Drop blackhole IPv6 route from Dublin to cogent block in Amsterdam

[chef.git] / cookbooks / oxidized / recipes / default.rb

diff --git a/cookbooks/oxidized/recipes/default.rb b/cookbooks/oxidized/recipes/default.rb
index 0ea5ec1f6184dcb14c1640cefe724f94e19191cf..7e4803c70299c3554f97eb9c06e9f623ed0ec88b 100644 (file)
--- a/cookbooks/oxidized/recipes/default.rb
+++ b/cookbooks/oxidized/recipes/default.rb
@@ -63,38 +63,63 @@ directory "/var/log/oxidized" do
   mode "755"
 end
 
   mode "755"
 end
 

-git "/opt/oxidized" do
+directory "/opt/oxidized" do
+  owner "oxidized"
+  group "oxidized"
+  mode "755"
+end
+
+git "/opt/oxidized/daemon" do

   action :sync
   repository "https://github.com/openstreetmap/oxidized.git"
   depth 1
   user "oxidized"
   group "oxidized"
   action :sync
   repository "https://github.com/openstreetmap/oxidized.git"
   depth 1
   user "oxidized"
   group "oxidized"

-  notifies :run, "bundle_install[/opt/oxidized]"
+  notifies :run, "bundle_install[/opt/oxidized/daemon]", :immediately
+end
+
+directory "/opt/oxidized/.ssh" do
+  owner "oxidized"
+  group "oxidized"
+  mode "700"

 end
 
 # Key is set as a deployment key in github repo
 end
 
 # Key is set as a deployment key in github repo

-file "/opt/oxidized/.ssh/id_rsa" do
+file "/opt/oxidized/.ssh/id_ed25519" do

   content keys["git"].join("\n")
   owner "oxidized"
   group "oxidized"
   mode "400"
   content keys["git"].join("\n")
   owner "oxidized"
   group "oxidized"
   mode "400"

-  notifies :delete, "file[/opt/oxidized/.ssh/id_rsa.pub]", :immediately
+  notifies :delete, "file[/opt/oxidized/.ssh/id_ed25519.pub]", :immediately

   notifies :restart, "service[oxidized]"
 end
 
 # Ensure public key is deleted if private key is changed. Trigged by notify
   notifies :restart, "service[oxidized]"
 end
 
 # Ensure public key is deleted if private key is changed. Trigged by notify

-file "/opt/oxidized/.ssh/id_rsa.pub" do
+file "/opt/oxidized/.ssh/id_ed25519.pub" do

   action :nothing
 end
 
   action :nothing
 end
 

-execute "/opt/oxidized/.ssh/id_rsa.pub" do
-  command "ssh-keygen -f /opt/oxidized/.ssh/id_rsa -y > /opt/oxidized/.ssh/id_rsa.pub"
+execute "/opt/oxidized/.ssh/id_ed25519.pub" do
+  command "ssh-keygen -f /opt/oxidized/.ssh/id_ed25519 -y > /opt/oxidized/.ssh/id_ed25519.pub"

   user "oxidized"
   group "oxidized"
   user "oxidized"
   group "oxidized"

-  creates "/opt/oxidized/.ssh/id_rsa.pub"
+  creates "/opt/oxidized/.ssh/id_ed25519.pub"

   notifies :restart, "service[oxidized]"
 end
 
   notifies :restart, "service[oxidized]"
 end
 

+ssh_known_hosts_entry "github.com" do
+  action [:create, :flush]
+  file_location "/opt/oxidized/.ssh/known_hosts"
+  owner "oxidized"
+  group "oxidized"
+end
+
+directory "/var/lib/oxidized" do
+  owner "oxidized"
+  group "oxidized"
+  mode "750"
+end
+

 git "/var/lib/oxidized/configs.git" do
   action :sync
   repository "git@github.com:openstreetmap/oxidized-configs.git" # Uses oxidized ssh key
 git "/var/lib/oxidized/configs.git" do
   action :sync
   repository "git@github.com:openstreetmap/oxidized-configs.git" # Uses oxidized ssh key


@@ -103,7 +128,7 @@ git "/var/lib/oxidized/configs.git" do
   group "oxidized"
 end
 
   group "oxidized"
 end
 

-bundle_install "/opt/oxidized" do
+bundle_install "/opt/oxidized/daemon" do

   action :nothing
   options "--deployment"
   user "oxidized"
   action :nothing
   options "--deployment"
   user "oxidized"


@@ -116,16 +141,14 @@ systemd_service "oxidized" do
   description "oxidized network device backup daemon"
   after "network.target"
   user "oxidized"
   description "oxidized network device backup daemon"
   after "network.target"
   user "oxidized"

-  working_directory "/opt/oxidized"
+  working_directory "/opt/oxidized/daemon"
+  runtime_directory "oxidized"

   exec_start "#{node[:ruby][:bundle]} exec oxidized"
   environment "OXIDIZED_HOME" => "/etc/oxidized",
               "OXIDIZED_LOGS" => "/var/log/oxidized"
   nice 10
   exec_start "#{node[:ruby][:bundle]} exec oxidized"
   environment "OXIDIZED_HOME" => "/etc/oxidized",
               "OXIDIZED_LOGS" => "/var/log/oxidized"
   nice 10

-  private_tmp true
-  private_devices true
-  protect_system "full"
-  protect_home true
-  no_new_privileges true
+  sandbox :enable_network => true
+  read_write_paths ["/run/oxidized", "/var/lib/oxidized", "/var/log/oxidized"]

   restart "on-failure"
   notifies :restart, "service[oxidized]"
 end
   restart "on-failure"
   notifies :restart, "service[oxidized]"
 end