cookbooks/oxidized/recipes/default.rb

   1 #
   2 # Cookbook:: oxidized
   3 # Recipe:: default
   4 #
   5 # Copyright:: 2022, OpenStreetMap Foundation
   6 #
   7 # Licensed under the Apache License, Version 2.0 (the "License");
   8 # you may not use this file except in compliance with the License.
   9 # You may obtain a copy of the License at
  10 #
  11 #     https://www.apache.org/licenses/LICENSE-2.0
  12 #
  13 # Unless required by applicable law or agreed to in writing, software
  14 # distributed under the License is distributed on an "AS IS" BASIS,
  15 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16 # See the License for the specific language governing permissions and
  17 # limitations under the License.
  18 #
  19
  20 include_recipe "git"
  21 include_recipe "ruby"
  22
  23 package %w[
  24   gcc
  25   g++
  26   make
  27   cmake
  28   libssl-dev
  29   libssh2-1-dev
  30   zlib1g-dev
  31   pkg-config
  32 ]
  33
  34 keys = data_bag_item("oxidized", "keys")
  35 devices = data_bag_item("oxidized", "devices")
  36
  37 directory "/etc/oxidized" do
  38   owner "root"
  39   group "root"
  40   mode "755"
  41 end
  42
  43 template "/etc/oxidized/config" do
  44   source "config.erb"
  45   owner "oxidized"
  46   group "oxidized"
  47   mode "444"
  48   notifies :restart, "service[oxidized]"
  49 end
  50
  51 template "/etc/oxidized/routers.db" do
  52   source "routers.db.erb"
  53   owner "oxidized"
  54   group "oxidized"
  55   mode "400"
  56   variables :devices => devices
  57   notifies :restart, "service[oxidized]"
  58 end
  59
  60 directory "/var/log/oxidized" do
  61   owner "oxidized"
  62   group "oxidized"
  63   mode "755"
  64 end
  65
  66 directory "/opt/oxidized" do
  67   owner "oxidized"
  68   group "oxidized"
  69   mode "755"
  70 end
  71
  72 git "/opt/oxidized/daemon" do
  73   action :sync
  74   repository "https://github.com/openstreetmap/oxidized.git"
  75   depth 1
  76   user "oxidized"
  77   group "oxidized"
  78   notifies :run, "bundle_install[/opt/oxidized/daemon]"
  79 end
  80
  81 directory "/opt/oxidized/.ssh" do
  82   owner "oxidized"
  83   group "oxidized"
  84   mode "700"
  85 end
  86
  87 # Key is set as a deployment key in github repo
  88 file "/opt/oxidized/.ssh/id_rsa" do
  89   content keys["git"].join("\n")
  90   owner "oxidized"
  91   group "oxidized"
  92   mode "400"
  93   notifies :delete, "file[/opt/oxidized/.ssh/id_rsa.pub]", :immediately
  94   notifies :restart, "service[oxidized]"
  95 end
  96
  97 # Ensure public key is deleted if private key is changed. Trigged by notify
  98 file "/opt/oxidized/.ssh/id_rsa.pub" do
  99   action :nothing
 100 end
 101
 102 execute "/opt/oxidized/.ssh/id_rsa.pub" do
 103   command "ssh-keygen -f /opt/oxidized/.ssh/id_rsa -y > /opt/oxidized/.ssh/id_rsa.pub"
 104   user "oxidized"
 105   group "oxidized"
 106   creates "/opt/oxidized/.ssh/id_rsa.pub"
 107   notifies :restart, "service[oxidized]"
 108 end
 109
 110 ssh_known_hosts_entry "github.com" do
 111   file_location "/opt/oxidized/.ssh/known_hosts"
 112   owner "oxidized"
 113   group "oxidized"
 114 end
 115
 116 ssh_known_hosts_entry "github.com_flush" do
 117   action :flush
 118   file_location "/opt/oxidized/.ssh/known_hosts"
 119 end
 120
 121 directory "/var/lib/oxidized" do
 122   owner "oxidized"
 123   group "oxidized"
 124   mode "750"
 125 end
 126
 127 git "/var/lib/oxidized/configs.git" do
 128   action :sync
 129   repository "git@github.com:openstreetmap/oxidized-configs.git" # Uses oxidized ssh key
 130   checkout_branch "master" # branch is hardcoded in oxidized
 131   user "oxidized"
 132   group "oxidized"
 133 end
 134
 135 bundle_install "/opt/oxidized/daemon" do
 136   action :nothing
 137   options "--deployment"
 138   user "oxidized"
 139   group "oxidized"
 140   notifies :restart, "service[oxidized]"
 141 end
 142
 143 # Based on https://github.com/ytti/oxidized/blob/master/extra/oxidized.service
 144 systemd_service "oxidized" do
 145   description "oxidized network device backup daemon"
 146   after "network.target"
 147   user "oxidized"
 148   working_directory "/opt/oxidized/daemon"
 149   runtime_directory "oxidized"
 150   exec_start "#{node[:ruby][:bundle]} exec oxidized"
 151   environment "OXIDIZED_HOME" => "/etc/oxidized",
 152               "OXIDIZED_LOGS" => "/var/log/oxidized"
 153   nice 10
 154   private_tmp true
 155   private_devices true
 156   protect_system "full"
 157   protect_home true
 158   no_new_privileges true
 159   restart "on-failure"
 160   notifies :restart, "service[oxidized]"
 161 end
 162
 163 service "oxidized" do
 164   action [:enable, :start]
 165 end
 166
 167 template "/etc/logrotate.d/oxidized" do
 168   source "logrotate.erb"
 169   owner "root"
 170   group "root"
 171   mode "644"
 172 end