.installed:
        - sources:
            - sublime-text: /usr/local/src/sublime-text_build-{{ build }}_amd64.deb


base:
  '*':
    - users
    - sudoers

  'roles:salt-master':
    - match: grain
    - firewall.salt

Add the PSF-CA pillars to the dev pillars

base:
  '*':
    - users
    - sudoers
    - psf-ca

  'roles:salt-master':
    - match: grain
    - firewall.salt


{% set cron_day_spec = salt['pillar.get']('purge-old-kernels:cron_day_spec', '*/7') %}
{% set kernels_to_keep = salt['pillar.get']('purge-old-kernels:kernels_to_keep', 2) %}

include:
    - .
    - cronic

purge-old-kernels-cron:
    cron.present:
        - name: cronic /usr/local/bin/purge-old-kernels -y --keep {{ kernels_to_keep }}
        - identifier: purge-old-kernels-regularly
        - daymonth: '{{ cron_day_spec }}'

Add compatibility for old salt

{% set cron_day_spec = salt['pillar.get']('purge-old-kernels:cron_day_spec', '*/7') %}
{% set kernels_to_keep = salt['pillar.get']('purge-old-kernels:kernels_to_keep', 2) %}

include:
    - purge-old-kernels
    - cronic

purge-old-kernels-cron:
    cron.present:
        - name: cronic /usr/local/bin/purge-old-kernels -y --keep {{ kernels_to_keep }}
        - identifier: purge-old-kernels-regularly
        - daymonth: '{{ cron_day_spec }}'


influxdb:
  pkg.installed:
    - sources:
      - influxdb: http://influxdb.s3.amazonaws.com/influxdb_0.9.2_amd64.deb
  service.running:
    - require:
      - pkg: influxdb

/var/lib/.influxdb:
  file.directory:
    - user: influxdb
    - group: influxdb
    - dir_mode: 755
    - file_mode: 644
/var/lib/.influxdb/data:
  file.directory:
    - user: influxdb
    - group: influxdb
    - dir_mode: 755
    - file_mode: 644
/var/lib/.influxdb/meta:
  file.directory:
    - user: influxdb
    - group: influxdb
    - dir_mode: 755
    - file_mode: 644
/var/lib/.influxdb/hh:
  file.directory:
    - user: influxdb
    - group: influxdb
    - dir_mode: 755
    - file_mode: 644

/etc/opt/influxdb/influxdb.conf:
  file.managed:
    - source: salt://influxdb/config/influxdb.conf
    - user: influxdb
    - group: influxdb
    - mode: 644

influxdb_consul_config:
  file.managed:
    - name: /etc/consul.d/influxdb_consul.json
    - source: salt://influxdb/config/influxdb_consul.json
    - user: root
    - group: root
    - mode: 644
    - makedirs: True

Change InfluxDB package to RPM from Debian.

influxdb:
  pkg.installed:
    - sources:
      - influxdb: https://s3.amazonaws.com/influxdb/influxdb-0.9.3-1.x86_64.rpm
  service.running:
    - require:
      - pkg: influxdb

/var/lib/.influxdb:
  file.directory:
    - user: influxdb
    - group: influxdb
    - dir_mode: 755
    - file_mode: 644
/var/lib/.influxdb/data:
  file.directory:
    - user: influxdb
    - group: influxdb
    - dir_mode: 755
    - file_mode: 644
/var/lib/.influxdb/meta:
  file.directory:
    - user: influxdb
    - group: influxdb
    - dir_mode: 755
    - file_mode: 644
/var/lib/.influxdb/hh:
  file.directory:
    - user: influxdb
    - group: influxdb
    - dir_mode: 755
    - file_mode: 644

/etc/opt/influxdb/influxdb.conf:
  file.managed:
    - source: salt://influxdb/config/influxdb.conf
    - user: influxdb
    - group: influxdb
    - mode: 644

influxdb_consul_config:
  file.managed:
    - name: /etc/opt/consul.d/influxdb_consul.json
    - source: salt://influxdb/config/influxdb_consul.json
    - user: root
    - group: root
    - mode: 644
    - makedirs: True


versions:
{% if grains['cpuarch'] == 'armv6l' %}
  # RasPi v2,v3, OrangePi etc.
  arduino: 1.8.1-linuxarm
  nodejs: v6.9.5-linux-armv6l
  golang: 1.7.5.linux-armv6l
{% elif grains['osarch'] == 'armhf' %}
  # RasPi v1
  arduino: 1.8.1-linuxarm
  nodejs: v6.9.5-linux-armv7l
  golang: 1.7.5.linux-armv6l
{% else %}
  arduino: 1.8.1-linux64
  nodejs_version: v6.9.5-linux-amd64
  golang: 1.7.5.linux-amd64
{% endif %}

Fix x86 nodejs package name

versions:
{% if grains['cpuarch'] == 'armv6l' %}
  # RasPi v2,v3, OrangePi etc.
  arduino: 1.8.1-linuxarm
  nodejs: v6.9.5-linux-armv6l
  golang: 1.7.5.linux-armv6l
{% elif grains['osarch'] == 'armhf' %}
  # RasPi v1
  arduino: 1.8.1-linuxarm
  nodejs: v6.9.5-linux-armv7l
  golang: 1.7.5.linux-armv6l
{% else %}
  arduino: 1.8.1-linux64
  nodejs: v6.9.5-linux-x64
  golang: 1.7.5.linux-amd64
{% endif %}


include:
  - rabbitmq

broker-user-{{ pillar['project_name'] }}:
  rabbitmq_user.present:
    - name: {{ pillar['project_name'] }}
    - password: {{ pillar.get('secrets', {}).get('BROKER_PASSWORD') }}
    - force: True
    - require:
      - service: rabbitmq-server

broker-vhost-{{ pillar['project_name'] }}:
  rabbitmq_vhost.present:
    - name: {{ pillar['project_name'] }}_{{ pillar['environment'] }}
    - user: {{ pillar['project_name'] }}
    - require:
      - rabbitmq_user: broker-user-{{ pillar['project_name'] }}

Stop using deprecated rabbitmq_vhost parm

include:
  - rabbitmq

broker-user-{{ pillar['project_name'] }}:
  rabbitmq_user.present:
    - name: {{ pillar['project_name'] }}
    - password: {{ pillar.get('secrets', {}).get('BROKER_PASSWORD') }}
    - force: True
    - require:
      - service: rabbitmq-server

broker-vhost-{{ pillar['project_name'] }}:
  rabbitmq_vhost.present:
    - name: {{ pillar['project_name'] }}_{{ pillar['environment'] }}
    - owner: {{ pillar['project_name'] }}
    - require:
      - rabbitmq_user: broker-user-{{ pillar['project_name'] }}


# Git plugins and configuration Jenkins.

# Import generic template for Jenkins plugin installation.
{% from 'common/jenkins/install_plugin.sls' import jenkins_plugin_installation_macros with context %}

###############################################################################
# <<<
{% if grains['os'] in [ 'RedHat', 'CentOS' ] %}

{% endif %}
# >>>
###############################################################################

###############################################################################
# <<<
{% if grains['os'] in [ 'Fedora' ] %} # OS

include:
    - common.jenkins.master
    - common.jenkins.download_jenkins_cli_tool

{% for registered_content_item_id in [
        'jenkins_git-client_plugin',
        'jenkins_git_plugin',
    ]
%}

# This SLS id is used by template.
'{{ registered_content_item_id }}_jenkins_plugin_installation_prerequisite':
    cmd.run:
        - name: "echo dummy:{{ registered_content_item_id }}"
        - require:
            - sls: common.jenkins.master
            - sls: common.jenkins.download_jenkins_cli_tool

# Call generic template.
{{ jenkins_plugin_installation_macros(registered_content_item_id) }}

{% endfor %}

{% endif %} # OS
# >>>
###############################################################################

###############################################################################
# <<<
{% if grains['os'] in [ 'Windows' ] %}

{% endif %}
# >>>
###############################################################################

Complete Jenkins Git plugin auto-install with deps

# Git plugins and configuration Jenkins.

# Import generic template for Jenkins plugin installation.
{% from 'common/jenkins/install_plugin.sls' import jenkins_plugin_installation_macros with context %}

###############################################################################
# <<<
{% if grains['os'] in [ 'RedHat', 'CentOS' ] %}

{% endif %}
# >>>
###############################################################################

###############################################################################
# <<<
{% if grains['os'] in [ 'Fedora' ] %} # OS

include:
    - common.jenkins.master
    - common.jenkins.download_jenkins_cli_tool

# Git plugin and its dependencies.
{% for registered_content_item_id in [
        'jenkins_scm-api_plugin',
        'jenkins_git-client_plugin',
        'jenkins_git_plugin',
    ]
%}

# This SLS id is used by template.
'{{ registered_content_item_id }}_jenkins_plugin_installation_prerequisite':
    cmd.run:
        - name: "echo dummy:{{ registered_content_item_id }}"
        - require:
            - sls: common.jenkins.master
            - sls: common.jenkins.download_jenkins_cli_tool

# Call generic template.
{{ jenkins_plugin_installation_macros(registered_content_item_id) }}

{% endfor %}

{% endif %} # OS
# >>>
###############################################################################

###############################################################################
# <<<
{% if grains['os'] in [ 'Windows' ] %}

{% endif %}
# >>>
###############################################################################


{% set repo = 'digibib' %}
{% set image = 'redef-catalinker' %}
{% set tag = pillar['GITREF'] %}

{% include 'docker-pull.sls-fragment' %}

{% set container = 'redef_patron_client_container' %}
{% set ports = ['8010/tcp'] %}
{% set environment = { 'SERVICES_PORT': "tcp://{0}:{1}".format(pillar['redef']['services']['host'], pillar['redef']['services']['port']) } %}
{% set port_bindings = {'8010/tcp': { 'HostIp': pillar['redef']['catalinker']['binding'], 'HostPort': pillar['redef']['catalinker']['port'] } } %}

{% include 'docker-run.sls-fragment' %}

Fix cut and paste error

{% set repo = 'digibib' %}
{% set image = 'redef-catalinker' %}
{% set tag = pillar['GITREF'] %}

{% include 'docker-pull.sls-fragment' %}

{% set container = 'redef_catalinker_container' %}
{% set ports = ['8010/tcp'] %}
{% set environment = { 'SERVICES_PORT': "tcp://{0}:{1}".format(pillar['redef']['services']['host'], pillar['redef']['services']['port']) } %}
{% set port_bindings = {'8010/tcp': { 'HostIp': pillar['redef']['catalinker']['binding'], 'HostPort': pillar['redef']['catalinker']['port'] } } %}

{% include 'docker-run.sls-fragment' %}


cmake:
  pkg.installed

git:
  pkg.installed

virtualenv:
  pip.installed

ghp-import:
  pip.installed

{% if grains["kernel"] != "Darwin" %}
libglib2.0-dev:
  pkg.installed

libgl1-mesa-dri:
  pkg.installed

freeglut3-dev:
  pkg.installed

libfreetype6-dev:
  pkg.installed

xorg-dev:
  pkg.installed

libssl-dev:
  pkg.installed

libbz2-dev:
  pkg.installed

xserver-xorg-input-void:
  pkg.installed

xserver-xorg-video-dummy:
  pkg.installed

xpra:
  pkg.installed

libosmesa6-dev:
  pkg.installed

{% else %}

pkg-config:
  pkg.installed

{% endif %}

Add gperf, which is apparently needed by freetype-sys in some cases.

cmake:
  pkg.installed

git:
  pkg.installed

virtualenv:
  pip.installed

ghp-import:
  pip.installed

{% if grains["kernel"] != "Darwin" %}
libglib2.0-dev:
  pkg.installed

libgl1-mesa-dri:
  pkg.installed

freeglut3-dev:
  pkg.installed

libfreetype6-dev:
  pkg.installed

xorg-dev:
  pkg.installed

libssl-dev:
  pkg.installed

libbz2-dev:
  pkg.installed

xserver-xorg-input-void:
  pkg.installed

xserver-xorg-video-dummy:
  pkg.installed

xpra:
  pkg.installed

libosmesa6-dev:
  pkg.installed

gperf:
  pkg.installed

{% else %}

pkg-config:
  pkg.installed

{% endif %}


# Require:
#  https://github.com/trexglobal/apache-formula
#  https://github.com/trexglobal/php-formula
#  https://github.com/trexglobal/mysql-formula

include:
    - apache
    - apache.default
    - apache.vhosts.standard
    - apache.rewrite
    - apache.utils
    - mysql.server
    - .mysql
    - php
    - php.mysql

Fix mysql to update users and databases as well

# Require:
#  https://github.com/trexglobal/apache-formula
#  https://github.com/trexglobal/php-formula
#  https://github.com/trexglobal/mysql-formula

include:
    - apache
    - apache.default
    - apache.vhosts.standard
    - apache.rewrite
    - apache.utils
    - mysql
    - .mysql
    - php
    - php.mysql


{% set os = salt['grains.get']('os', '') %}
{% set os_family = salt['grains.get']('os_family', '') %}
{% set os_major_release = salt['grains.get']('osmajorrelease', '') %}

{% if os_family == 'RedHat' %}
  {% if os == 'Fedora' %}
    {% set repotype = 'fedora' %}
  {% else %}
    {% set repotype = 'epel' %}
  {% endif %}

include:
   - test_install.epel

{% if os_major_release == '5' %}
python-hashlib:
  pkg.installed:
    - require_in:
      - pkgrepo: saltstack-copr
{% endif %}

saltstack-copr:
  pkgrepo.managed:
    - humanname: Copr repo for salt owned by saltstack
    - baseurl: http://copr-be.cloud.fedoraproject.org/results/saltstack/salt/{{ repotype }}-{{ salt['grains.get']('osmajorrelease') }}-$basearch/
    - gpgcheck: 0
    - skip_if_unavailable: True
    - enabled: 1
    - require_in:
      - cmd: yum_update

{% elif os == 'Debian' %}
include:
  - test_install.debian

# Get the GPG key for Debian/Ubuntu Packages
debian_key:
  cmd.run:
    - name: wget -O - http://debian.saltstack.com/debian-salt-team-joehealy.gpg.key|apt-key add -
    - require_in:
      - file: sources_list_prep

{% endif %}

Remove python-hashlib requirement for RHEL 5

{% set os = salt['grains.get']('os', '') %}
{% set os_family = salt['grains.get']('os_family', '') %}
{% set os_major_release = salt['grains.get']('osmajorrelease', '') %}

{% if os_family == 'RedHat' %}
  {% if os == 'Fedora' %}
    {% set repotype = 'fedora' %}
  {% else %}
    {% set repotype = 'epel' %}
  {% endif %}

include:
   - test_install.epel

saltstack-copr:
  pkgrepo.managed:
    - humanname: Copr repo for salt owned by saltstack
    - baseurl: http://copr-be.cloud.fedoraproject.org/results/saltstack/salt/{{ repotype }}-{{ salt['grains.get']('osmajorrelease') }}-$basearch/
    - gpgcheck: 0
    - skip_if_unavailable: True
    - enabled: 1
    - require_in:
      - cmd: yum_update

{% elif os == 'Debian' %}
include:
  - test_install.debian

# Get the GPG key for Debian/Ubuntu Packages
debian_key:
  cmd.run:
    - name: wget -O - http://debian.saltstack.com/debian-salt-team-joehealy.gpg.key|apt-key add -
    - require_in:
      - file: sources_list_prep

{% endif %}


# Values used on all servers. These may be overwritten.
domain_prefix: ''
automatic_reboot: 'false'
extra_cove_branches: []

Add defaults for allowedhosts and prefixmap

# Values used on all servers. These may be overwritten.
domain_prefix: ''
automatic_reboot: 'false'
extra_cove_branches: []
cove:
  allowedhosts: '.cove.opendataservices.coop'
  prefixmap: ''


include:
  - python

aws-cli:
  pip.installed:
    - pkgs:
      - awscli
    - require:
      - pkg: pip
      - pip: virtualenv

unzip:
  pkg.installed:
    - name: unzip

Add proxychains package for warc testing

include:
  - python

aws-cli:
  pip.installed:
    - pkgs:
      - awscli
    - require:
      - pkg: pip
      - pip: virtualenv

unzip:
  pkg.installed:
    - name: unzip

# Proxychains is used for performance testing on archived web content
# https://github.com/servo/servo-warc-tests/
proxychains:
  pkg.installed:
    - name: proxychains


base:
  '*':
    - development
    - extra_packages
    - iptables
    - ntp
    - postfix.common
    - salt
    - ssh
    - sudo
    - timezones
    - users
  'jupiter.djl.im':
    - debsecan
    - logcheck
    - misc.jupiter
    - postfix.outbound
    - sabnzbd
    - sickbeard
    - smartmontools
  'neptune.djl.im':
    - misc.neptune
    - postfix.outbound
    - udev
    - xbmc
  'wilde.djl.im':
    - debsecan
    - logcheck
    - postfix.outbound
    - znc

Add dnsmasq, openvpn to wilde.

base:
  '*':
    - development
    - extra_packages
    - iptables
    - ntp
    - postfix.common
    - salt
    - ssh
    - sudo
    - timezones
    - users
  'jupiter.djl.im':
    - debsecan
    - logcheck
    - misc.jupiter
    - postfix.outbound
    - sabnzbd
    - sickbeard
    - smartmontools
  'neptune.djl.im':
    - misc.neptune
    - postfix.outbound
    - udev
    - xbmc
  'wilde.djl.im':
    - debsecan
    - dnsmasq
    - logcheck
    - openvpn
    - postfix.outbound
    - znc


###############################################################################
#

# Import properties.
{% set properties_path = profile_root.replace('.', '/') + '/properties.yaml' %}
{% import_yaml properties_path as props %}

{% set master_minion_id = props['master_minion_id'] %}

system_features:

    wildfly_deployments:

        standard_wildfly:
            resource_id: wildfly_application_server_distribution_zip
            archive_format: zip
            root_subdir: 'wildfly-10.0.0.Final'
            owner_user: master_minion_user
            destination_dir_path: Apps/wildfly/standard_wildfly

    wildfly_instances:

        node-1:
            target_system_role: wildfly_node_1_role
            deployment_id: standard_wildfly

            file_templates:
                example:
                    source_url:
                    destination_path:
                    config_data:

        node-2:
            target_system_role: wildfly_node_2_role
            deployment_id: standard_wildfly

            file_templates:
                example:
                    source_url:
                    destination_path:
                    config_data:

###############################################################################
# EOF
###############################################################################

Update wildfly config to create instances

###############################################################################
#

# Import properties.
{% set properties_path = profile_root.replace('.', '/') + '/properties.yaml' %}
{% import_yaml properties_path as props %}

{% set master_minion_id = props['master_minion_id'] %}

system_features:

    wildfly_deployments:

        standard_wildfly:
            resource_id: wildfly_application_server_distribution_zip
            archive_format: zip
            root_subdir: 'wildfly-10.0.0.Final'
            owner_user: master_minion_user
            destination_dir_path: Apps/wildfly/standard_wildfly

    wildfly_instances:

        node-1:
            target_system_role: wildfly_node_1_role
            deployment_id: standard_wildfly

            file_templates:
                example:
                    source_url: 'salt://common/wildfly/templates/standalone.xml'
                    template_type: jinja
                    destination_path: 'configuration/standalone.xml'
                    config_data:
                        key1: value1
                        key2: value2

        node-2:
            target_system_role: wildfly_node_2_role
            deployment_id: standard_wildfly

            file_templates:
                example:
                    source_url: 'salt://common/wildfly/templates/standalone.xml'
                    template_type: jinja
                    destination_path: 'configuration/standalone.xml'
                    config_data:
                        key1: value1
                        key2: value2

###############################################################################
# EOF
###############################################################################


include:
    - sun-java
    - sun-java.env

daemon:
    pkg.installed: []

download:
    file.managed:
        - name: /tmp/keycloak.tar.gz
        - source:
            - salt://keycloak/files/keycloak-1.9.1.Final.tar.gz
            - http://downloads.jboss.org/keycloak/1.9.1.Final/keycloak-1.9.1.Final.tar.gz
    cmd.run:
        - name: |
            cd /srv/
            tar -x -z -f /tmp/keycloak.tar.gz -C /srv
            ln -s keycloak-1.9.1.Final keycloak
        - user: root
        - group: root

keycloak-config:
    file.managed:
        - name: /srv/keycloak/standalone/configuration/standalone.xml
        - source: salt://keycloak/files/standalone.xml
        - mode: 400
        - require:
            - file: download

keycloak-init.d:
    file.managed:
        - name: /etc/init.d/keycloak
        - source: salt://keycloak/files/service.sh
        - user: root
        - group: root
        - mode: 555
        - require:
            - pkg: daemon
    cmd.run:
        - name: update-rc.d keycloak defaults 99
        - user: root

create-java-symlink:
    file.symlink:
        - name: /usr/bin/java
        - target: /usr/lib/java/bin/java
        - force: True
        - user: root
        - group: root

Update Keycloak config file permissions

include:
    - sun-java
    - sun-java.env

daemon:
    pkg.installed: []

download:
    file.managed:
        - name: /tmp/keycloak.tar.gz
        - source:
            - salt://keycloak/files/keycloak-1.9.1.Final.tar.gz
            - http://downloads.jboss.org/keycloak/1.9.1.Final/keycloak-1.9.1.Final.tar.gz
    cmd.run:
        - name: |
            cd /srv/
            tar -x -z -f /tmp/keycloak.tar.gz -C /srv
            ln -s keycloak-1.9.1.Final keycloak
        - user: root
        - group: root

keycloak-config:
    file.managed:
        - name: /srv/keycloak/standalone/configuration/standalone.xml
        - source: salt://keycloak/files/standalone.xml
        - mode: 644
        - require:
            - file: download

keycloak-init.d:
    file.managed:
        - name: /etc/init.d/keycloak
        - source: salt://keycloak/files/service.sh
        - user: root
        - group: root
        - mode: 555
        - require:
            - pkg: daemon
    cmd.run:
        - name: update-rc.d keycloak defaults 99
        - user: root

create-java-symlink:
    file.symlink:
        - name: /usr/bin/java
        - target: /usr/lib/java/bin/java
        - force: True
        - user: root
        - group: root


##########
# KOHA-COMMON
##########

local-apt-repo-priority:
  file.managed:
    - name: /etc/apt/preferences.d/local-apt-repo
    - source: salt://koha/files/local-apt-repo.tmpl

deichmanrepo:
  pkgrepo.managed:
    - name: deb http://datatest.deichman.no/repositories/koha/public/ wheezy main
    - watch:
      - file: local-apt-repo-priority

koharepo:
  pkgrepo.managed:
    - name: deb http://debian.koha-community.org/koha stable main
    - key_url: http://debian.koha-community.org/koha/gpg.asc

koha-common:
  pkg.installed:
    - skip_verify: True
    - version: 16.05.00+201606031204~patched
    - require:
      - pkgrepo: deichmanrepo
      - pkgrepo: koharepo

Update koha patched to fix missing biblio definitions in API

##########
# KOHA-COMMON
##########

local-apt-repo-priority:
  file.managed:
    - name: /etc/apt/preferences.d/local-apt-repo
    - source: salt://koha/files/local-apt-repo.tmpl

deichmanrepo:
  pkgrepo.managed:
    - name: deb http://datatest.deichman.no/repositories/koha/public/ wheezy main
    - watch:
      - file: local-apt-repo-priority

koharepo:
  pkgrepo.managed:
    - name: deb http://debian.koha-community.org/koha stable main
    - key_url: http://debian.koha-community.org/koha/gpg.asc

koha-common:
  pkg.installed:
    - skip_verify: True
    - version: 16.05.00+201606031346~patched
    - require:
      - pkgrepo: deichmanrepo
      - pkgrepo: koharepo


org_ids:
  default_branch: 'master'
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '11'
extra_org_ids_branches: [] # remove the [] (empty list) if you re-add some values below

Add live branch to org-ids

org_ids:
  default_branch: 'live'
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '11'
extra_org_ids_branches: [] # remove the [] (empty list) if you re-add some values below


#!stateconf
{% from 'states/openvpn/map.jinja' import openvpn as openvpn_map with context %}
{% from 'states/defaults.map.jinja' import defaults with context %}

.params:
    stateconf.set: []
# --- end of state config ---

{% for vpnname, vpn in params.vpns.items() %}
openvpn-client-{{ vpnname }}-service:
  service.running:
    - name: {{ openvpn_map.client.service|format('client-' + vpnname) }}
    - enable: True
    - require:
      - pkg: openvpn
{% endfor %}

Fix OpenVPN service state for non-systemd systems.

#!stateconf
{% from 'states/openvpn/map.jinja' import openvpn as openvpn_map with context %}
{% from 'states/defaults.map.jinja' import defaults with context %}

.params:
    stateconf.set: []
# --- end of state config ---

{% for vpnname, vpn in params.vpns.items() %}
openvpn-client-{{ vpnname }}-service:
  service.running:
    {% if '%s' in openvpn.server.service %}
    - name: {{ openvpn_map.client.service|format('client-' + vpnname) }}
    {% else %}
    - name: {{ openvpn.server.service }}
    {% endif %}

    - enable: True
    - require:
      - pkg: openvpn
{% endfor %}


include:
  - users.groups

{% if 'users' in pillar and pillar['users'] %}
{% for user, args in pillar['users'].iteritems() %}
{{ user }}:
  user.present:
    - name: {{ user }}
    - shell: /bin/bash
    - home: /home/{{ user }}
    - remove_groups: False
{% if 'groups' in args %}
    - groups: {{ args['groups'] }}
{% else %}
    - groups: [admin, login]
    - require:
      - group: admin
      - group: login
{% endif %}

{% if 'public_key' in args %}
  ssh_auth:
    - present
    - user: {{ user }}
    - require:
      - user: {{ user }}
    - names:
{%- for key in args.get('public_key', []) %}
      - {{ key }}
{% endfor %}
{% endif %}

{% endfor %}
{% endif %}

{% if 'users' in pillar and pillar['users'] %}
purge_users:
  cmd.script:
    - cwd: /var/www/{{ pillar['project_name']}}-{{ pillar['environment']}}
    - name: salt://users/purge-users.py {% for user in pillar['users'] %}--keep={{ user }} {% endfor %}
    - user: root
    - require:
{% for user in pillar['users'] %}
      - user: {{ user }}
{% endfor %}
{% endif %}

Fix working directory for purge script

include:
  - users.groups

{% if 'users' in pillar and pillar['users'] %}
{% for user, args in pillar['users'].iteritems() %}
{{ user }}:
  user.present:
    - name: {{ user }}
    - shell: /bin/bash
    - home: /home/{{ user }}
    - remove_groups: False
{% if 'groups' in args %}
    - groups: {{ args['groups'] }}
{% else %}
    - groups: [admin, login]
    - require:
      - group: admin
      - group: login
{% endif %}

{% if 'public_key' in args %}
  ssh_auth:
    - present
    - user: {{ user }}
    - require:
      - user: {{ user }}
    - names:
{%- for key in args.get('public_key', []) %}
      - {{ key }}
{% endfor %}
{% endif %}

{% endfor %}
{% endif %}

{% if 'users' in pillar and pillar['users'] %}
purge_users:
  cmd.script:
    - cwd: /var/www/{{ pillar['project_name']}}
    - name: salt://users/purge-users.py {% for user in pillar['users'] %}--keep={{ user }} {% endfor %}
    - user: root
    - require:
{% for user in pillar['users'] %}
      - user: {{ user }}
{% endfor %}
{% endif %}


include:
  - pkgs.system.gcc
  - pkgs.python.pip
  - pkgs.system.swig

pyzmq:
  pip.installed:
    {%- if salt['config.get']('virtualenv_name', None)  %}
    - bin_env: /srv/virtualenvs/{{ salt['config.get']('virtualenv_name') }}
    {%- endif %}
    - index_url: https://pypi-jenkins.saltstack.com/jenkins/develop
    - extra_index_url: https://pypi.python.org/simple
    - require:
      - pip: pip
      - pkg: gcc
      - pkg: swig

Add global and install options

include:
  - pkgs.system.gcc
  - pkgs.python.pip
  - pkgs.system.swig

pyzmq:
  pip.installed:
    {%- if salt['config.get']('virtualenv_name', None)  %}
    - bin_env: /srv/virtualenvs/{{ salt['config.get']('virtualenv_name') }}
    {%- endif %}
    - index_url: https://pypi-jenkins.saltstack.com/jenkins/develop
    - extra_index_url: https://pypi.python.org/simple
    - global-options:
      - fetch_libzmq
    - install-options:
      - --zmq=bundled
    - require:
      - pip: pip
      - pkg: gcc
      - pkg: swig


base:
  '*':
    - condiments
    - spack
    - funwith
    - setup_github
    - apps
    - karabiner
    - applications
    - devapps
    - git
    - zsh
    - dotfiles

Remove devapps - done through pillars

base:
  '*':
    - condiments
    - spack
    - funwith
    - setup_github
    - apps
    - karabiner
    - git
    - zsh
    - dotfiles


sudo:
  service:
    - running
    - enable: True
    - reload: True
    - watch:
      - pkg: sudo

/etc/sudoers.d/admin:
  file.managed:
    - source: salt://sudo/sudoers.d/admin
    - user: root
    - mode: 440

Fix sudo state dependencies and minor clean up.

/etc/sudoers.d/admin:
  file.managed:
    - source: salt://sudo/sudoers.d/admin
    - user: root
    - mode: 440

sudo:
  service:
    - running
    - enable: True
    - reload: True
    - require:
      - pkg: base-packages
    - watch:
      - file: /etc/sudoers.d/admin


pypi:
  group:
    - present
  user.present:
    - home: /var/local/pypi
    - shell: /bin/bash
    - gid_from_name: True
    - require:
      - group: pypi
  pip.installed:
    - name: pypiserver
    - require:
      - user: pypi
  file.directory:
    - name: /var/local/pypi/packages:
    - user: pypi
    - group: pypi
    - recurse:
      - user
      - group
    - require:
      - user: pypi
  file.managed:
    - name: /etc/init.d/pypiserver
    - source: salt://pypi/pypiserver.init
    - mode: 755
  file.managed:
    - name: /etc/default/pypiserver
    - source: salt://pypi/pypiserver.conf
  service.running:
    - name: pypiserver
    - enabled: True
    - require:
      - file: /var/local/pypi/packages
      - file: /etc/init.d/pypiserver
      - file: /etc/default/pypiserver

Refactor a few things into pillar.

pypi:
  group:
    - present
  user.present:
    - home: {{ pillar['pypi']['home'] }}
    - shell: /bin/bash
    - gid_from_name: True
    - require:
      - group: pypi

pypiserver:
  pip.installed:
    - require:
      - user: pypi
  service.running:
    - enabled: True
    - require:
      - file: {{ pillar['pypi']['path'] }}
      - file: /etc/init.d/pypiserver
      - file: /etc/default/pypiserver

{{ pillar['pypi']['path'] }}:
  file.directory:
    - makedirs: True
    - user: pypi
    - group: pypi
    - recurse:
      - user
      - group
    - require:
      - user: pypi

/etc/init.d/pypiserver:
  file.managed:
    - source: salt://pypi/pypiserver.init
    - mode: 755

/etc/default/pypiserver:
  file.managed:
    - source: salt://pypi/pypiserver.conf


# grantnav live
grantnav:
  allowedhosts: '.live.threesixtygiving.uk0.bigv.io,.threesixtygiving.org'
  deploy_mode: list
  deploys:
    new:
      datadate: '2016-09-14.1'
      branch: 'iteration07.2'
      dataselection: acceptable_license_valid
    current:
      datadate: '2016-09-14.1'
      branch: 'iteration07.2'
      dataselection: acceptable_license_valid
    old:
      datadate: '2016-08-31'
      branch: 'iteration07.1'
      dataselection: acceptable_license_valid
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '9'

Remove nominet temporarily from GrantNav data

# grantnav live
grantnav:
  allowedhosts: '.live.threesixtygiving.uk0.bigv.io,.threesixtygiving.org'
  deploy_mode: list
  deploys:
    new:
      datadate: '2016-09-14.1_nominet_removed'
      branch: 'iteration07.2'
      dataselection: acceptable_license_valid
    current:
      datadate: '2016-09-14.1_nominet_removed'
      branch: 'iteration07.2'
      dataselection: acceptable_license_valid
    old:
      datadate: '2016-08-31'
      branch: 'iteration07.1'
      dataselection: acceptable_license_valid
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '9'


{% set elasticsearch_version = salt['pillar.get']('elasticsearch:version', false) -%}
{%- if elasticsearch_version %}
elasticsearch:
  pkg.installed:
    - sources:
      {%- if elasticsearch_version.startswith(('0', '1')) %}
      - elasticsearch: https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-{{ elasticsearch_version }}.deb
      {%- else %}
      - elasticsearch: https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/deb/elasticsearch/{{ elasticsearch_version }}/elasticsearch-{{ elasticsearch_version }}.deb
      {%- endif %}
{%- endif %}

Make sure ES is running

{% set elasticsearch_version = salt['pillar.get']('elasticsearch:version', false) -%}
{%- if elasticsearch_version %}
elasticsearch:
  pkg.installed:
    - sources:
      {%- if elasticsearch_version.startswith(('0', '1')) %}
      - elasticsearch: https://download.elasticsearch.org/elasticsearch/elasticsearch/elasticsearch-{{ elasticsearch_version }}.deb
      {%- else %}
      - elasticsearch: https://download.elasticsearch.org/elasticsearch/release/org/elasticsearch/distribution/deb/elasticsearch/{{ elasticsearch_version }}/elasticsearch-{{ elasticsearch_version }}.deb
      {%- endif %}
  service.running:
    - enable: True
    - require:
      - pkg: elasticsearch
{%- endif %}


base-packages:
  pkg:
    - installed
    - names:
      - python-software-properties
      - dpkg-dev
      - wget
      - build-essential
      - vim
      - byobu
      - ntp
      - sudo

Install base packages in a single command rather than in seperate states.

base-packages:
  pkg.installed:
    - pkgs:
      - python-software-properties
      - dpkg-dev
      - wget
      - build-essential
      - vim
      - byobu
      - ntp
      - sudo


# Values used only on the Cove OCDS server
default_branch: 'master'
cove:
  gitbranch: live
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '18'
    dimension_map: 'file_type=1,page_type=2,form_name=3,language=4,exit_language=5'
  iati: True
  servername: iati.cove.opendataservices.coop
  allowedhosts: '.iati.cove.opendataservices.coop'
  larger_uwsgi_limits: True
  uwsgi_as_limit: 31500
  uwsgi_harakiri: 7200
  app: cove_iati
  https: 'force'
  # A uwsgi_port is needed to make cove-live-iati-2 work
  uwsgi_port: 3008

Increase cove-live-iati-2 uwsgi limits some more

# Values used only on the Cove OCDS server
default_branch: 'master'
cove:
  gitbranch: live
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '18'
    dimension_map: 'file_type=1,page_type=2,form_name=3,language=4,exit_language=5'
  iati: True
  servername: iati.cove.opendataservices.coop
  allowedhosts: '.iati.cove.opendataservices.coop'
  larger_uwsgi_limits: True
  uwsgi_as_limit: 31500
  uwsgi_harakiri: 36000
  app: cove_iati
  https: 'force'
  # A uwsgi_port is needed to make cove-live-iati-2 work
  uwsgi_port: 3008


# Values used only on the Cove BODS server
default_branch: 'master'
cove:
  app: cove_project
  uwsgi_port: 3032  # Can't use default 3031 on Ubuntu 18 till https://github.com/unbit/uwsgi/issues/1491 is fixed
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '22'
    dimension_map: 'file_type=1,page_type=2,form_name=3,language=4,exit_language=5'
  giturl: 'https://github.com/openownership/cove-bods.git'
  allowedhosts: '.default.opendataservices.uk0.bigv.io,dev.datareview.openownership.org'
  ocds_redirect: False
  larger_uwsgi_limits: True
  # Note: these values supersede the much smaller values in live_pillar.sls
  uwsgi_as_limit: 12000
  uwsgi_harakiri: 1800
  https: 'force'
  servername: 'dev.datareview.openownership.org'
# This is empty as we don't use extra_cove_branches on this server.
# Instead just change the default_branch above (that means there can only be one, but that's fine for now)
extra_cove_branches: []
# DO NOT EDIT extra_cove_branches - please see the comment above!

Set up new branch on bods dev cove

# Values used only on the Cove BODS server
default_branch: '35-spreadsheet-version-detection'
cove:
  app: cove_project
  uwsgi_port: 3032  # Can't use default 3031 on Ubuntu 18 till https://github.com/unbit/uwsgi/issues/1491 is fixed
  piwik:
    url: '//mon.opendataservices.coop/piwik/'
    site_id: '22'
    dimension_map: 'file_type=1,page_type=2,form_name=3,language=4,exit_language=5'
  giturl: 'https://github.com/openownership/cove-bods.git'
  allowedhosts: '.default.opendataservices.uk0.bigv.io,dev.datareview.openownership.org'
  ocds_redirect: False
  larger_uwsgi_limits: True
  # Note: these values supersede the much smaller values in live_pillar.sls
  uwsgi_as_limit: 12000
  uwsgi_harakiri: 1800
  https: 'force'
  servername: 'dev.datareview.openownership.org'
# This is empty as we don't use extra_cove_branches on this server.
# Instead just change the default_branch above (that means there can only be one, but that's fine for now)
extra_cove_branches: []
# DO NOT EDIT extra_cove_branches - please see the comment above!


psf_internal_network: &psf_internal_network 192.168.5.0/24
pypi_internal_network: &pypi_internal_network 172.16.57.0/24
rackspace_iad_service_net: &rackspace_iad_service_net 10.0.0.0/8

mine_functions:
  psf_internal:
    mine_function: network.ip_addrs
    cidr: *psf_internal_network

Add the new mine functions

psf_internal_network: &psf_internal_network 192.168.5.0/24
pypi_internal_network: &pypi_internal_network 172.16.57.0/24
rackspace_iad_service_net: &rackspace_iad_service_net 10.0.0.0/8

mine_functions:
  psf_internal:
    mine_function: network.ip_addrs
    cidr: *psf_internal_network

  ipv4_addrs:
    mine_function: network.ip_addrs

  ipv6_addrs:
    mine_function: network.ip_addrs6


{% set edx_tracking_local_folder = '/edx/var/log/tracking' %}
{% set instance_id = salt.grains.get('id') %}
{% set business_unit = salt.grains.get('business_unit', 'residential') %}
{% set edx_tracking_bucket = 'odl-{}-tracking-backup'.format(business_unit) %}
{% set aws_creds = salt.pillar.get('edx:tracking_backups:aws_creds') %}
{% set archive_name = 'edx_tracking_' ~ instance_id ~ '-' ~ salt.system.get_system_date_time().split(' ')[0] ~ '.tgz' %}

tar_tracking_data:
  cmd.run:
    - name: 'tar -czf {{ archive_name }} *'
    - cwd: {{ edx_tracking_local_folder }}
    - creates: {{ edx_tracking_local_folder }}/{{ archive_name }}

upload_tar_to_s3:
  module.run:
    - name: s3.put
    - bucket: {{ edx_tracking_bucket }}
    - path: {{ instance_id }}.tgz
    - local_file: {{ edx_tracking_local_folder }}/{{ archive_name }}
    - key: {{ aws_creds.secret_key }}
    - keyid: {{ aws_creds.access_key}}

Add date to compressed filename

{% set edx_tracking_local_folder = '/edx/var/log/tracking' %}
{% set instance_id = salt.grains.get('id') %}
{% set business_unit = salt.grains.get('business_unit', 'residential') %}
{% set edx_tracking_bucket = 'odl-{}-tracking-backup'.format(business_unit) %}
{% set aws_creds = salt.pillar.get('edx:tracking_backups:aws_creds') %}
{% set date = salt.system.get_system_date_time().split(' ')[0] %}
{% set archive_name = 'edx_tracking_' ~ instance_id ~ '-' ~ date ~ '.tgz' %}

tar_tracking_data:
  cmd.run:
    - name: 'tar -czf {{ archive_name }} *'
    - cwd: {{ edx_tracking_local_folder }}
    - creates: {{ edx_tracking_local_folder }}/{{ archive_name }}

upload_tar_to_s3:
  module.run:
    - name: s3.put
    - bucket: {{ edx_tracking_bucket }}
    - path: {{ instance_id }}-{{ date }}.tgz
    - local_file: {{ edx_tracking_local_folder }}/{{ archive_name }}
    - key: {{ aws_creds.secret_key }}
    - keyid: {{ aws_creds.access_key}}


backerclient:
  user.present:
    - fullname: Backer Client User
    - shell: /bin/false
    - home: /home/backerclient
    - createhome: True
    - groups:
      - wheel

ssh-keygen -N "" -f /home/backerclient/.ssh/id_rsa:
  cmd.run:
    - creates: /home/backerclient/.ssh/id_rsa

Make .ssh dir as ssh-kegen wont

backerclient:
  user.present:
    - fullname: Backer Client User
    - shell: /bin/false
    - home: /home/backerclient
    - createhome: True
    - groups:
      - wheel

/home/backerclient/.ssh/:
  file.directory:
    - user: backerclient
    - group: users
    - mode: 700
    - require:
      - user: backerclient

ssh-keygen -N "" -f /home/backerclient/.ssh/id_rsa:
  cmd.run:
    - creates: /home/backerclient/.ssh/id_rsa


#
# Install NodeJS and Yarn package manager
#

nodejs:
  pkg.installed

yarn:
  pkg.installed

include:
  - .nvm
# Include autoupdate if configured to do so
{% if salt['pillar.get']('autoupdate:nodejs', False) %}
  - .update
{% endif %}

Disable nvm install for debug

#
# Install NodeJS and Yarn package manager
#

nodejs:
  pkg.installed

yarn:
  pkg.installed

include:
#  - .nvm
# Include autoupdate if configured to do so
{% if salt['pillar.get']('autoupdate:nodejs', False) %}
  - .update
{% endif %}


##########
# KOHA-COMMON
##########
koharepo:
  pkgrepo.managed:
    - name: deb http://debian.koha-community.org/koha squeeze main
    - key_url: http://debian.koha-community.org/koha/gpg.asc

koha-common:
  pkg.installed:
    - skip_verify: True
    - version: 3.18.02
    - require:
      - pkgrepo: koharepo

Update Koha 3.18.02 > 3.18.03

##########
# KOHA-COMMON
##########
koharepo:
  pkgrepo.managed:
    - name: deb http://debian.koha-community.org/koha squeeze main
    - key_url: http://debian.koha-community.org/koha/gpg.asc

koha-common:
  pkg.installed:
    - skip_verify: True
    - version: 3.18.03
    - require:
      - pkgrepo: koharepo


psf_internal_network: 192.168.5.0/24
pypi_internal_network: 172.16.57.0/24
vpn0_internal_network: 10.8.0.0/24
vpn1_internal_network: 10.9.0.0/24
rackspace_iad_service_net: 10.0.0.0/8

psf_internal_vpn_gateway: 192.168.5.10
pypi_internal_vpn_gateway: 172.16.57.17

Add mine functions which will record IP addresses

psf_internal_network: 192.168.5.0/24
pypi_internal_network: 172.16.57.0/24
vpn0_internal_network: 10.8.0.0/24
vpn1_internal_network: 10.9.0.0/24
rackspace_iad_service_net: 10.0.0.0/8

psf_internal_vpn_gateway: 192.168.5.10
pypi_internal_vpn_gateway: 172.16.57.17

mine_functions:
  psf-internal:
    mine_function: ip_picker.ip_addrs
    cidr: 192.168.5.0/24
  pypi-internal:
    mine_function: ip_picker.ipaddrs
    cidr: 172.16.57.0/24


include:
  - openstack.nova.user

'/etc/nova':
  file.directory:
    - user: nova
    - group: nova
    - require:
      - user: nova-user

{% for conf in 'nova.conf','api-paste.ini','policy.json' %}
'/etc/nova/{{conf}}':
  file.managed:
    - source: salt://openstack/nova/conf/{{conf}}
    - template: jinja
    - user: nova
    - group: nova
    - require:
      - user: nova-user
      - file: '/etc/nova'
{% endfor %}

Make an explicit array of strings

include:
  - openstack.nova.user

'/etc/nova':
  file.directory:
    - user: nova
    - group: nova
    - require:
      - user: nova-user

{% for conf in ['nova.conf','api-paste.ini','policy.json'] %}
'/etc/nova/{{conf}}':
  file.managed:
    - source: salt://openstack/nova/conf/{{conf}}
    - template: jinja
    - user: nova
    - group: nova
    - require:
      - user: nova-user
      - file: '/etc/nova'
{% endfor %}


nginx:
  install_from_repo: True
  server:
    config:
      http:
        access_log: !!null
    extra_config:
      logging:
        log_format app_metrics: >-
          'time=$time_iso8601
          client=$remote_addr
          method=$request_method
          request="$request"
          request_length=$request_length
          status=$status
          bytes_sent=$bytes_sent
          body_bytes_sent=$body_bytes_sent
          referer=$http_referer
          user_agent="$http_user_agent"
          upstream_addr=$upstream_addr
          upstream_status=$upstream_status
          request_time=$request_time
          request_id=$request_id
          upstream_response_time=$upstream_response_time
          upstream_connect_time=$upstream_connect_time
          upstream_header_time=$upstream_header_time'
        access_log: /var/log/nginx/access.log app_metrics
  servers:
    managed:
      default: # Disable the default nginx config
        enabled: False
        deleted: True
        config: None
      nginx_metrics:
        enabled: True
        config:
          - server:
              - location /nginx-status:
                  - stub_status: 'on'
                  - access_log: 'off'
                  - allow: 127.0.0.1
                  - deny: all

Fix list format of pillar data for nginx

nginx:
  install_from_repo: True
  server:
    config:
      http:
        access_log: !!null
    extra_config:
      logging:
        - log_format app_metrics: >-
            'time=$time_iso8601
            client=$remote_addr
            method=$request_method
            request="$request"
            request_length=$request_length
            status=$status
            bytes_sent=$bytes_sent
            body_bytes_sent=$body_bytes_sent
            referer=$http_referer
            user_agent="$http_user_agent"
            upstream_addr=$upstream_addr
            upstream_status=$upstream_status
            request_time=$request_time
            request_id=$request_id
            upstream_response_time=$upstream_response_time
            upstream_connect_time=$upstream_connect_time
            upstream_header_time=$upstream_header_time'
        - access_log: /var/log/nginx/access.log app_metrics
  servers:
    managed:
      default: # Disable the default nginx config
        enabled: False
        deleted: True
        config: None
      nginx_metrics:
        enabled: True
        config:
          - server:
              - location /nginx-status:
                  - stub_status: 'on'
                  - access_log: 'off'
                  - allow: 127.0.0.1
                  - deny: all


include:
  - apache

rootco.de-web:
  git.latest:
    - name: https://github.com/sysrich/rootco.de-web.git
    - target: /srv/www/source
    - require:
      - pkg: apache2

/srv/www/htdocs:
  file.copy:
    - source: /srv/www/source/_site
    - force: true
    - preserve: true

Fix jekyll_site to be unique

include:
  - apache

rootco.de-web:
  git.latest:
    - name: https://github.com/sysrich/rootco.de-web.git
    - target: /srv/www/source
    - require:
      - pkg: apache2

jekyll_site:
  file.copy:
    - name: /srv/www/htdocs
    - source: /srv/www/source/_site
    - force: true
    - preserve: true


{%- from "pkgs/system/python-pip.sls" import pip with context -%}

include:
  - pkgs.system.python-pip

{#- Ubuntu Lucid and CentOS 5 has way too old pip package, we'll need to upgrade "by hand", salt can't do it for us #}
{% if (grains['os'] == 'Ubuntu' and grains['osrelease'].startswith('10.')) or (grains['os'] == 'CentOS' and grains['osrelease'].startswith('5.')) %}
uninstall-python-pip:
  pkg.purged:
    - name: {{ pip }}

pip-cmd:
  cmd.run:
    - name: wget --no-check-certificate https://bootstrap.pypa.io/get-pip.py -O - | python
    - require:
      - pkg: uninstall-python-pip
    - reload_modules: true
{% endif %}

pip:
  pip.installed:
    {%- if salt['config.get']('virtualenv_name', None) %}
    - bin_env: /srv/virtualenvs/{{ salt['config.get']('virtualenv_name') }}
    {%- endif %}
    - index_url: https://pypi-jenkins.saltstack.com/jenkins/develop
    - extra_index_url: https://pypi.python.org/simple
    - upgrade: true
    - reload_modules: true
    - require:
      {%- if grains['os'] == 'Ubuntu' and grains['osrelease'].startswith('10.') %}
      - cmd: pip-cmd
      {%- else %}
      - pkg: python-pip
      {%- endif %}

Use the right python binary name

{%- from "_python_binary_name.sls" import python with context -%}
{%- from "pkgs/system/python-pip.sls" import pip with context -%}

include:
  - pkgs.system.python-pip

{#- Ubuntu Lucid and CentOS 5 has way too old pip package, we'll need to upgrade "by hand", salt can't do it for us #}
{% if (grains['os'] == 'Ubuntu' and grains['osrelease'].startswith('10.')) or (grains['os'] == 'CentOS' and grains['osrelease'].startswith('5.')) %}
uninstall-python-pip:
  pkg.purged:
    - name: {{ pip }}

pip-cmd:
  cmd.run:
    - name: wget --no-check-certificate https://bootstrap.pypa.io/get-pip.py -O - | {{ python }}
    - require:
      - pkg: uninstall-python-pip
    - reload_modules: true
{% endif %}

pip:
  pip.installed:
    {%- if salt['config.get']('virtualenv_name', None) %}
    - bin_env: /srv/virtualenvs/{{ salt['config.get']('virtualenv_name') }}
    {%- endif %}
    - index_url: https://pypi-jenkins.saltstack.com/jenkins/develop
    - extra_index_url: https://pypi.python.org/simple
    - upgrade: true
    - reload_modules: true
    - require:
      {%- if grains['os'] == 'Ubuntu' and grains['osrelease'].startswith('10.') %}
      - cmd: pip-cmd
      {%- else %}
      - pkg: python-pip
      {%- endif %}


include:
  - projects.virtualenv
  - pkgs.python.six
  - pkgs.python.nose
  - pkgs.python.ioflo
  - pkgs.python.libnacl
  - pkgs.python.coverage
  - pkgs.python.salttesting

noop:
  test.succeed_without_changes:
    - require:
      - virtualenv: create-virtualenv

Add msgpack to the mix

include:
  - projects.virtualenv
  - pkgs.python.six
  - pkgs.python.nose
  - pkgs.python.ioflo
  - pkgs.python.libnacl
  - pkgs.python.msgpack
  - pkgs.python.coverage
  - pkgs.python.salttesting

noop:
  test.succeed_without_changes:
    - require:
      - virtualenv: create-virtualenv


# This defines a base configuration that we want installed on all of our
# servers.

# Core packages that almost all our software will depend on
git:
  pkg.installed

# Useful commands for people logging into the servers
useful-shell-commands:
  pkg.installed:
    - pkgs:
      - vim
      - tmux

## Security
# Install fail2ban
fail2ban:
  pkg.installed

# Disable SSH password login (use keys instead)
/etc/ssh/sshd_config:
  file.replace:
    - pattern: PasswordAuthentication yes
    - repl: PasswordAuthentication no

# reload SSH if we change the config
ssh:
  service:
    - running
    - enable: True
    - reload: True
    - watch:
      - file: /etc/ssh/sshd_config

# Install authorized SSH public keys from the pillar
/root/.ssh/authorized_keys:
  file.managed:
    - contents_pillar: authorized_keys
    - makedirs: True

# Set up unattended upgrades
unattended-upgrades:
  pkg.installed:
    - pks:
      - unattended-upgrades
      - mailutils

/etc/apt/apt.conf.d/50unattended-upgrades:
  file.managed:
    - source: salt://apt/50unattended-upgrades

/etc/apt/apt.conf.d/10periodic:
  file.managed:
    - source: salt://apt/10periodic

Install update-notifier-common for info about reboots required

# This defines a base configuration that we want installed on all of our
# servers.

# Core packages that almost all our software will depend on
git:
  pkg.installed

# Useful commands for people logging into the servers
useful-shell-commands:
  pkg.installed:
    - pkgs:
      - vim
      - tmux

## Security
# Install fail2ban
fail2ban:
  pkg.installed

# Disable SSH password login (use keys instead)
/etc/ssh/sshd_config:
  file.replace:
    - pattern: PasswordAuthentication yes
    - repl: PasswordAuthentication no

# reload SSH if we change the config
ssh:
  service:
    - running
    - enable: True
    - reload: True
    - watch:
      - file: /etc/ssh/sshd_config

# Install authorized SSH public keys from the pillar
/root/.ssh/authorized_keys:
  file.managed:
    - contents_pillar: authorized_keys
    - makedirs: True

# Set up unattended upgrades
unattended-upgrades:
  pkg.installed:
    - pkgs:
      - unattended-upgrades # this perform unattended upgrades
      - update-notifier-common # this checks whether a restart is required

/etc/apt/apt.conf.d/50unattended-upgrades:
  file.managed:
    - source: salt://apt/50unattended-upgrades

/etc/apt/apt.conf.d/10periodic:
  file.managed:
    - source: salt://apt/10periodic


openvpn:
  pkg:
    - installed
  service:
    - running
    - enable: True
    - require:
      - pkg: openvpn
    - watch:
      - file: /etc/openvpn

/etc/openvpn:
  file.recurse:
    - source: salt://openvpn/etc_openvpn
    - template: jinja
    - user: root
    - group: root
    - exclude_pat: E@(dnsmasq.settings.default)|(login.settings.default)
    - file_mode: 600

/etc/openvpn/up.sh:
  file.managed:
    - source: salt://openvpn/up.sh
    - user: root
    - group: root
    - mode: 700

Copy default files as well

openvpn:
  pkg:
    - installed
  service:
    - running
    - enable: True
    - require:
      - pkg: openvpn
    - watch:
      - file: /etc/openvpn

/etc/openvpn:
  file.recurse:
    - source: salt://openvpn/etc_openvpn
    - template: jinja
    - user: root
    - group: root
    - file_mode: 600

/etc/openvpn/up.sh:
  file.managed:
    - source: salt://openvpn/up.sh
    - user: root
    - group: root
    - mode: 700


install_editor_alternative:
  alternatives.install:
    - name: editor
    - link: /usr/bin/editor
    - path: /usr/bin/nvim
    - priority: 100

ensure_editor_alternative:
  alternatives.auto:
    - name: editor
    - require:
      - alternatives: install_editor_alternative

/home/steveno/.config/nvim/backups:
  file.directory:
    - name: /home/steveno/.config/nvim/backups
    - user: steveno
    - group: steveno
    - mode: 664

/home/steveno/.config/nvim/init.vim:
  file.managed:
    - source: salt://files/nvim/init.vim
    - template: jinja
    - user: steveno
    - group: steveno
    - mode: 664
    - makedirs: True

{% if not salt['file.file_exists'](/home/steveno/.local/share/nvim/site/autoload/plug.vim) %}
/home/steveno/.local/share/nvim/site/autoload/plug.vim:
  file.managed:
    - source: https://raw.githubusercontent.com/junegunn/vim-plug/master/plug.vim
    - user: steveno
    - group: steveno
    - mode: 664
    - makedirs: True
{% endif %}

Add quotes to file path

install_editor_alternative:
  alternatives.install:
    - name: editor
    - link: /usr/bin/editor
    - path: /usr/bin/nvim
    - priority: 100

ensure_editor_alternative:
  alternatives.auto:
    - name: editor
    - require:
      - alternatives: install_editor_alternative

/home/steveno/.config/nvim/backups:
  file.directory:
    - name: /home/steveno/.config/nvim/backups
    - user: steveno
    - group: steveno
    - mode: 664

/home/steveno/.config/nvim/init.vim:
  file.managed:
    - source: salt://files/nvim/init.vim
    - template: jinja
    - user: steveno
    - group: steveno
    - mode: 664
    - makedirs: True

{% if not salt['file.file_exists']('/home/steveno/.local/share/nvim/site/autoload/plug.vim') %}
/home/steveno/.local/share/nvim/site/autoload/plug.vim:
  file.managed:
    - source: https://raw.githubusercontent.com/junegunn/vim-plug/master/plug.vim
    - user: steveno
    - group: steveno
    - mode: 664
    - makedirs: True
{% endif %}


include:
  - openstack.neutron.user
  - openstack.neutron.conf
extend:
  /etc/neutron:
    file.directory:
      - name: {{staging}}/neutron

  /etc/neutron/plugins:
    file.directory:
      - name: {{staging}}/neutron/plugins

  /etc/neutron/plugins/openvswitch:
    file.directory:
      - name: {{staging}}/neutron/openvswitch

  /etc/neutron/neutron.conf:
    file.managed:
      - name: {{staging}}/neutron/neutron.conf

  '/etc/neutron/dnsmasq.conf':
    file.managed:
      - name: {{staging}}/neutron/dnsmasq.conf

  '/etc/neutron/metadata_agent.ini':
    file.managed:
      - name: {{staging}}/neutron/metadata_agent.ini

  '/etc/neutron/dhcp_agent.ini':
    file.managed:
      - name: {{staging}}/neutron/dhcp_agent.ini

  '/etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini':
    file.managed:
      - name: {{staging}}/neutron/plugins/openvswitch/ovs_neutron_plugin.ini

  '/etc/neutron/plugin.ini':
    file.symlink:
      - name: {{staging}}/neutron/plugin.ini
      - target: '{{staging}}/neutron/plugins/openvswitch/ovs_neutron_plugin.ini'

  '/etc/neutron/lbaas_agent.ini':
    file.managed:
      - name: {{staging}}/neutron/lbaas_agent.ini

Add missing staging prefix variable to neutron

{% set staging = "/srv/container" %}
include:
  - openstack.neutron.user
  - openstack.neutron.conf

extend:
  /etc/neutron:
    file.directory:
      - name: {{staging}}/neutron

  /etc/neutron/plugins:
    file.directory:
      - name: {{staging}}/neutron/plugins

  /etc/neutron/plugins/openvswitch:
    file.directory:
      - name: {{staging}}/neutron/openvswitch

  /etc/neutron/neutron.conf:
    file.managed:
      - name: {{staging}}/neutron/neutron.conf

  '/etc/neutron/dnsmasq.conf':
    file.managed:
      - name: {{staging}}/neutron/dnsmasq.conf

  '/etc/neutron/metadata_agent.ini':
    file.managed:
      - name: {{staging}}/neutron/metadata_agent.ini

  '/etc/neutron/dhcp_agent.ini':
    file.managed:
      - name: {{staging}}/neutron/dhcp_agent.ini

  '/etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini':
    file.managed:
      - name: {{staging}}/neutron/plugins/openvswitch/ovs_neutron_plugin.ini

  '/etc/neutron/plugin.ini':
    file.symlink:
      - name: {{staging}}/neutron/plugin.ini
      - target: '{{staging}}/neutron/plugins/openvswitch/ovs_neutron_plugin.ini'

  '/etc/neutron/lbaas_agent.ini':
    file.managed:
      - name: {{staging}}/neutron/lbaas_agent.ini


# Copyright 2012-2013 Hewlett-Packard Development Company, L.P.
# All Rights Reserved.
#
#    Licensed under the Apache License, Version 2.0 (the "License"); you may
#    not use this file except in compliance with the License. You may obtain
#    a copy of the License at
#
#         http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.
#
base:
  '*':
    - fail2ban
    - datadog
    - network
  'logstash*':
    - logstash.indexer
    - logstash.queue
    - logstash.web
    - redis
    - redis.jenkins
    - elasticsearch.master
  'esnode*':
    - elasticsearch.data-slave
  'jenkins.*':
    - jenkins.master
  'msgaas*.jenkins*':
    - jenkins.msgaas
  'dbaas*.jenkins*':
    - jenkins.dbaas
  'pypi*':
    - pypi
  'apt.mirror*':
    - apt.mirror
  'devstack':
    - devstack

Set up an apt cache for dbaas

# Copyright 2012-2013 Hewlett-Packard Development Company, L.P.
# All Rights Reserved.
#
#    Licensed under the Apache License, Version 2.0 (the "License"); you may
#    not use this file except in compliance with the License. You may obtain
#    a copy of the License at
#
#         http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
#    License for the specific language governing permissions and limitations
#    under the License.
#
base:
  '*':
    - fail2ban
    - datadog
    - network
  'logstash*':
    - logstash.indexer
    - logstash.queue
    - logstash.web
    - redis
    - redis.jenkins
    - elasticsearch.master
  'esnode*':
    - elasticsearch.data-slave
  'jenkins.*':
    - jenkins.master
  'msgaas*.jenkins*':
    - jenkins.msgaas
  'dbaas*.jenkins*':
    - jenkins.dbaas
  'pypi*':
    - pypi
  'apt.mirror*':
    - apt.mirror
  'apt.dbaas*':
    - apt.cache
  'devstack':
    - devstack


{%- if salt['pillar.get']('pip:installed') %}
  {%- for pip in salt['pillar.get']('pip:installed') %}
pip-{{ pip }}-installed:
  pip.installed:
    - name: {{ pip }}
    - upgrade: False
    - require:
      - sls: pkg
    - require_in:
      - cmd: pip-reload-modules
  {% endfor %}
{%- endif %}

pip-reload-modules:
  cmd.run:
    - name: /bin/true
    - reload_modules: True

Upgrade pips so we fix issue with pyOpenSSL

{%- if salt['pillar.get']('pip:installed') %}
  {%- for pip in salt['pillar.get']('pip:installed') %}
pip-{{ pip }}-installed:
  pip.installed:
    - name: {{ pip }}
    - upgrade: True
    - require:
      - sls: pkg
    - require_in:
      - cmd: pip-reload-modules
  {% endfor %}
{%- endif %}

pip-reload-modules:
  cmd.run:
    - name: /bin/true
    - reload_modules: True