Issue 1094 - Generate update manifests on the update server

modules/updateserver/manifests/init.pp

 class updateserver(
     $domain,
     $certificate,
     $private_key,
     $is_default=false
   ) {
   class {'nginx':
     worker_processes => 2,
     worker_connections => 4000,
     ssl_session_cache => off,
   }
 
   File {
     owner => root,
     group => root
   }
 
   file {'/var/www':
     ensure => directory,
     mode => 0755,
     require => Package['nginx']
   }
 
   $update_dir = '/var/www/update'
 
-  file {"${update_dir}":

[Wladimir Palant, 2014/07/25 09:50:11]

Why put it into quotation marks here?

file {$update_dir:

[Felix Dahlke, 2014/07/25 10:31:15]

Done.

+  file {$update_dir:
     ensure => directory,
     mode => 0755
   }
 
-  $update_manifest_dirs = ["${update_dir}/adblockplus",
+  $sitescripts_var_dir = '/var/lib/sitescripts'

[Felix Dahlke, 2014/07/25 14:21:01]

This was /var/lib/adblockplus before. This is now more confusing since we have
/opt/sitescripts, which suggests it's a all-in-one package, and then we have
these runtime files here in the proper FHS place.

I don't see a better way without changing the sitescripts module though.
/opt/sitescripts is a hg repository, adding files not under version control
there seems worse. I suppose the cleanest way would be to move /opt/sitescripts
to /usr/lib/sitescripts.

+
+  user {'sitescripts':
+    ensure => present,
+    home => $sitescripts_var_dir
+  }
+
+  file {$sitescripts_var_dir:
+    ensure => directory,
+    mode => 0755,
+    owner => 'sitescripts',
+    group => 'sitescripts'
+  }
+
+  $update_manifest_dirs = ["${update_dir}/gecko",
                            "${update_dir}/adblockplusandroid",
                            "${update_dir}/adblockplussafari"]
 
   file {$update_manifest_dirs:
     ensure => directory,
-    mode => 0755
+    mode => 0755,
+    owner => 'sitescripts',
+    group => 'sitescripts'
   }
 
   file {"${update_dir}/adblockplusie":
     ensure => directory,
     mode => 0755
   }
 
   file {"${update_dir}/adblockplusie/update.json":
     ensure => file,
     source => 'puppet:///modules/updateserver/adblockplusie/update.json',
     mode => 0644
   }
 
   nginx::hostconfig{$domain:
     source => 'puppet:///modules/updateserver/site.conf',
     is_default => $is_default,
     certificate => $certificate,
     private_key => $private_key,
     log => 'access_log_update'
   }
 
   class {'sitescripts':
     sitescriptsini_source => 'puppet:///modules/updateserver/sitescripts'
   }
 
-  $base_dir = '/var/lib/adblockplus'
-
-  file {$base_dir:
-    ensure => directory,
-    mode => 0755
-  }
-
-  $safari_certificate_path = "${base_dir}/adblockplussafari.pem"
+  $safari_certificate_path = "${sitescripts_var_dir}/adblockplussafari.pem"
 
   file {$safari_certificate_path:
     source => 'puppet:///modules/private/adblockplussafari.pem'
   }
 
   $repositories_to_sync = ['downloads', 'adblockplus', 'adblockplusandroid',
                            'adblockpluschrome', 'elemhidehelper', 'abpwatcher',
                            'abpcustomization', 'urlfixer']
 
   define fetch_repository() {
-    $repository_path = "${updateserver::base_dir}/${title}"
+    $repository_path = "${updateserver::sitescripts_var_dir}/${title}"
     exec {"fetch_repository_${title}":
-      command => "hg clone https://hg.adblockplus.org/${title} ${repository_path}",
-      path => '/usr/bin',
+      command => "hg clone -U https://hg.adblockplus.org/${title} ${repository_path}",
+      path => '/usr/local/bin:/usr/bin:/bin',
+      user => 'sitescripts',
       timeout => 0,
       onlyif => "test ! -d ${repository_path}",
-      require => [Package['mercurial'], File[$updateserver::base_dir]]
+      require => [Package['mercurial'], File[$updateserver::sitescripts_var_dir]]
     }
   }
 
   fetch_repository {$repositories_to_sync: }
 
   $update_update_manifests_script = '/usr/local/bin/update_update_manifests'
 
   file {$update_update_manifests_script:
     mode => '0755',
     content => template('updateserver/update_update_manifests.erb')
   }
 
   $update_update_manifests_dependencies = ['python-m2crypto', 'python-jinja2']
 
   package {$update_update_manifests_dependencies:}
 
   exec {'update_update_manifests':
     command => $update_update_manifests_script,
+    user => 'sitescripts',
     timeout => 0,
     require => [Exec['fetch_sitescripts'],
                 Fetch_repository[$repositories_to_sync],
                 File[$update_update_manifests_script],
                 File[$update_manifest_dirs], File[$safari_certificate_path],
                 Package[$update_update_manifests_dependencies]]
   }
 
   cron {'update_update_manifests':
     ensure => present,
     environment => ['MAILTO=admins@adblockplus.org'],
     command => $update_update_manifests_script,

[Wladimir Palant, 2014/07/25 09:50:11]

I'd rather not have anything from sitescripts run as root unless there is a very
good reason for that. Please have some user that will own the manifest
directories and run sitescripts.

[Felix Dahlke, 2014/07/25 10:31:15]

I actually started out having a dedicated user for this, but it's more hassle,
and I didn't really see any reason why it shouldn't run as root, we're not
running any externally available services here.

We can go with a dedicated user if you really think it's an issue though. One
problem I had was that I couldn't think of a good name for one, suggestions?

[Wladimir Palant, 2014/07/25 11:11:02]

The reason is that we have less reason to worry about the quality of our
sitescripts contents (security-wise and otherwise).
Yes, please.
sitescripts?

[Felix Dahlke, 2014/07/25 14:17:56]

Done.

+    user => 'sitescripts',
     minute => '*/10',
     require => Exec['update_update_manifests']
   }
 }