Issue 2471 - Update our Discourse instance

modules/discourse/manifests/init.pp

 class discourse(
     $domain,
     $certificate,
     $private_key,
     $is_default = false
   ) inherits private::discourse {
 
+  class { 'postgresql::globals':
+    manage_package_repo => true,
+    version => '9.3',
+  }->
   class {"postgresql::server":}
 
+  class {"postgresql::server::contrib":
+    package_ensure => 'present',
+  }
+
   postgresql::server::database {'discourse':}
 
   postgresql::server::role {'discourse':
     password_hash => postgresql_password('discourse', $database_password),
     db => 'discourse',
     login => true,
     superuser => true,
     require => Postgresql::Server::Database['discourse']
   }
 
-  $basic_dependencies = ['postgresql-contrib', 'redis-server', 'ruby1.9.1',
-      'libjemalloc1', 'curl']
-  $gem_dependencies = ['git', 'build-essential', 'ruby1.9.1-dev', 'libxml2-dev',
-      'libxslt-dev', 'libpq-dev']
+  $rvm_dependencies = ['curl', 'git-core', 'patch', 'build-essential', 'bison',
+      'zlib1g-dev', 'libssl-dev', 'libxml2-dev', 'sqlite3', 'libsqlite3-dev',
+      'autotools-dev', 'libxslt1-dev', 'libyaml-0-2', 'autoconf', 'automake',
+      'libreadline6-dev', 'libyaml-dev', 'libtool', 'libgdbm-dev',
+      'libncurses5-dev', 'libffi-dev', 'pkg-config', 'gawk']
+  $discourse_dependencies = ['redis-server', 'libjemalloc1']
+  $gem_dependencies = ['libpq-dev']
   $image_optim_dependencies = ['advancecomp', 'gifsicle', 'jhead', 'jpegoptim',
       'libjpeg-progs', 'optipng', 'pngcrush']
   $image_sorcery_dependencies = 'imagemagick'
 
-  package {[$basic_dependencies, $gem_dependencies, $image_optim_dependencies, $image_sorcery_dependencies]:
+  package {[$rvm_dependencies, $discourse_dependencies, $gem_dependencies, $image_optim_dependencies, $image_sorcery_dependencies]:
     ensure => present
   }
 
-  Exec {path => '/bin:/usr/bin:/usr/sbin:/usr/local/bin'}
-
-  exec {'update-alternatives --set ruby "/usr/bin/ruby1.9.1"':
-    unless => 'test $(readlink "/etc/alternatives/ruby") == "/usr/bin/ruby1.9.1"',
-    require => Package['ruby1.9.1']
+  Exec <| tag == 'rvm' |> {
+    path => '/bin:/usr/bin:/usr/sbin:/usr/local/bin:/home/discourse/.rvm/bin',

[mathias, 2015/05/09 15:34:19]

Do you know why the directory precedence here is inverted, in contrast to what
one would expect? I do realize that the former version did the same, but there's
no obvious reason for either one - and it looks like it can quickly become an
issue.

[Wladimir Palant, 2015/05/11 15:00:42]

Done.

+    user => discourse,
+    group => www-data,
+    environment => ['HOME=/home/discourse'],
   }
 
-  exec {'update-alternatives --set gem "/usr/bin/gem1.9.1"':
-    unless => 'test $(readlink "/etc/alternatives/gem") == "/usr/bin/gem1.9.1"',
-    require => Package['ruby1.9.1'],
-    before => Exec['update_gem']
+  exec {'install-rvm-key':
+    command => 'gpg --keyserver hkp://keys.gnupg.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3',
+    tag => 'rvm',
+    unless => 'gpg --list-keys | grep D39DC0E3',
   }
 
-  exec {'update_gem':
-    command => '/usr/bin/gem update --system 1.8.25',
-    unless => 'test $(gem -v) == "1.8.25"',
-    environment => 'REALLY_GEM_UPDATE_SYSTEM=1',
+  exec {'install-ruby':
+    command => 'curl -sSL https://get.rvm.io | bash -s stable --ruby=2.1.2',

[mathias, 2015/05/09 15:34:19]

Note that this does not cover upgrading to future Ruby versions, a specific
patch or similar. Also, it introduces yet another major (but avoidable)
dependency on external resources. However, it's fine for now that we want to fix
Discourse logins, but we have to re-visit it afterwards at least.

[Wladimir Palant, 2015/05/11 15:00:42]

Yes, I had RVM and Ruby installation separate initially but dropped that for
reasons of simplicity. I guess we'll want to reintroduce that separation.

I verified that updating Ruby actually works correctly now. However, I didn't
update to Ruby 2.2.2 yet because in my VM it produced out of memory errors.

+    tag => 'rvm',
+    creates => '/home/discourse/.rvm',
+    timeout => 0,
+    logoutput => true,
+    require => [Exec['install-rvm-key'], Package[$rvm_dependencies]],
   }
 
-  package {'bundler':
-    ensure => present,
-    provider => gem,
-    require => Exec['update_gem']
+  exec {'install-bundler':

[mathias, 2015/05/09 15:34:19]

Note that this would be better handled as a Package with provider => gem --
Though our Puppet version may not be compatible with this version of Gem itself.
So gain this may be fine for now, but should become revisited at least.

[Wladimir Palant, 2015/05/11 15:00:42]

We need two different Ruby versions: one for Puppet/Hiera (1.9), another one for
Discourse (2.0+). So we don't touch the system Ruby version and install a
separate version for discourse user only.

Using Package will only install bundler in the system Ruby - that's what we did
before but it won't be usable with the Ruby installation in the discourse
account. So Exec seems to be the only way.

+    command => 'rvm default do gem install bundler',
+    tag => 'rvm',
+    unless => 'rvm default do gem list | grep "^bundler ")',
+    require => Exec['install-ruby'],
   }
 
   file {'/opt/discourse':
     ensure => directory,
     mode => 755,
     owner => discourse,
     group => www-data
   }
 
   file {['/opt/discourse/tmp', '/opt/discourse/tmp/pids']:
@@ skipping 36 matching lines @@
     mode => 0440,
     source => 'puppet:///modules/discourse/sudoers',
     require => User['discourse']
   }
 
   exec {'fetch-discourse':
     command => "hg clone https://hg.adblockplus.org/discourse /opt/discourse",
     path => ["/usr/bin/", "/bin/"],
     user => discourse,
     group => www-data,
+    timeout => 0,
     require => [Package['mercurial'], File['/opt/discourse']],
-    notify => Exec['/usr/local/bin/init-discourse'],
+    notify => Exec['init-discourse'],
     onlyif => "test ! -d /opt/discourse/.hg"

[mathias, 2015/05/09 15:34:19]

(Not part of this patch-set, but a bug that needs to be addressed as well;
cloning into a non-empty directory does not work. Though in practice that should
not happen with the code here, it's still a footgun.)

[Wladimir Palant, 2015/05/11 15:00:42]

Why would it be non-empty? It's created right before cloning - and it's only a
separate step because the discourse user doesn't have permission to write to
/opt.

   }
 
-  exec {'/usr/local/bin/init-discourse':
+  file {'/opt/discourse/config/initializers/airbrake.rb':
+    ensure => absent,
+    before => Exec['init-discourse'],
+  }
+
+  file {'/opt/discourse/config/version.rb':
+    ensure => present,
+    owner => discourse,
+    group => www-data,
+
+    # This is hardcoded here so that Discourse doesn't try to extract it from
+    # the repository. Ideally, we should update it when updating Discourse.
+    content => '$git_version = "8a3a02421a39f53b6adf3ca9a6fdba73f42bc932"',
+    require => Exec['fetch-discourse'],
+    before => Exec['init-discourse'],
+  }
+
+  exec {'init-discourse':
+    command => 'rvm default do /usr/local/bin/init-discourse',
+    tag => 'rvm',
     subscribe => File['/usr/local/bin/init-discourse'],
     refreshonly => true,
-    environment => ["AIRBRAKE_KEY=${airbrake_key}"],
-    user => discourse,
-    group => www-data,
     timeout => 0,
     logoutput => true,
-    require => [Package['bundler', $gem_dependencies],
+    require => [Exec['install-bundler'],
+                Package[$discourse_dependencies, $gem_dependencies],
                 User['discourse'], File['/etc/sudoers.d/discourse'],
                 Exec['fetch-discourse'],
                 File['/opt/discourse/config/discourse.conf'],
                 Postgresql::Server::Role['discourse']]
   }
 
   Discourse::Sitesetting <| |> {
-    require => Exec['/usr/local/bin/init-discourse']
+    require => Exec['init-discourse']
   }
 
   discourse::sitesetting {'title':
     ensure => present,
     type => 1,
     value => 'Adblock Plus internal discussions'
   }
 
   discourse::sitesetting {'notification_email':
     ensure => present,
@@ skipping 66 matching lines @@
     type => 5,
     value => 'f'
   }
 
   discourse::sitesetting {'enable_local_account_create':
     ensure => present,
     type => 5,
     value => 'f'
   }
 
+  discourse::sitesetting {'enable_google_logins':
+    ensure => present,
+    type => 5,
+    value => 'f'
+  }
+
+  discourse::sitesetting {'enable_google_oauth2_logins':
+    ensure => present,
+    type => 5,
+    value => 't'
+  }
+
+  discourse::sitesetting {'google_oauth2_client_id':
+    ensure => present,
+    type => 1,
+    value => $google_client_id
+  }
+
+  discourse::sitesetting {'google_oauth2_client_secret':
+    ensure => present,
+    type => 1,
+    value => $google_client_secret
+  }
+
   discourse::sitesetting {'enable_facebook_logins':
     ensure => present,
     type => 5,
     value => 'f'
   }
 
   discourse::sitesetting {'enable_twitter_logins':
     ensure => present,
     type => 5,
     value => 'f'
@@ skipping 33 matching lines @@
     ensure => present,
     type => 3,
     value => '50',
   }
 
   Discourse::Customservice <| |> {
     user => 'discourse',
     workdir => '/opt/discourse',
     env => ['RAILS_ENV=production', 'RUBY_GC_MALLOC_LIMIT=90000000',
       'UNICORN_WORKERS=2', 'LD_PRELOAD=/usr/lib/libjemalloc.so.1'],
-    require => Exec['/usr/local/bin/init-discourse']
+    require => Exec['init-discourse']

[mathias, 2015/05/09 15:34:19]

Wouldn't it make more sense to make it subscribe to all
Discourse::Sitesetting[]s? (Then Exec['init-discourse'] is covered as well.)

[Wladimir Palant, 2015/05/11 15:00:42]

Not sure whether the services should really be considered dependent on the
settings. Given that these settings are non-essential (the essential ones are in
discourse.conf) and can be changed via web UI - I think they shouldn't prevent
the services from starting up.

   }
 
   discourse::customservice {'discourse':
-    command => 'bundle exec config/unicorn_launcher -c config/unicorn.conf.rb',
+    command => '/home/discourse/.rvm/bin/rvm default do bundle exec config/unicorn_launcher -c config/unicorn.conf.rb',
     require => File['/opt/discourse/tmp/pids'],
   }
 
   discourse::customservice {'sidekiq':
-    command => 'bundle exec sidekiq'
+    command => '/home/discourse/.rvm/bin/rvm default do bundle exec sidekiq'
   }
 
   class {'nginx':
     worker_processes => 1,
     worker_connections => 500
   }
 
   nginx::hostconfig{$domain:
     source => 'puppet:///modules/discourse/site.conf',
     global_config => '
       upstream discourse {
         server localhost:3000;
       }',
     is_default => $is_default,
     certificate => $certificate,
     private_key => $private_key,
     log => 'access_log_intraforum'
   }
 }