Issue 1094 - Generate update manifests on the update server

modules/updateserver/manifests/init.pp

 class updateserver(
     $domain,
     $certificate,
     $private_key,
     $is_default=false
   ) {
   class {'nginx':
     worker_processes => 2,
     worker_connections => 4000,
     ssl_session_cache => off,
   }
 
   File {
     owner => root,
     group => root
   }
 
   file {'/var/www':
     ensure => directory,
     mode => 0755,
     require => Package['nginx']
   }
 
-  file {'/var/www/update':
+  $update_dir = '/var/www/update'
+
+  file {"${update_dir}":

[Wladimir Palant, 2014/07/25 09:50:11]

Why put it into quotation marks here?

file {$update_dir:

[Felix Dahlke, 2014/07/25 10:31:15]

Done.

     ensure => directory,
     mode => 0755
   }
 
-  file {'/var/www/update/adblockplusie':
+  $update_manifest_dirs = ["${update_dir}/adblockplus",
+                           "${update_dir}/adblockplusandroid",
+                           "${update_dir}/adblockplussafari"]
+
+  file {$update_manifest_dirs:
     ensure => directory,
     mode => 0755
   }
 
-  file {'/var/www/update/adblockplusie/update.json':
+  file {"${update_dir}/adblockplusie":
+    ensure => directory,
+    mode => 0755
+  }
+
+  file {"${update_dir}/adblockplusie/update.json":
     ensure => file,
     source => 'puppet:///modules/updateserver/adblockplusie/update.json',
     mode => 0644
   }
 
   nginx::hostconfig{$domain:
     source => 'puppet:///modules/updateserver/site.conf',
     is_default => $is_default,
     certificate => $certificate,
     private_key => $private_key,
     log => 'access_log_update'
   }
+
+  class {'sitescripts':
+    sitescriptsini_source => 'puppet:///modules/updateserver/sitescripts'
+  }
+
+  $base_dir = '/var/lib/adblockplus'
+
+  file {$base_dir:
+    ensure => directory,
+    mode => 0755
+  }
+
+  $safari_certificate_path = "${base_dir}/adblockplussafari.pem"
+
+  file {$safari_certificate_path:
+    source => 'puppet:///modules/private/adblockplussafari.pem'
+  }
+
+  $repositories_to_sync = ['downloads', 'adblockplus', 'adblockplusandroid',
+                           'adblockpluschrome', 'elemhidehelper', 'abpwatcher',
+                           'abpcustomization', 'urlfixer']
+
+  define fetch_repository() {
+    $repository_path = "${updateserver::base_dir}/${title}"
+    exec {"fetch_repository_${title}":
+      command => "hg clone https://hg.adblockplus.org/${title} ${repository_path}",
+      path => '/usr/bin',
+      timeout => 0,
+      onlyif => "test ! -d ${repository_path}",
+      require => [Package['mercurial'], File[$updateserver::base_dir]]
+    }
+  }
+
+  fetch_repository {$repositories_to_sync: }
+
+  $update_update_manifests_script = '/usr/local/bin/update_update_manifests'
+
+  file {$update_update_manifests_script:
+    mode => '0755',
+    content => template('updateserver/update_update_manifests.erb')
+  }
+
+  $update_update_manifests_dependencies = ['python-m2crypto', 'python-jinja2']
+
+  package {$update_update_manifests_dependencies:}
+
+  exec {'update_update_manifests':
+    command => $update_update_manifests_script,
+    timeout => 0,
+    require => [Exec['fetch_sitescripts'],
+                Fetch_repository[$repositories_to_sync],
+                File[$update_update_manifests_script],
+                File[$update_manifest_dirs], File[$safari_certificate_path],
+                Package[$update_update_manifests_dependencies]]
+  }
+
+  cron {'update_update_manifests':
+    ensure => present,
+    environment => ['MAILTO=admins@adblockplus.org'],
+    command => $update_update_manifests_script,

[Wladimir Palant, 2014/07/25 09:50:11]

I'd rather not have anything from sitescripts run as root unless there is a very
good reason for that. Please have some user that will own the manifest
directories and run sitescripts.

[Felix Dahlke, 2014/07/25 10:31:15]

I actually started out having a dedicated user for this, but it's more hassle,
and I didn't really see any reason why it shouldn't run as root, we're not
running any externally available services here.

We can go with a dedicated user if you really think it's an issue though. One
problem I had was that I couldn't think of a good name for one, suggestions?

[Wladimir Palant, 2014/07/25 11:11:02]

The reason is that we have less reason to worry about the quality of our
sitescripts contents (security-wise and otherwise).
Yes, please.
sitescripts?

[Felix Dahlke, 2014/07/25 14:17:56]

Done.

+    minute => '*/10',
+    require => Exec['update_update_manifests']
+  }
 }