summaryrefslogtreecommitdiff
path: root/config-joey.hs
blob: 6c4507d66b6476724c770f5082cac072fb858610 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
-- |  This is the live config file used by propellor's author.

import Propellor
import Propellor.CmdLine
import Propellor.Property.Scheduled
import qualified Propellor.Property.File as File
import qualified Propellor.Property.Apt as Apt
import qualified Propellor.Property.Network as Network
import qualified Propellor.Property.Ssh as Ssh
import qualified Propellor.Property.Cron as Cron
import qualified Propellor.Property.Sudo as Sudo
import qualified Propellor.Property.User as User
import qualified Propellor.Property.Hostname as Hostname
--import qualified Propellor.Property.Reboot as Reboot
import qualified Propellor.Property.Tor as Tor
import qualified Propellor.Property.OpenId as OpenId
import qualified Propellor.Property.Docker as Docker
import qualified Propellor.Property.SiteSpecific.GitHome as GitHome
import qualified Propellor.Property.SiteSpecific.GitAnnexBuilder as GitAnnexBuilder
import qualified Propellor.Property.SiteSpecific.JoeySites as JoeySites
import Data.List

main :: IO ()
main = defaultMain [host, Docker.containerProperties container]

-- | This is where the system's HostName, either as returned by uname
-- or one specified on the command line, is converted into a list of
-- Properties for that system.
--
-- Edit this to configure propellor!
host :: HostName -> Maybe [Property]
-- Clam is a tor bridge, and an olduse.net shellbox and other fun stuff.
host hostname@"clam.kitenet.net" = standardSystem Unstable $ props
	& cleanCloudAtCost hostname
	& Apt.unattendedUpgrades
	& Network.ipv6to4
	& Apt.installed ["git-annex", "mtr"]
	& Tor.isBridge
	& JoeySites.oldUseNetshellBox
	& Docker.docked container hostname "openid-provider"
	& Docker.configured
	& Docker.garbageCollected `period` Daily
-- Orca is the main git-annex build box.
host hostname@"orca.kitenet.net" = standardSystem Unstable $ props
	& Hostname.set hostname
	& Apt.unattendedUpgrades
	& Docker.configured
	& Apt.buildDep ["git-annex"] `period` Daily
	& Docker.docked container hostname "amd64-git-annex-builder"
	& Docker.docked container hostname "i386-git-annex-builder"
	! Docker.docked container hostname "armel-git-annex-builder-companion"
	! Docker.docked container hostname "armel-git-annex-builder"
	& Docker.garbageCollected `period` Daily
-- My laptop
host _hostname@"darkstar.kitenet.net" = Just $ props
	& Docker.configured
	& Apt.buildDep ["git-annex"] `period` Daily
	
-- add more hosts here...
--host "foo.example.com" =
host _ = Nothing

-- | This is where Docker containers are set up. A container
-- can vary by hostname where it's used, or be the same everywhere.
container :: HostName -> Docker.ContainerName -> Maybe (Docker.Container)
container _parenthost name
	-- Simple web server, publishing the outside host's /var/www
	| name == "webserver" = Just $ standardContainer Stable "amd64"
		[ Docker.publish "8080:80"
		, Docker.volume "/var/www:/var/www"
		, Docker.inside $ props
			& Apt.serviceInstalledRunning "apache2"
		]

	-- My own openid provider. Uses php, so containerized for security
	-- and administrative sanity.
	| name == "openid-provider" = Just $ standardContainer Stable "amd64"
		[ Docker.publish "8081:80"
		, Docker.inside $ props
			& OpenId.providerFor ["joey", "liw"]
				"openid.kitenet.net:8081"
		]
	
	-- armel builder has a companion container that run amd64 and
	-- runs the build first to get TH splices. They share a home
	-- directory, and need to have the same versions of all haskell
	-- libraries installed.
	| name == "armel-git-annex-builder-companion" = Just $ Docker.containerFrom
		(image $ System (Debian Unstable) "amd64")
		[ Docker.volume GitAnnexBuilder.homedir
		, Docker.inside $ props
			& Apt.unattendedUpgrades
		]
	| name == "armel-git-annex-builder" = Just $ Docker.containerFrom
		(image $ System (Debian Unstable) "armel")
		[ Docker.link (name ++ "-companion") "companion"
		, Docker.volumes_from (name ++ "-companion")
		, Docker.inside $ props
--			& GitAnnexBuilder.builder "armel" "15 * * * *" True
			& Apt.unattendedUpgrades
		]
	
	| "-git-annex-builder" `isSuffixOf` name =
		let arch = takeWhile (/= '-') name
		in Just $ Docker.containerFrom
			(image $ System (Debian Unstable) arch)
			[ Docker.inside $ props
				& GitAnnexBuilder.builder arch "15 * * * *" True
				& Apt.unattendedUpgrades
			]
	
	| otherwise = Nothing

-- | Docker images I prefer to use.
image :: System -> Docker.Image
image (System (Debian Unstable) arch) = "joeyh/debian-unstable-" ++ arch
image (System (Debian Stable) arch) = "joeyh/debian-stable-" ++ arch
image _ = "debian-stable-official" -- does not currently exist!

-- This is my standard system setup
standardSystem :: DebianSuite -> [Property] -> Maybe [Property]
standardSystem suite customprops = Just $
	standardprops : customprops ++ endprops
  where
	standardprops = propertyList "standard system" $ props
		& Apt.stdSourcesList suite `onChange` Apt.upgrade
		& Apt.installed ["etckeeper"]
		& Apt.installed ["ssh"]
		& GitHome.installedFor "root"
		& User.hasSomePassword "root"
		-- Harden the system, but only once root's authorized_keys
		-- is safely in place.
		& check (Ssh.hasAuthorizedKeys "root")
			(Ssh.passwordAuthentication False)
		& User.accountFor "joey"
		& User.hasSomePassword "joey"
		& Sudo.enabledFor "joey"
		& GitHome.installedFor "joey"
		& Apt.installed ["vim", "screen", "less"]
		& Cron.runPropellor "30 * * * *"
		-- I use postfix, or no MTA.
		& Apt.removed ["exim4", "exim4-daemon-light", "exim4-config", "exim4-base"]
			`onChange` Apt.autoRemove
	-- May reboot, so comes last
	-- Currently not enable due to #726375 
	endprops = [] -- [Apt.installed ["systemd-sysv"] `onChange` Reboot.now]

-- This is my standard container setup, featuring automatic upgrades.
standardContainer :: DebianSuite -> Architecture -> [Docker.Containerized Property] -> Docker.Container
standardContainer suite arch ps = Docker.containerFrom
	(image $ System (Debian suite) arch) $
	[ Docker.inside $ props
		& Apt.stdSourcesList suite
		& Apt.unattendedUpgrades
	] ++ ps

-- Clean up a system as installed by cloudatcost.com
cleanCloudAtCost :: HostName -> Property
cleanCloudAtCost hostname = propertyList "cloudatcost cleanup"
	[ Hostname.set hostname
	, Ssh.uniqueHostKeys
	, "worked around grub/lvm boot bug #743126" ==>
		"/etc/default/grub" `File.containsLine` "GRUB_DISABLE_LINUX_UUID=true"
		`onChange` cmdProperty "update-grub" []
		`onChange` cmdProperty "update-initramfs" ["-u"]
	, combineProperties "nuked cloudatcost cruft"
		[ File.notPresent "/etc/rc.local"
		, File.notPresent "/etc/init.d/S97-setup.sh"
		, User.nuked "user" User.YesReallyDeleteHome
		]
	]