#3927 - Clear Nginx cache when notifications are updated

modules/notificationserver/manifests/init.pp

 class notificationserver($is_default = false) {
 
   include nginx
 
   class {'sitescripts':
     sitescriptsini_source => 'puppet:///modules/notificationserver/sitescripts.ini'
   }
 
   exec {'fetch_notifications':
     command => 'hg clone --noupdate https://hg.adblockplus.org/notifications /opt/notifications && chown -R nginx /opt/notifications',
     path => ['/usr/bin/', '/bin/'],
     require => [
       Package['mercurial'],
       User['nginx'],
     ],
     onlyif => 'test ! -d /opt/notifications'
   }
 
   # http://hub.eyeo.com/issues/3927
-  $clear_cache = "find /var/cache/nginx/notification -type f -exec rm -rf {} +"
+  $cache_flush = 'find /var/cache/nginx/notification -type f -exec rm -rf {} +'
+  $cache_user = 'www-data'
 
   # https://linux.die.net/man/5/sudoers
-  file {"/etc/sudoers.d/notification-cache":
-    content => "nginx ALL=(www-data) NOPASSWD:/usr/bin/$clear_cache\n",

[f.nicolaisen, 2017/09/28 11:05:25]

Consider extracting 'www-data' here and below to make it obvious that they are
coupled.

[mathias, 2017/09/28 12:00:00]

Acknowledged.

+  file {'/etc/sudoers.d/notification-cache':
+    content => "nginx ALL=($cache_user) NOPASSWD:/usr/bin/$cache_flush\n",
     ensure => 'present',
     group => 'root',
     mode => '0440',
     owner => 'root',
   }
 
   # https://docs.puppet.com/puppet/latest/types/augeas.html
-  augeas {"files/opt/notifications/.hg/hgrc/hooks/cache":
-    changes => ["set hooks/changegroup.cache 'sudo -u www-data $clear_cache'"],
+  augeas {'files/opt/notifications/.hg/hgrc/hooks/cache':
+    changes => [
+      "set hooks/changegroup.cache 'sudo -u $cache_user $cache_flush'",
+    ],
     incl => '/opt/notifications/.hg/hgrc',

[f.nicolaisen, 2017/09/28 11:05:25]

No dependency on the notifications repo having been cloned already.

[mathias, 2017/09/28 12:00:00]

Acknowledged.

Interestingly we just recently learned that the behavior of Puppet changed here
somewhere in the late 3.x versions:

"The order of resources in a Puppet manifest does not matter. Puppet assumes
that most resources are not related to each other and will manage the resources
in whatever order is most efficient." (2.x)

vs.

"By default, Puppet applies resources in the order they’re declared in their
manifest. However, if a group of resources must always be managed in a specific
order, you should explicitly declare such relationships with relationship
metaparameters, chaining arrows, and the require function." (4.x)

Nonetheless I prefer explicit notation of relationships anyway.

-    lens => "Puppet.lns",
+    lens => 'Puppet.lns',
+    require => [
+      Exec['fetch_notifications'],
+      File['/etc/sudoers.d/notification-cache'],
+    ],
   }
 
   cron {'update_notifications':
     command => 'hg pull -q -u -R /opt/notifications',
     environment => hiera('cron::environment', []),
     minute => '2-59/20',
     user => 'nginx',
     require => Exec['fetch_notifications'],
   }
 
@@ skipping 26 matching lines @@
   nginx::hostconfig{'notification.adblockplus.org':
     source => 'puppet:///modules/notificationserver/site.conf',
     global_config => template('notificationserver/global.conf.erb'),
     is_default => $is_default,
     certificate => 'easylist-downloads.adblockplus.org_sslcert.pem',
     private_key => 'easylist-downloads.adblockplus.org_sslcert.key',
     log => 'access_log_notification',
     log_format => 'notification',
   }
 }